Intel x86 CPU's are top secret information apparently. The smaller models are built using various models of SoC like Broadcom.   On the MX models I've pulled the cases off they have serial ports on the motherboard where you can watch the bootup sequence in plaintext, alternatively just pull the heatsink off and look. ... View more

I agree with you.The MX product line has stagnated. The simple fact is that Meraki MX devices aren't suitable for all deployments as a firewall. They certainly have their place and for many customers they fit very well in certain sections of the network but they can't be installed everywhere. ... View more

Assuming you have an internal VLAN with publically routed IP addressing you'll need the no-NAT and the inbound firewall rule features enabled to get that working. ... View more

Did they fix the issue where the firewalls forward traffic on their LAN ports before configuration is applied when the MX reboots? Have only been waiting 4 years for that one to be fixed, oh well. Can't rush these things 🙄 ... View more

Fortigates can do up to 512 WAN links when setup using SDWAN, just saying. ... View more

Only one license as the only HA option is active / passive, so only one device is forwarding traffic at any time. No changes to licensing needed when failing over either automatically or manually via the button in Dashboard. ... View more

MX's are all rate-limited internally so they line up nicely on the spec sheet.   Like when the Z1 got nerfed years ago. ... View more

Corrected a race condition that could result in small amounts of traffic improperly flowing between the WAN and LAN during system bootup on MX64(W) and MX65(W) appliances. Wow, only took three years of waiting for this fix. Reported multiple tickets on this and each time engineering always said "working as designed". I wonder what it took for them to finally take this seriously and fix it. Hopefully also includes other platforms as the MX84,100 also leak data between LAN and WAN on reboot, like STP which can cause BPDU guard to kick in. ... View more

The MX84 WAN1 and WAN2 ports are 10/100/1000 while the MM-SFP-1G-TX is only 1000. It won't come up if the handoff port is a lower speed. ... View more

No you need to use the labelled ports. You will need an SFP module but be careful with the speed of the SFP module and coax modem ethernet port. ... View more

Yes you still need to setup the WAN links on both MX250 locally before they will connect out to dashboard to grab their complate configuration.   The cloned network operates exactly like any other network, so same warm spare options etc. The reason for cloning is to keep the original network unmodified so you also have a rollback plan.   To keep the public IP addressing unique you would need to power off the MX84 if you don't have spare IP addressing in the public IP allocation from the ISP. WAN configuration IP addressing isn't validated and checked by Dashboard like LAN side settings are so no problem with duplicates. ... View more

You should plan for it all to break as soon as you remove the MX84's from the network. Use a hotspot off your mobile phone to maintain connectivity to Dashboard while adding / removing.   The second option would be to clone the existing network and put the MX250's in the clone. When you clone it will leave AutoVPN off. Once the MX250 are up and local internet is working you can disable / delete the old MX84 network and bring up VPN if needed. ... View more

Thats not totally correct. For regular flows originating from inside to outside the MX will only use the WAN interface address for source NAT.   The "Port forwarding" section uses the MX interface WAN address, the "1:Many" and "1:1 NAT" sections lets you specify an IP address to use for NAT. Return traffic for these sessions uses the correct address. ... View more

Yes we have also noticed higher CPU and lower VPN throughput as a result of this issue. There is a note in 16.4 which states "Significant performance regressions for VPN traffic may be observed on MX84 and MX100 appliances" and I suspect this is present prior to this release. ... View more

FPGA isn't needed. Dedicated security processors like Cavium exist for this. Some Juniper SRX and Paloalto firewalls are based on Cavium for forwarding because of the offloading from a general purpose CPU.   Using a dedicated processor like Cavium doesn't line up with the "Meraki way" of using OpenWRT for everything with extras added on top though. ... View more

Keep in mind though that even if an MX has certain hardware inside Meraki artificially add policers to limit throughput so the models line up nicely in the sizing guide. Remember the times when Z1 was not limited until a certain software version introduced the policer? ... View more

The last MX64 that I pulled apart used a Broadcom SoC 50586 or something along those lines. Dual core ARMv7. Serial console on the motherboard. Nothing secret as it was all easily available.   U-Boot 2012.10-00099-g7c856f3 (Mar 19 2015 - 12:00:01)Meraki MX64 Boot Kernel Loader [ 0.000000] Booting Linux on physical CPU 0 [ 0.000000] Linux version 3.4.109+ (meraki@buildbot106.meraki.com) (gcc version 4.8.3 (GCC) ) #3 SMP Wed Jun 15 15:00:28 PDT 2016 [ 0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c5387d [ 0.080000] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.160000] hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 7 counters available [ 0.180000] CPU1: Booted secondary processor [ 0.340000] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.340000] Brought up 2 CPUs [ 0.340000] SMP: Total of 2 processors activated (4780.85 BogoMIPS).   An faulty MX84 we had was on a C2000 series Intel dual core from memory. Again no rocket science here. ... View more

For a template you can schedule the update for the template to happen sometime in the future, then re-schedule individual networks to happen at different times to the template. ... View more

Put a router in front of the MX to terminate one of the DIA services + the 4G. MX keeps one DIA service + a connection to the router in front. ... View more

This will let you specifiy a different blacklist (and/or different category list) per VLAN which is what the original request was. Use append and the global blacklist and categories to apply firewall wide (all VLAN's) and the VLAN specific list for granular filtering. ... View more

Not advisable for the middle of production hours.   If I'm not mistaken swapping the MX's over in the warm spare topology will induce a reboot of both firewalls. This will break all user sessions. Certainly noticable. ... View more

  Apply a group policy to the VLAN that has URL filtering set to Override. Leave the list empty or populate with whatever, same for URL categories. ... View more