Yes it's fine, acls are processed line by line from top to bottom so what you have done is correct and is the only way to achieve what you want.    Jon ... View more

  The second acl is correct assuming you apply the acl inbound on the L3 interface for the client subnet.    Why do you think it won't work ?    Jon ... View more

  I think the confusion is because active/active cannot work for the same context so if you are just using one context you cannot have active/active failover for it, it is just active/standby.    I agree the paragraph is misleading because it seems to be saying if you don't want multiple contexts here is a way to have active/active failover but it isn't because you have to have multiple contexts.    It is in effect a circular argument and is there because in my opinion active/active is a misleading term, it is really active/standby per context with the ability to have each firewall active for a subset of the contexts.   But that doesn't sound as good in marketing terms :)    Jon   ... View more

  As already suggested you have a route but no interface in the next hop IP subnet so it can't work as far as I can tell.    What are the Meraki IPs you can ping ?    Jon     ... View more

  Assuming R1 is HSRP active and 10.0.0.52 is using 10.0.0.1 as it's default gateway.    If you ping a 10.2.0..x IP then the packet is inbound on vlan 10 so that acl is applied and you have a permit for 10.0.0.x IPs to any so you can ping 10.2.0.2 because it is on R1 and you can ping 10.2.0.4 and 10.2.0.10 because these are devices reachable from R1 so no other acls are applied.    But if you ping 10.2.0.3 then the packet is allowed on R1, because of the permit line, and R1 then routes it onto vlan 2 and sends it to R2 but that is now an inbound packet on R2's vlan 2 interface which has an acl applied denying any 10.0.0.x IPs which is why you see that line incrementing.    If you want it be able to ping all management IPs from 10.0.0.x you are going to have add some permit statements to your management vlan acl for it to work.    Jon ... View more

  As far as I know switch independent mode does not use NIC teaming on the switch, it is all done in the virtual switch.    You would have to use switch dependent mode with either a static or an LACP configuration.    Jon ... View more