I see you as having two options.   Do a cutover migration.  Configure the Meraki switches with the same config as the current switches, and then on the day of the cut over move the WAN circuits across from the old to the new switches.  No changes are needed by the carrier.   Do a staged migration where both old and new kit are hot at the same time.  Yes, you'll need to change both /30s to /29's as you have stated, so everything can be online at the same time. ... View more

I've been testing a tighter ruleset for my CA enabled MVs. It appears allowing 443 to *.vision.meraki.com is working (in addition to the other cloud destinations needed for mgmt, streaming proxy, etc).   They appear to also need port 80 to 142.250.0.0/15 which must be part of the broader port 80 to any suggested rule. ... View more