meraki mx static ip assignment

Cisco Meraki MX Static IP assignment via Dashboard

This morning, I received a notice about a Cisco Meraki MX firmware upgrade planned for a security appliance I have in my lab.

The message lists the new features:

• Layer 7 traffic classifications for VPN flow preferences
• Syslog export of AMP events
• Added support for using FQDNs in L3 firewall rule destination
• Threat Grid support for the MX60(W), MX64(W), MX65(W), MX80, MX90, MX84, and MX100 appliances
• Content filtering improvements
• Static IP assignment via Dashboard (via Appliance Status page)
• Device utilization reporting (via the new Summary Reports page)
• Performance, stability, and security improvements

This is now true: Static IP assignment via Dashboard! I was waiting this feature since a long time.

Let’s see a real case: you send a MX security appliance to a customer; he wants to installs it on his Internet connection but his ISP does not provide a DHCP service on this link. This is often the case for business internet access here, because the customer need a static IP range, like a /30 or /29, you are supposed to use static IP assignment on your device.

To solve this, you can try to ask the ISP to enable DHCP on his CE router, or even better, to create a static DHCP entry on his router for the Meraki MX. But this is not always possible. The alternative is to go to the customer, connect your laptop to the Mgmt or LAN port of the MX, depending of the model, and then type:  http://setup.meraki.com  to get a very ugly gray page, local to the MX, to be able to configure the WAN IP and DNS settings:

But to login to this page, you must use the serial number as username and a blank password. So, you must find the serial number on the device, probably already mounted into a rack full of others network devices, or go back to the Meraki dashboard to copy the serial number. Not very easy, right?

Now, Meraki announce you can configure the WAN IP and DNS settings directly from the Meraki dashboard. To do this, go to the dashboard , then to the Appliance status page and finally on Uplink tab. Here we can see a small pencil close to the WAN IP to change the IP settings:

It looked great, so I wanted to test this: As this setting is located on the appliance status page, I was not sure it is available when the device is offline. To be sure, I tried with my test device: I removed the power, waited a few minutes to see it in red into the dashboard with the message: “device unreachable”, and I changed the WAN IP from DHCP to a free static IP on the same range. I did this on the WAN-2 interface, to be sure this is also supported:

After the reboot, the appliance took this new IP and everything was working fine, great!

But does that really solve my problem? Well, yes but only partially. Now, we can configure the MX static IP in the dashboard before deploying it. But then, the appliance still need to get this configuration. And the default WAN configuration is still in DHCP client mode.

A solution could be the customer or partner plug the WAN interface of the MX into his LAN, or into a residential internet access, like this the MX can get his configuration for the final installation. And then he connects the MX WAN interface to the right internet access. This is not perfect, but it works.

Note: I made these tests with a MX65 using MX 12.26 firmware upgraded to MX 13.28.

Did you like this article? Please share it…

2 Thoughts to “Cisco Meraki MX Static IP assignment via Dashboard”

I Use a 4g router in WAN 2. My techs install the MX and I’m offsite programming. When I see it online I then go in and program WAN 1 with the static IP and let them plug it into the ISP.

This is a very smart technique to avoid configuration errors from the tech on site and make the installation easier. Then, do you leave the 4G router in place, as a backup or for SD-WAN traffic, after the install?

Leave a Comment Cancel reply

Privacy overview.

404 Not found

404 Not found

404 Not found

• Contact Sales

MX67 and MX68 Datasheet

• Last updated
• Save as PDF

After April 30, 2024 , MX with Third-party USB Cellular Modems will only receive support related to security vulnerabilities for third-party USB modems. All support for Third-party USB Modems will be deprecated as of June 30, 2026 .

Overview 

Designed from the ground up with a new built-in cellular modem the MX67C and MX68CW are designed to simplify any deployment that requires a cellular uplink. This is ideal for small remote locations with unreliable WAN circuit providers or for sites that want the highest level of redundancy and availability. The Meraki Dashboard in addition with the built-in cellular uplink allows for simple and easy deployment of the MX67C or MX68CW with minimal pre-configuration in almost any location. 

For smaller sites that don't require a cellular uplink but still need a capable device that can be easily deployed, the base models of the MX67 and MX68 are available without a built-in cellular uplink. The MX67 and MX68 are also available in Wireless models (MX67W / MX68CW) that can provide 802.11ac coverage for wireless clients.

