topic VPN Concentrator mode in Cloud Networking Platform

VPN Concentrator mode

njccnp — Tue, 17 Feb 2026 14:16:50 GMT

I've seen inconsistent information about exactly which features are disabled in VPN concentrator mode. I know that VLANs, routing, NAT, and DHCP server are disabled. All documentation seems to agree on that, so that's not in question. But I'm not sure about firewall functionality. I initially read that all firewall services are disabled, except IDS. But now I've read other sources saying that firewall functionality is not disabled at all, and once source that says that only content filtering is disabled.

I'm looking for an exact list of which features are not available in VPN concentrator mode.

And more importantly, is this list anywhere in the Meraki online documentation?

Re: VPN Concentrator mode

aleabrahao — Tue, 17 Feb 2026 14:20:34 GMT

When an MX Security Appliance is switched to VPN Concentrator / Passthrough mode, the unit essentially becomes a Layer-2 bridge and no longer functions as a full router/firewall appliance.

The firewall function will work just for inbound traffic.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z-series_Teleworker_Gateway?

Re: VPN Concentrator mode

njccnp — Tue, 17 Feb 2026 14:30:48 GMT

So, does this mean it does still support all of its firewall features (L3/L7 firewall rules, content filtering, AMP, etc.), but just without routing/VLANs/NAT/DHCP service?

Re: VPN Concentrator mode

aleabrahao — Tue, 17 Feb 2026 14:42:23 GMT

When in passthrough mode, the MX is best used for in-line:

Layer 3/7 firewall rules, traffic shaping, and analysis

Network asset discovery and reporting

Intrusion detection

Client and site-to-site VPN

Re: VPN Concentrator mode

RWelch-USA — Tue, 17 Feb 2026 21:25:49 GMT

> I'm looking for an exact list of which features are not available in VPN concentrator mode.

Not sure if such a list (non supported features) exists but here is a list of features for your consideration General MX Best Practices.

Re: VPN Concentrator mode

Philip D'Ath — Wed, 18 Feb 2026 02:55:23 GMT

Site-to-site VPN firewall rules still work.

I don't know about the firewall rules used for Internet access. I have not had to use it for that case.