Cisco 500-220 - Engineering Cisco Meraki Solutions (ECMS) v2.2

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences#Load_Balancing

iOS devices that are using Apple's Device Enrollment Program (DEP) can be supervised and enrolled over-the-air anytime they are factory reset. DEP is the best way to permanently force your devices to be owned and managed by your organization, and it is important to assign your DEP settings properly before deployment. https://documentation.meraki.com/SM/Device_Enrollment/Enrolling_and_Supervising_iOS_Devices_using_Apple_Configurator_2.5_or_Later#:~:text=DEP%20is%20the%20best%20way,DEP%20settings%20properly%20before%20deployment .

What happens if a network loses connectivity to the Meraki cloud?

Because of Meraki’s out of band architecture, most end users are not affected if Meraki wireless APs, switches, or security appliances cannot

communicate with Meraki’s cloud services (e.g., because of a temporary WAN failure):

• Users can access the local network (printers, file shares, etc.)

• If WAN connectivity is available, users can access the Internet

• Network policies (firewall rules, QoS, etc.) continue to be enforced

• Users can authenticate via 802.1X/RADIUS and can roam wirelessly between access points

• Users can initiate and renew DHCP leases

• Established VPN tunnels continue to operate

• Local configuration tools are available (e.g., device IP configuration

https://meraki.cisco.com/lib/pdf/meraki_datasheet_cloud_management.pdf

Routed Mode:

This mode is the default mode of operation

This mode is generally also the default gateway for devices on the LAN

Client traffic to the internet has the source IP rewritten to match the WAN IP of the appliance

DHCP services can be configured on the MX appliance

Passthrough Mode:

The MX appliance acts as a layer 2 bridge

VLANs cannot be configured

No address translation is provided

This mode is not recommended at the network perimeter

This question is related to the topic of MX Addressing and VLANs in the Cisco Meraki documentation. You can find more information about this topic in the MX Addressing and VLANs article or the General MX Best Practices page.

"Inbound and outbound flows will generate a syslog message showing the source and destination along with port numbers and the firewall rule that they matched. For inbound rules, 1=deny and 0=allow." https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration

Table Description automatically generated with medium confidence

These are the two features and functions that are supported when using an MX appliance in Passthrough mode. According to the [MX Addressing and VLANs] article, Passthrough mode allows the MX appliance to act as a layer 2 bridge, passing traffic between its LAN and WAN ports without performing any routing or address translation. However, some features such as intrusion prevention and site-to-site VPN are still available in this mode.

Before deploying MXs as one-arm VPN concentrators, place them into Passthrough or VPN Concentrator mode on the Addressing and VLANs page. In one-armed VPN concentrator mode, the units in the pair are connected to the network "only" via their respective ‘Internet’ ports. Make sure they are NOT connected directly via their LAN ports. Each MX must be within the same IP subnet and able to communicate with each other, as well as with the Meraki dashboard. Only VPN traffic is routed to the MX, and both ingress and egress packets are sent through the same interface.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/Meraki_Auto_VPN_General_Best_Practices