The inbound firewall is controlled a little bit differently. The inbound firewall will deny any traffic that does not have a session initiated by a client behind the MX. This allows internal client machines to connect with any resources needed but does not let outside devices initiate connections with inside client machines.   https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Blocking_Inbound_Traffic_on_MX_Security_Appliances ... View more

This… as long as your switch can drop the user on a particular VLAN you should be fine.  ... View more

If the MX is not running a current stable firmware (or better) I would take the opportunity to upgrade it (which will do the reboot you mention as well). ... View more

If I had the choice - I would connect the MR to the MS.  The MS offers more monitoring and fault diagnosis tools.  Depending on your MS, the solution also supports additional things like SecurePort. https://documentation.meraki.com/MS/Access_Control/SecurePort_(formerly_known_as_SecureConnect)  ... View more

Two very small exceptions: A spare HA MX doesn't need a license, and the first five sensors also don't need licenses, as each org has five free MT licenses. ... View more