VPN Concentrator mode

[njccnp]

I've seen inconsistent information about exactly which features are disabled in VPN concentrator mode. I know that VLANs, routing, NAT, and DHCP server are disabled. All documentation seems to agree on that, so that's not in question. But I'm not sure about firewall functionality. I initially read that all firewall services are disabled, except IDS. But now I've read other sources saying that firewall functionality is not disabled at all, and once source that says that only content filtering is disabled.

I'm looking for an exact list of which features are not available in VPN concentrator mode.

And more importantly, is this list anywhere in the Meraki online documentation?

[aleabrahao]

When an MX Security Appliance is switched to VPN Concentrator / Passthrough mode, the unit essentially becomes a Layer-2 bridge and no longer functions as a full router/firewall appliance.

The firewall function will work just for inbound traffic.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networks_and_Routing/Passthrough_Mode_on_the_MX_Security_Appliance_and_Z-series_Teleworker_Gateway?

[njccnp]

So, does this mean it does still support all of its firewall features (L3/L7 firewall rules, content filtering, AMP, etc.), but just without routing/VLANs/NAT/DHCP service?

[aleabrahao]

When in passthrough mode, the MX is best used for in-line:

Layer 3/7 firewall rules, traffic shaping, and analysis

Network asset discovery and reporting

Intrusion detection

Client and site-to-site VPN

[RWelch-USA · Accepted solution]

> I'm looking for an exact list of which features are not available in VPN concentrator mode.

Not sure if such a list (non supported features) exists but here is a list of features for your consideration General MX Best Practices.

[Philip D'Ath]

Site-to-site VPN firewall rules still work.

I don't know about the firewall rules used for Internet access. I have not had to use it for that case.