What is our primary use case?
Security appliance/firewall and SD-WAN. With an advanced security license, the content filtering, IDS, and geographical blocking features are surprisingly good compared to using alternative solutions with no noticeable performance hit.
The geographical blocking is a great security feature but you have to use it with planning. I’ve managed to block a few vendor websites and mail servers without realizing what country those vendors were located in. When you’re not used to having geographical blocking, it can be hard to troubleshoot connectivity issues. I once sort of over secured myself, and this was not MX's fault. Overall, this feature is great. It requires the advanced security license which I think while more expensive, is the sweet spot for licensing an MX with regard to features.
How has it helped my organization?
This solution has improved our organization with:
We are an MSP and Meraki provides MSPs with a combined management dashboard to centralize all clients under one single pane of glass. They offer a dynamic DNS, so Client VPNs and point-to-point VPNs can dynamically follow IP changes with no need for static IPs. The SD-WAN VPNs are also the easiest VPNs to set up in either a mesh or hub-and-spoke configuration that you will find. It works with non-Meraki VPN equipment too.
What is most valuable?
The dashboard brings all management features with you wherever you are. All you need is an Internet connection and a browser and you can manage the solution. The dashboard tracks your uplink connectivity to the dashboard and double checks with you all changes impacting the connectivity, making it much safer to enact changes remotely. Dual WAN connections are greatly simplified and site-to-site VPNs automatically connect regardless of what WAN connection is active.
Site-to-Site VPNs are easier to set up than any other vendor’s solution. You simply pick two or more devices to tunnel together and then select what network subsets should be allowed to cross the tunnel and you are done. The solution handles all the details. Site-to-site VPNs can dynamically follow IP changes with no need for static IPs.
For MSPs, the dashboard is even more convenient as all your clients are on the same MSP account. Switching between managing different clients can be done with a few clicks once you log in to the dashboard. Two-factor authentication is available for enhanced dashboard security.
Options for teleworkers include Meraki Z3. This device is great for extending your workforce into homes. It has a POE port built-in and can power a VoIP phone for your office communications as well as the AutoVPN capability. We deployed a lot of these during the pandemic making VoIP phones easy to set up and use for end users at their homes. This is a very easy way to support remote workers and keep them happy.
What needs improvement?
Some advanced enterprise features are missing, so Meraki MX is not for
demanding enterprise networks as it lacks high-level features (including SSL inspection).
As for SSL inspection, I think this is better performed on the Client PC where the inspection can be performed before or after the SSL encryption is done. Look at a solution like SentinalOne for this. This type of solution is going to be less prone to problems with SSL inspection.
Additionally, the native client VPN uses native OS VPN connectivity in Windows, Mac OS X, and Linux. While this is nice from the perspective of no license fees to have a client VPN, there are sometimes issues when drivers or OS updates are released that impact client VPN connectivity. DrayTek makes VPN client software that works with the MX but it is not officially supported by Meraki.
I'm not a fan of any security appliance's VPN as they typically allow access to everything on the corporate network. Specific VPN solutions like Absolute allow you to create granular access control to resources inside your firewall. I think having that level of control is a huge security plus.
More recently, Meraki implemented the Cisco AnyConnect VPN client with the MX and that is a more reliable solution than using the VPN built into Windows. I highly recommend using that or a 3rd party ZTNA solution.
There are so many options available when you are looking to create your security stack. In my experience, I've found that putting all your requirements on one solution will usually result in some level of disappointment.
On the Meraki dashboard is a “Make a Wish” button to request new features. I have made multiple wishes and they were all granted.
For how long have I used the solution?
I have been using this solution for nine years.
What do I think about the stability of the solution?
Meraki hardware seems to be very stable. Their update process can be automated and I have not had any issues with stability. Also redundant Internet connectivity automatically fails over reliably. AutoVPN rebuilds the site to site VPN tunnels after an Internet connectivity failover without any admin action.
What do I think about the scalability of the solution?
During the Intel CPU clock signal component issue in early 2017, Meraki’s MX84 product line was impacted. Once Meraki started getting replacement CPUs they shipped a replacement MX84 to swap my production unit. I was very impressed to learn how easy a hardware swap works with the Meraki dashboard. It was very simple to add the replacement unit. It began to function as a warm spare so I could then remove the old serial numbered device. A few minutes later the replacement unit downloaded the production configuration and we were up and running on the replacement hardware. I also on a separate project upgraded to a larger MX and it was just as simple.
How are customer service and support?
Tech support is available from the dashboard. Meraki tech support staff have a lot more visibility into your network than you do, which is frustrating at times. I understand the approach is to keep the dashboard easier to understand. But this will frustrate more advanced users at times. The ability to run packet captures from the dashboard makes troubleshooting a lot easier.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
Previously, I managed Cisco ASA equipment and enjoyed these firewalls. The need to train other admins and deploy MSP clients was at the top of my list for switching to Meraki MX. The learning curve is much less steep for new security admins and the central dashboard allows collaborative efforts when admins are in different locations. Built-in change management makes it easy to see who made specific changes as changes are logged on the dashboard.
How was the initial setup?
Setup is rather easy but with templates or using an existing MX as a template to create a new MX configuration setup becomes even easier.
What about the implementation team?
We perform all Meraki implementations in-house.
What was our ROI?
ROI is huge on Meraki products for admins. The learning curve reduces the amount of training required and the dashboard makes administration of MX appliances simple and that impacts ROI in a big way.
What's my experience with pricing, setup cost, and licensing?
Other content filtering solutions that I have used had more bells and whistles, but given the cost, complexity, and management overhead, I am very pleased with Meraki’s solution.
Which other solutions did I evaluate?
I previously evaluated Cisco ASA, Fortinet FortiGate, Ubiquiti, SonicWall.
What other advice do I have?
I was very worried when Cisco purchased Meraki, but surprisingly, they have not changed the organization or product lines for the worse. Cisco has mixed AnyConnect VPN and they now use Talos data for content filtering, which works very well. The hardware is still following the Meraki model which is a good thing.
Which deployment model are you using for this solution?
On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Yeah, Great full stack solution.