switch meraki mx to new internet connection

*** Important 

Cisco messed up the local status page passwords. Autogenerated pws but they weren't stored by cisco or given to customers.

Step 1 - Make sure local status page is enabled and pw reset

• Network wide > configure > general 
• Scroll down to Device configuration
• Make sure "local device status page enabled" is selected in the drop down
• Change password, enter a 14 char pw with numbers/upper and lower case and symbol
• Click update
• Allow time for cloud to sync

Step 2 - Test local status page before switching

• Before switching anything 
• Plug laptop into a meraki LAN port (check the port is on right vlan)
• Visit the local status page for MX it should be http://wired.meraki.com
• One customer said it only worked in edge but not chrome 
• test login works

Step 3 - Switch over to new interconnection and reconfig

• Switch over to new internet connection
• Plug WAN port into the new ISP
• Log into local status page. 
• Config the new settings and save
• Give it a few minutes to connect to cloud (check LEDs)
• It should come online and appear in cloud
• You may also change the cloud config to match 

Meraki status pages

MR - http://ap.meraki.com

MS - http://switch.meraki.com 

MX - http://mx.meraki.com or http://wired.meraki.com

MG - http://mg.meraki.com

Any - http://setup.meraki.com or http://my.meraki.com

FYI - Cisco reset local status page passwords, it used to be admin and the serial of the device but in 2025 cisco auto generated one and asked users to set a password.

https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

Meraki monitoring pages

Organisation -> Alerts

Network-wide > clients

Network wide > Traffic

switch a meraki mx to bridged mode with vodafone DSL

Switch meraki first to PPPOE as you will lose connection once you switch the modem into bridge mode. You can still access via the local status page mx.meraki.com

PPPOE settings to config vodafone modemL

username: [serial_number_of_modem]@vfiefttc.ie

password: broadband

Then switch vodafone modem to Bridged mode

You may need to untick TR-069 (used for managing CPE devices)

You may need to reboot vodafone modem for it to go into bridge mode

meraki MTU

 You need to call meraki support to check and get MTU changed.

WAN MTU is 1500 by default

Auto VPN MTU is 69 bytes less (1431 by default)

If you call meraki to change MTU it should create a blip, they said full reboot not needed

-20 for TCP

-20 for IP

-8 for PPPOE

meraki routing

Meraki when you add an address to the HQ VPN encryption domain it forces all remote sites to route that traffic to HQ

if you only wanted to do it, for one site you can use static routing on the remote side

I was using the uplink IP address in HQ as the next hop but that is incorrect

routing

1 HQ route

manual 

mx ip = 192.168.128.1/24

upilink any

group non

vpn mode enabled

Cisco meraki outbound ports for firewall

Allow you meraki outbound on the following UDP ports

51625

38107

9351

9350

7351

We found in some configurations we had to give the HQ meraki its own static public IP. When it was sharing the firewall IP it was not working. I believe this is because it wants to use port 51625 exclusively.

Cisco updated some ranges

Port: UDP 9350–9381

Non-China cloud (meraki.com / gov-meraki.com):

• 209.206.48.0/20
• 158.115.128.0/19
• 216.157.128.0/20

China cloud (meraki.cn):

• 43.192.139.128/25
• 43.196.13.128/25