Do you have Umbrella enabled ? if so you need to create VPN exclusion rules in Local internet breakout.   otherwise traffic vom the NAT-Client will be send into umbrella and will be blocked. this is however only configurable in SDWAN hub-mode. ... View more

I think for this requirement you can use the MR36H Model very good. It comes with a second LAN port which you can connect to your switch and the MR36H joins the WiFi like a client. You can also bridge diffrent VLANs.   https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/Port_Profiles ... View more

If the MX does use automatically WAN2 when WAN1 goes down and you are connected to either a Cisco ASA or FTD. You can simply configure the tunnel on the ASA/FTD twice.   If WAN2 does not answer to the ASA/FTD as long as WAN1 is working only one tunnel is UP at a time.   You can setup a second tunnel is ASA/FTD as long as the destination public ip of the tunnel is diffrent. The SA of the tunnel can be the same. ... View more