Most engineers think…
Most people see 'SD-WAN' and picture a complex overlay with manual tunnel configs, IKE negotiation worksheets, and separate firewall boxes for IPS. That model fails you at interview and in production.
Cisco Meraki MX is a cloud-managed security appliance where the dashboard is the brain: you set a device as Hub or Spoke, save, and AutoVPN forms authenticated IPsec tunnels to every other hub or configured spoke automatically — no manual IKE, no pre-shared key spreadsheets. The SD-WAN engine then steers each flow to the best WAN link using live health metrics. On top of that the same box runs Snort IPS (Talos-updated), Cisco AMP for file inspection, and URL content filtering. Understanding that all of this lives in one dashboard-managed appliance is what lets you design, operate, and justify Meraki to an interviewer or a customer.
① The Meraki MX — cloud-managed security appliance and SD-WAN platform
The MX is Cisco Meraki's combined security appliance, firewall, and SD-WAN gateway. Every MX phones home to the Meraki cloud dashboard over an outbound management tunnel — no on-prem controller, no local CLI management for day-to-day operations. Configuration changes push from the cloud; telemetry, alerts, and event logs stream back the same way. This cloud-first model means a branch office MX can be shipped pre-configured, plugged in, and operational in minutes.
MX models span from small branch devices to high-throughput data-centre appliances. Licensing is the key decision: Enterprise license unlocks SD-WAN and AutoVPN; Advanced Security adds Cisco AMP and the Snort IPS engine; both are subscription-based and tied to the cloud dashboard. The Meraki cloud is not just a GUI — it is the control plane that brokers AutoVPN tunnels, holds org-wide policy, and pushes firmware.
What is the role of the Meraki cloud in MX operations?
② AutoVPN — hub-and-spoke and full mesh with zero manual IPsec
AutoVPN is the headline feature: navigate to Security & SD-WAN > Site-to-site VPN in the dashboard, set a device to Hub or Spoke, and the Meraki cloud broker negotiates authenticated IPsec tunnels between all eligible appliances — automatically, with no IKE worksheet. A device set to Hub builds tunnels to every other hub (full mesh between hubs) and acts as a gateway for its spokes. A device set to Spoke builds tunnels only to its configured hubs.
Topologies and tunnel modes
If all appliances in the organisation are set to Hub, the result is a full-mesh topology. Hub priority controls failover: the spoke sends traffic to the highest-priority hub that is reachable and advertising the target subnet. Traffic mode is either split tunnel (only site-to-site subnets go over VPN; internet breaks out locally) or full tunnel (the hub advertises a default route and all spoke traffic — including internet — exits through the hub). Dual-WAN MX appliances run AutoVPN over both links simultaneously, providing built-in redundancy.
The cloud broker that stores org policy, brokers AutoVPN tunnel formation, pushes firmware and config changes, and serves the dashboard UI — no on-prem controller needed.
An MX set to Hub builds IPsec tunnels to all other hubs (full mesh) and acts as a VPN gateway for its spokes. Hub priority controls failover order for spokes.
An MX set to Spoke builds tunnels only to its configured hubs. It uses hub priority to fail over and can run split tunnel (local internet) or full tunnel (all traffic via hub).
The MX probes each VPN tunnel for loss, latency, and jitter. SD-WAN policies define per-class thresholds; if the preferred link degrades, the MX steers the flow to the next best link instantly.
In an interview, say that AutoVPN tunnels are negotiated by the Meraki cloud broker — not by direct IKE between devices. That distinction explains why there is no manual IKE configuration and why a new MX can join the VPN fabric the moment it connects to the internet and checks into the cloud.
A branch MX is set as a Spoke with two hubs configured. Hub 1 loses its WAN link. What happens?
③ SD-WAN policy and dynamic path selection — best link, per flow
SD-WAN on the MX is a suite of policies that steer traffic per-flow across available WAN links without manual intervention. The MX continuously probes each VPN tunnel using loss, latency, and jitter metrics. When you configure an SD-WAN policy, you specify per-traffic-class thresholds — for example, route VoIP flows only over a link with less than 50 ms latency and less than 1% loss. If the preferred link degrades past those thresholds, the MX instantly moves the flow to the next best link.
Meraki also supports application-aware path selection: traffic can be classified by application signature (e.g. Zoom, Office 365, Salesforce) and steered to the preferred WAN link regardless of IP or port. WAN health dashboards show live and historical loss/latency/jitter per link, making it easy to correlate performance complaints with WAN events. Cellular failover with integrated 4G/LTE on supported MX models provides a last-resort path when both WAN links fail.
Failover (active/passive) is only one mode. Meraki SD-WAN does per-flow dynamic path selection: different traffic classes can ride different links simultaneously based on live health metrics. VoIP goes on the low-latency link, bulk backup goes on the cheap broadband, and a video conference moves to the cellular backup the instant jitter spikes — all automatically.
▶ Watch a VoIP call steer from a degraded WAN link to a healthy backup
How SD-WAN dynamic path selection protects a real-time flow. Press Play for the healthy path, then Break it to see the failure mode.
A VoIP SD-WAN policy sets a 50 ms latency threshold on the primary WAN link. Latency rises to 80 ms. What does the MX do?
