Intel x86 CPU's are top secret information apparently. The smaller models are built using various models of SoC like Broadcom.   On the MX models I've pulled the cases off they have serial ports on the motherboard where you can watch the bootup sequence in plaintext, alternatively just pull the heatsink off and look. ... View more

I agree with you.The MX product line has stagnated. The simple fact is that Meraki MX devices aren't suitable for all deployments as a firewall. They certainly have their place and for many customers they fit very well in certain sections of the network but they can't be installed everywhere. ... View more

Assuming you have an internal VLAN with publically routed IP addressing you'll need the no-NAT and the inbound firewall rule features enabled to get that working. ... View more

Did they fix the issue where the firewalls forward traffic on their LAN ports before configuration is applied when the MX reboots? Have only been waiting 4 years for that one to be fixed, oh well. Can't rush these things 🙄 ... View more

Fortigates can do up to 512 WAN links when setup using SDWAN, just saying. ... View more

Only one license as the only HA option is active / passive, so only one device is forwarding traffic at any time. No changes to licensing needed when failing over either automatically or manually via the button in Dashboard. ... View more

MX's are all rate-limited internally so they line up nicely on the spec sheet.   Like when the Z1 got nerfed years ago. ... View more

Corrected a race condition that could result in small amounts of traffic improperly flowing between the WAN and LAN during system bootup on MX64(W) and MX65(W) appliances. Wow, only took three years of waiting for this fix. Reported multiple tickets on this and each time engineering always said "working as designed". I wonder what it took for them to finally take this seriously and fix it. Hopefully also includes other platforms as the MX84,100 also leak data between LAN and WAN on reboot, like STP which can cause BPDU guard to kick in. ... View more

The MX84 WAN1 and WAN2 ports are 10/100/1000 while the MM-SFP-1G-TX is only 1000. It won't come up if the handoff port is a lower speed. ... View more

No you need to use the labelled ports. You will need an SFP module but be careful with the speed of the SFP module and coax modem ethernet port. ... View more

Thats not totally correct. For regular flows originating from inside to outside the MX will only use the WAN interface address for source NAT.   The "Port forwarding" section uses the MX interface WAN address, the "1:Many" and "1:1 NAT" sections lets you specify an IP address to use for NAT. Return traffic for these sessions uses the correct address. ... View more

Yes we have also noticed higher CPU and lower VPN throughput as a result of this issue. There is a note in 16.4 which states "Significant performance regressions for VPN traffic may be observed on MX84 and MX100 appliances" and I suspect this is present prior to this release. ... View more

FPGA isn't needed. Dedicated security processors like Cavium exist for this. Some Juniper SRX and Paloalto firewalls are based on Cavium for forwarding because of the offloading from a general purpose CPU.   Using a dedicated processor like Cavium doesn't line up with the "Meraki way" of using OpenWRT for everything with extras added on top though. ... View more

Keep in mind though that even if an MX has certain hardware inside Meraki artificially add policers to limit throughput so the models line up nicely in the sizing guide. Remember the times when Z1 was not limited until a certain software version introduced the policer? ... View more

The last MX64 that I pulled apart used a Broadcom SoC 50586 or something along those lines. Dual core ARMv7. Serial console on the motherboard. Nothing secret as it was all easily available.   U-Boot 2012.10-00099-g7c856f3 (Mar 19 2015 - 12:00:01)Meraki MX64 Boot Kernel Loader [ 0.000000] Booting Linux on physical CPU 0 [ 0.000000] Linux version 3.4.109+ (meraki@buildbot106.meraki.com) (gcc version 4.8.3 (GCC) ) #3 SMP Wed Jun 15 15:00:28 PDT 2016 [ 0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c5387d [ 0.080000] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.160000] hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 7 counters available [ 0.180000] CPU1: Booted secondary processor [ 0.340000] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.340000] Brought up 2 CPUs [ 0.340000] SMP: Total of 2 processors activated (4780.85 BogoMIPS).   An faulty MX84 we had was on a C2000 series Intel dual core from memory. Again no rocket science here. ... View more

For a template you can schedule the update for the template to happen sometime in the future, then re-schedule individual networks to happen at different times to the template. ... View more

Put a router in front of the MX to terminate one of the DIA services + the 4G. MX keeps one DIA service + a connection to the router in front. ... View more

This will let you specifiy a different blacklist (and/or different category list) per VLAN which is what the original request was. Use append and the global blacklist and categories to apply firewall wide (all VLAN's) and the VLAN specific list for granular filtering. ... View more

Not advisable for the middle of production hours.   If I'm not mistaken swapping the MX's over in the warm spare topology will induce a reboot of both firewalls. This will break all user sessions. Certainly noticable. ... View more

  Apply a group policy to the VLAN that has URL filtering set to Override. Leave the list empty or populate with whatever, same for URL categories. ... View more

The MX84 and MX100 use Intel CPU's where the smaller MX firewalls use ARM cores. Does this mean Anyconnect isn't supported on the ARM CPU devices? ... View more

Only AutoVPN routes are announced over the eBGP session. If you don't have any other site to site (AutoVPN) peers nothing will be announced from MX to router. You can still send routes to the MX from the router and they should show up in the routing table. ... View more

This is all part of the Meraki "Magic" 🙂 Wait until you come across the MX250 template bug.   Sometimes settings just don't work on MX. Yesterday for me it was SNMPv2 just would not poll for one site, change the community string to a temporary value then back to the original and all of a sudden SNMP polling is working again. ... View more