Features  

Hardware features.

Dual WAN uplinks

Built-in Cellular CAT 6 LTE Uplink (Cellular models only, requires SIM card)

Built-in 802.11ac Wireless capability (Wireless models only)

Built-in PoE+ capabilities (MX68 only) 

Configuration 

The basic initial configuration of the MX67 and MX68 is just as simple as with other MX models. The links below provide additional information and instructions relating to each step in getting the device setup and configured for the first time. 

• If a Dashboard Organization does not yet exist, Create one
• If a Network does not yet exist, Create one first
• Before inserting the SIM card, ensure the SIM is activated with the PIN disabled or the correct PIN entered. It may be necessary to use an external modem, or work with the cellular provider to have the PIN disabled or the SIM unlocked. (Cellular models only)
• If a custom APN is needed, ensure it is applied from  Cellular  section of the  Uplink  tab on the  Security & SD-WAN > Monitor > Appliance Status  page. (Cellular models only)
• Insert an activated SIM card to allow the cellular uplink to function (Cellular models only)
• Ensure the cellular and/or wireless antennas are connected correctly (Cellular and Wireless models only) 
• Power on the device and let it check in to the Dashboard
• If necessary, configure a Static IP on the WAN interface through the Local Status Page  to allow it to check in.
• Manage local VLANs
• Modify Firewall rules
• Configure VPN connectivity

Context and Comparisons 

Technical breakdown , wan interface, lan interface, 802.11 wireless interface .

NOTE: The MX68CW has fixed antennas that serve both 802.11 and LTE connectivity and cannot be removed.  

Cellular Interface

When bringing the units online for the very first time, MX67C/68CW units should be connected via a wired WAN interface to the Meraki Dashboard to retrieve an update to allow for proper use of the integrated cellular connectivity.

Carrier compatibility is generally based on having compatible bands on the modem. In the open market, carriers may only require regulatory domain certifications and open market certifications, like the PTCRB and GCF, to be compatible for their network. Sometimes carriers will require additional testing before a device can be used on their network. The section Tested Carriers is based on Meraki device certifications being approved by those specific carriers. A carrier being listed above means that they have officially certified the Meraki product for their cellular network. There maybe many unlisted carriers could be functionally compatible with Meraki devices. The list of tested certified carriers is based on the carrier validating Meraki per their network parameter requirements. If a carrier you are looking to use is not listed above, it could be that they do not require additional compliance testing for their network.  

Physical 

Accessories  .

NOTE:  The MX68CW has fixed antennas that serve both 802.11 and LTE connectivity and cannot be removed.   

MX Warranty coverage periods are as follows:

Additional warranty information can be found on the Return Policy and Requesting an RMA  page of the Cisco Meraki website. 

If your Cisco Meraki device fails and the problem cannot be resolved by troubleshooting, contact support to address the issue. Once support determines that the device is in a failed state, they can process an RMA and send out a replacement device free of charge. In most circumstances, the RMA will include a pre-paid shipping label so the faulty equipment can be returned. 

In order to initiate a hardware replacement for non-functioning hardware that is under warranty, you must have access to the original packaging the hardware was shipped in. The original hardware packaging includes device serial number and order information, and may be required for return shipping.

Troubleshooting 

Common troubleshooting steps .

My cellular uplink is stuck at 'Connecting'

Built-in Cellular  - Ensure the following:

• The SIM is activated with the PIN disabled or the correct PIN entered. It may be necessary to use an external modem, or work with the cellular provider to have the PIN disabled or the SIM unlocked.
• There is no external USB modem connected as the MX will prefer an external USB modem to the internal modem, if available. 
• If a custom APN is needed, ensure it is applied from Cellular section of the Uplink tab on the Security & SD-WAN > Monitor > Appliance Status page.
• The SIM card is fully inserted.

USB Cellular  - Ensure the following:

• The USB Modem is activated and able to pass traffic when connected to a PC.
• If a custom APN is needed, ensure it is applied from the Cellular section of Uplink tab on the Security & SD-WAN > Monitor > Appliance Status page. 
• It is fully connected and powered on when connected to the MX.