④ Integrated security — IPS, AMP, and content filtering, Talos-updated
The MX runs three security engines without a separate appliance. The IPS engine is powered by Snort — the same engine used in Cisco Firepower — with rules curated by Cisco Talos. Rule sets are automatically pushed from the Meraki cloud; you choose between Connectivity (low-noise), Balanced, or Security (maximum coverage) rule modes. No manual signature downloads or scheduled jobs.
Cisco AMP (Advanced Malware Protection) inspects HTTP file downloads: the MX sends a file hash to the AMP cloud, which returns a disposition (clean / malicious / unknown). Malicious files are blocked; unknown files may be tracked retrospectively if a threat verdict changes. AMP requires Advanced Security licensing. Content filtering uses Talos URL categories to block or allow web destinations — the MX inspects the HTTP URL or the TLS SNI field, checks against a local cache of up to 100,000 Talos-categorised records, and enforces the policy with minimal latency impact. All three engines are cloud-updated, so the MX stays current with zero manual intervention.
Priya at a Mumbai fintech startup faces this
After enabling the Snort IPS in Security mode on their MX hub, legitimate HTTPS API calls to a payment gateway start failing intermittently, causing transaction errors.
The IPS Security rule set has a signature that matches a pattern in the payment gateway's TLS handshake or HTTP payload, triggering a false positive block.
Dashboard > Security & SD-WAN > Event log — filter for IDS alerts. Identify the signature ID firing on the payment gateway's IP. Cross-reference with Talos to confirm it is a false positive for this traffic.
Security & SD-WAN > Threat Protection > IDS/IPS mode + Event LogSwitch from Security mode to Balanced mode to reduce aggressive signatures, or create a Layer 7 bypass rule for the known-good payment gateway IP range. Alternatively, add a content policy exception to prevent the IPS engine inspecting that destination.
Re-test: payment API calls succeed; the event log shows no IDS alerts for the payment gateway IP. Monitor the event log for a week to confirm no recurring false positives.
Cisco AMP and the full Snort IPS engine on MX require the Advanced Security Edition license. Enterprise license alone gives you SD-WAN and AutoVPN but not AMP. Always check the license tier when designing or troubleshooting — a security feature that appears in the dashboard may simply be greyed out due to insufficient licensing.
Which Cisco service curates and delivers the IPS rule updates to the Meraki MX?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is Meraki AutoVPN easier to manage than traditional site-to-site IPsec VPN? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- AutoVPN
- Meraki's zero-touch site-to-site VPN: set an MX as Hub or Spoke and the Meraki cloud broker negotiates IPsec tunnels automatically, with no manual IKE configuration.
- Meraki Cloud (Control Plane)
- The Meraki cloud service that stores org-wide policy, brokers AutoVPN tunnel formation, pushes firmware and config, and serves the dashboard UI.
- Hub (AutoVPN)
- An MX set to Hub builds IPsec tunnels to all other hubs (full mesh) and acts as a VPN gateway for spoke devices.
- Spoke (AutoVPN)
- An MX set to Spoke builds tunnels only to its configured hubs and fails over to the next-priority hub when the primary is unreachable.
- Dynamic Path Selection
- SD-WAN feature that probes VPN tunnels for loss, latency, and jitter and moves flows per-class to the best available link when thresholds are breached.
- Snort IPS (on MX)
- Intrusion Prevention System engine embedded in the MX, using Cisco Talos-curated rules delivered automatically from the Meraki cloud.
- Cisco AMP
- Advanced Malware Protection: the MX sends file hashes to the AMP cloud for a clean/malicious/unknown disposition on HTTP downloads. Requires Advanced Security license.
- Cisco Talos
- Cisco's threat intelligence research group that curates IPS signatures, AMP verdicts, and URL content-filtering categories used by the MX.
- Split Tunnel
- AutoVPN mode where only site-to-site subnets travel over VPN; internet traffic exits locally at the spoke MX.
- Full Tunnel
- AutoVPN mode where the hub advertises a default route so all spoke traffic, including internet, is back-hauled through the hub.
📚 Sources
- Cisco Meraki Documentation — Meraki Auto VPN: Configuration and Troubleshooting (hub/spoke/mesh, IPsec broker). documentation.meraki.com/SASE_and_SD-WAN/MX
- Cisco Meraki Documentation — Meraki SD-WAN: dynamic path selection, WAN health, per-flow steering. documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure
- Cisco Meraki Documentation — Threat Protection: Snort IDS/IPS and Talos rule modes (Connectivity, Balanced, Security). documentation.meraki.com/SASE_and_SD-WAN/MX/Operate_and_Maintain/Content_Filtering_and_Threat_Protection/Threat_Protection
- Cisco Meraki Documentation — Advanced Malware Protection (AMP): file hash inspection and Advanced Security licensing. documentation.meraki.com/SASE_and_SD-WAN/MX/Operate_and_Maintain/Content_Filtering_and_Threat_Protection/Advanced_Malware_Protection_(AMP)
- Cisco Meraki Documentation — Content Filtering: Talos URL categories, SNI inspection, and local cache. documentation.meraki.com/SASE_and_SD-WAN/MX/Operate_and_Maintain/Content_Filtering_and_Threat_Protection/Content_Filtering
- Cisco Meraki — MX Family datasheet: SD-WAN, AutoVPN, IPS, AMP, content filtering feature summary. meraki.cisco.com/product-collateral/mx-family-datasheet
What's next?
Got the MX architecture? Next, go deep on Meraki MR wireless and how the cloud-managed access layer integrates with the same dashboard for unified wired and wireless policy.