Cisco support referred me to this link: . https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover#Connectivity_Tests   So yes in fact this is the expected behavior and there is no option to change it or specific a choice of IP addresses for the WAN connectivity test. It is interesting to note that with 8.8.8.8 dropped in my upstream firewall there is no failover attempt to use 209.206.55.10 or at least I see no ICMP traffic other than the attempts for 8.8.8.8, so the description of "209.206.55.10 or 8.8.8.8" must mean whichever IP Cisco decides to code in. I have also noticed that with 8.8.8.8 dropped, the Dashboard still shows the switch as Online, so I see no reason to open the firewall to allow ICMP to/from Google.    Thanks for all your input   ... View more

Yes, it appears it is uplink monitoring and 8.8.8.8 is the primary uplink check. I am surprised though that there is not a setting on the uplink management page to set the IP manually or at least select Cisco as the primary uplink host to check since firewall exceptions need to be made for Cisco Meraki management regardless. The less rules I have to manage the better. For the moment, I have created and exception to allow ICMP between the switch and 8.8.8.8, but normally I deny that on the management network, so I have had to make a specific exception for one switch.    I opened a ticket and will wait to see what the response is. Not holding my breath, but maybe Cisco will consider a firmware upgrade that provides a means to designate the uplink check to something other than Google.       ... View more

After upgrade I am still see ICMP pings to Google. I guess I will open support ticket and see what they say.   ... View more

@cmr Sounds like firmware upgrade is a good bet. I will do that and see if I continue to see this traffic. ... View more

@cmr By the way, packet capture shows that is is ICMP Echo (ping). I assume it is verification of Internet connectivity but why Google and not Cisco since I already created firewall rules to allow Cisco ... View more

The version is MS 12.28.1. According to the dashboard, this is up to date. ... View more

Yes, the uplink page of the local management shows the correct DNS (my servers). The uptime on my DNS cluster is 14 years (give or take). I have a well established cluster so I am not worried about my DNS servers being unavailable. If they are, I will have bigger issues than just this one switch.  What is more concerning to me is that the switch is attempting to connect to a foreign DNS server after I set the DNS to my own network. It is bad enough to have to blow a whole in my management network to let this thing communicate with Cisco (a /20 network, wow) on top of that it is attempting to communicate to a foreign DNS.    ... View more

To bel clear, yes the management IP of the switch. ... View more

That is correct. I noted that one of Google's DNS IP addresses (8.8.8.8) was being trapped in my firewall for the management IP and wondering why it would even being trying to query Google since I set the DNS to my own DNS server.  ... View more