Hi with the current setup: MX64 LAN on MX250 LAN, an L3 firewall does not work on either the MX64 or the MX250 The current setup looks like this: Transfer network 10.100.110.104/30 VLAN 4000 MX64 IP 10.100.110.105 MX250 IP 10.100.110.106 MX250 Static Route: to remote LAN 192.168.0.0/24 gw 10.100.110.105 MX64 Static Route: to local LAN 172.18.5.0/24 gw 10.100.110.106 This setup works. But as described, only without a firewall. Now let's assume that a computer with the IP 192.168.0.10 should access a server 172.18.5.99. And nothing else in the 172 LAN. I have created the following L3 rules. InboundRule that looks like this. Deny TestRule1 Any 192.168.0.10/32 Any 172.15.5.99/32 Any And an outbound rule that looks like this. Deny TestRule1 Any 172.15.5.99/32 Any 192.168.0.10/32 Any The same on the MX250. I can still reach the server without any problems. Or ping the client from the server. Even if I put a deny for both subnets, it still works. And here the Meraki support told me that it is because the two MX see themselves as clients and I cannot regulate the traffic via the firewall. That would probably only work if the local LAN was connected to the MX64. But this is not the case, as the MX64 only serves as a non-Meraki VPN gateway. Hence the idea from support to do this via a no-NAT on WAN2 of the MX64. This brings me to my problem that I can only reach the WAN2 interface from the local network and the traffic does not go through the non-Meraki VPN.
... View more
