For those of you keeping track, I reached out Sept 13th for an update and this is the reply:   I've checked the investigation thread but there have not yet been any updates stating that this behavior has been resolved. I will be contacting our MX products team for confirmation of the current state of the investigation and will let you know if any of the recent firmware versions have a resolution for this behavior. Thank you for your patience, Christian Torres Network Support Engineer .ılı.ılı. Cisco Meraki ... View more

I can tell you that we are working on 18.107.2 and SNORT 2.9 with no seen issues yet. The 2nd Meraki was just update yesterday, so far so good. The SNORT 2.9 install is done on the backend, Cisco has to apply it. ... View more

Updated our other MX100 Monday to 18.107.2 and reverted to SNORT 2.9. Thoroughput looks good so far and we can now also test our VPN tunnel between the two MX100s. It does appear that changing SNORT to v2.9 has corrected the bandwidth issue. Cisco is also keeping the ticket open until they figure out the fix for SNORT 3.x.   Has anyone else with MX100s gone through this process so we can have validity spanning more than one install? ... View more

They did not, I took upon the assumption that 2.9 was going to have some issues since there is always some vulnerability, bug or feature issue in previous versions that get addressed in later versions. The process was really to determine the actual cause, not necessarily to be the most up to date. It still is better than being at 15.44 but I also expect to see Cisco address the issue and get it up to SNORT 3.x eventually. ... View more

Been running in the mode of Firmware 18.107.2 and revert back to SNORT 2.9 versus SNORT 3 for several days with all good throughput. I am asking to update my other MX100 the same way and see how the VPN operates as well. Will update once I get the results. Right now it appears the MX100 firmware cannot handle SNORT 3 ... View more

Replying to my own post so y'all can see the progression. Today Cisco removed SNORT 3.0 and replaced it with v2.9. I turned on IDS again for detection and connectivity. It appears the throughput has stabilized at around 870D/930U. We are going to run tests throughout today and tomorrow to see if it holds. It may be that the issue is with SNORT 3 only which I believe someone already guessed was the issue. ... View more

In the test we did yesterday, using different rule sets did not help. The only path to good throughput was to turn off IDS. See my comment below, I will report back Monday on the latest patch. ... View more

All, I finally got Meraki to confirm the issue with the firmware. Version 18.107.2 was supposed to fix it but it did not. I am working with them on a fix as we did validate that the degradation is associated with IDS. We spent over an hour yesterday doing tests with 18.107.2 applied and I am currently running the MX100 with that release but no IDS running and throughput is close to our expected levels. Cisco is creating a backend process for SNORT and will apply it on Monday morning during our next maintenance window. I will report back after that application of the backend process to see where we stand. ... View more

This is what is on the dashboards of MX100 users now:   MX100 Firmware Upgrade Notice: MX100s with firmware below version MX16.16 will likely become inoperable if upgraded to versions 17.10.5 or 18.1.07. Cisco Meraki will be canceling all currently-scheduled upgrades for MX models running the prior firmware versions to prevent device inoperability. If you need to upgrade to one of these versions in the immediate future, please reach out to Support for assistance. More information is available here: MX100 Scheduled Firmware Upgrade Cancellation   They obviously know they have an issue. Unfortunately with my open ticket, the support engineer is still wanting to do tests. I am at the point where I am asking for our support money back and looking at other manufacturer options.   Anyone have any different experiences lately?       ... View more

Does anyone have any updates on this issue? Meraki (a new support tech) is now saying the MX100 is over utilized (again). I had to remind them about the troubleshooting methods used back in the fall with no load and same results. They seem to be using this as an excuse to just get you to buy another device. I will let you know what I hear but they are slow to reply and don't seem to be talking amongst themselves as it appears some of us get "they know about the issue" and some just want to blame it on connections. ... View more

That is correct, and here we sit at 15.44 ... View more

We did try the latest 18.x release and it still does not fix the issue with MX100. This is only affecting MX100 and MX85 I believe. My ticket is still open and they want to try trouble shooting issues on our live system so not sure how that is going to work. Still waiting on Meraki to come up with a solution or just finally admit they have no solution and swap it out with a device known to work. ... View more

Thanks, I sent this into my case as well since they want us to try it. I am still on 15.44 since the bandwidth issue introduced in 16.X and wasn't addressed in 17.x either ... View more

As for:   Performance improvements for VPN traffic for Z3(C), MX84, and MX100 appliances. General performance improvements. These are most likely to be noticed in environments where MX appliances are processing a high volume of packets. Has anyone with a MX100 who has been having the WAN throughput degrade to over 50% after 15.44 tried this firmware? Cisco support says this release FINALLY fixes this issue and wondering if anyone has tried. ... View more

Well, not going to try 17.10.2 again, that was a mess to revert back to 15.44. I'll wait to 18.x and if it still has issues I'll try the IDS change but that just sounds wrong since when we upgrade there is no load on either of our networks. If that works then it is a programming issue with IDS, not a load issue. ... View more

Setting IDS to a lower security threshold doesn't sound like a proper solution to a "security appliance". We use Balanced here, and OK, if that is a work around temporarily, I understand, but that is not a "fix" to disable other security features to get a security appliance to work.  Does anyone have an open case number with TAC for this specific issue that is still open? ... View more

I actually never got any pushback from Cisco about this. They recognized it was an issue. Just never been able to fix it. One person narrowed it down from the SNORT upgrade in 16.x but not sure I can validate that. Everytime a new firmware update comes out I ask if it addresses this issue and most times the answer was "no". for 17.10.2 I was told it did fix it so I tried it. That's when we found out 17.10.2 was even worse. ... View more

Yes 17.10.2 made it even worse, agreed ... View more

I only have 2 site to site VPNs and one has only a 10mmb connection, the other is 1 GB. To say you are taxing the device is causing the issue is IMO just wrong. This was introduced in 16.X and wasn't gradual. Someone, somewhere programmed a change that caused this issue. I only have 1,000 users at one site and 600 at the other. These are kids doing chromebooks for the most part. The issue also happens when no one is on the network. We do upgrades when no one is around and our throughput testing was done when only about 2 people were on the network.  ... View more

Yes, on 16.x and 17.10.1 it only went down to 500Mbps so you would notice it if you have uplinks faster than that. Assuming, this is an issue that throttles back instead of just cutting performance. 17.10.2 was down to 300 - 250 Mbps. ... View more

I can verify it was not solved with this release. I had upgraded because Cisco did say it was fixed with this release. After upgrading it was actually even worse than 16.x and the prior 17.x releases. It also was more difficult to roll back to 15.44. It took 2 tries to get the MX100 stable again back on 15.44. I responded back to Cisco with my results, still waiting. ... View more

OK, Thanks, if they say it doesn't then I won't try it. Waiting for 18.x I guess. ... View more

OK, I see 17.10 is released but nothing in the change log about the ongoing problem with performance and SNORT. Anyone try it yet on a MX100 with Advanced Security? ... View more

Thanks for the update. We are a Advanced Security license and appliance so I guess I need to push that update to no. ... View more

Has anyone upgraded to 17.9 to see if it fixes the issue? Cisco says it should fix it but I am wondering if it really does and anyone can confirm. ... View more