My modem is connected but is getting very poor throughput

Meraki strongly recommends that the cellular uplink be used on a 4G connection with good signal strength to provide adequate bandwidth to support using the cellular connection as a backup/primary uplink. If no 4G signal is available or the available signal is low strength, the achievable throughput may not be adequate to fully support a remote site and more restrictive traffic shaping rules should be used to ensure traffic is prioritized appropriately. 

Common Event Log Messages 

Common event logs exist for wired, WiFi, and cellular events. As such, no specific MX67 or MX68 event log entries are required at this time.

  For more general information about navigating the Event Log and the types of Events that could be expected please check out our Event Log documentation . 

Is the MX currently using the Cellular Uplink?

When the MX is using the Cellular Uplink it will display a Purple Status LED instead of the usual White LED.

Is this SD-WAN over LTE?

Can LTE be used as the primary uplink?

No, LTE is currently only supported as a fail-over link and should only be primary during a temporary WAN failure event.

Note: From MX16.2+ versions, integrated cellular MXs (MX67C and MX68CW only) have a feature available under "SD-WAN & Traffic shaping" page where cellular connection that was previously only enabled as backup can now be configured as an active uplink.

Can I utilize LTE for warm spare configuration?

Yes, LTE is supported in a warm spare configuration when using the embedded cellular modules. In order to support HA, customers must be using firmware MX 14.53, MX 15.42, or MX 16.11 or higher. At this time, if a cellular uplink is used in an HA pair, the following will occur in order:

• Primary MX WAN 1+2 fails > fails over to secondary MX
• Secondary MX WAN 1+2 fails > fails over to primary MX cellular
• Primary MX cellular fails > fails over to secondary MX cellular

How does LTE work for free trials?

Meraki does not supply SIM cards so while the unit can be trialed, it is up to the end user to procure a working SIM card on a compatible carrier.

Do these models support eSIM capability?

No. Currently, Meraki customers will need to acquire a SIM card from their carrier and install. 

Will the LTE devices be available in the USA and Worldwide?

Yes. There will be two models: a North American model and a Worldwide model

Should I contact Meraki Support for carrier issues?

No, you will need to bring support issues to the carrier for carrier issues. 

How do I troubleshoot carrier issues?

The Meraki Dashboard provides the ability to monitor signal strength, performance, and historical traffic for troubleshooting purposes. For additional troubleshooting related to the carrier, the carrier will need to be contacted.

If an external USB cellular modem and the internal LTE SIM card are both connected, which one takes precedence?

The external USB cellular modem will take priority over the internal LTE SIM.

Can I change the APN?

Custom APNs can be configured from Cellular section of the  Uplink  tab on the  Security & SD-WAN > Monitor > Appliance Status   page. 

Can I change the antennas to improve my performance?

The MX68CW has fixed antennas for Wi-Fi and LTE that cannot be swapped. For the MX67C, only Meraki antennas are supported. Replacement antennas will be available for purchase.

If my antennae are lost or damaged, can I use 3rd party antennae that fit on the Meraki device?

Only the Meraki antennae are supported. Lost or malfunctioning antennae can be replaced by contacting Meraki support. 

Why are the C and W models in the MX67 series separated whereas the MX68 has CW combined in one model?

The MX68CW provides a high-end option for customers who want all features included in one unit (wireless, high port count, PoE, cellular). The MX67, MX67C, MX67W are for customers who don’t need all features in a single unit. 

404 Not found

Meraki Community

• Community Platform Help
• Contact Community Team
• Meraki Documentation
• Meraki DevNet Developer Hub
• Meraki System Status
• Technical Forums
• Security & SD-WAN
• Re: Security appliance MX 18.211 Release

Security appliance MX 18.211 Release

• Subscribe to RSS Feed
• Mark Topic as New
• Mark Topic as Read
• Float this Topic for Current User
• Printer Friendly Page

• Mark as New
• Report Inappropriate Content
• All forum topics
• Previous Topic

• New May 13: [CONTEST CLOSED] Join us in some fun wordplay for National Limerick Day, hooray!
• May 7: Community Platform Update: Reducing space within content
• May 2: Recognizing the April 2024 Members of the Month
• 3rd Party VPN 144
• Auto VPN 268
• Client VPN 392
• Firewall 501
• Community guidelines
• Cisco privacy
• Khoros privacy
• Terms of service