Meraki MX90

[staningrimsby]

Morning Guys

Does anybody have any experience with the Mearki MX90;

Meraki MX90 Cloud Managed Security Appliance

We have been told that all 44 of our primary schools will be having there web filtering disconnected on the 8^th April and will have to find something else, I have looked into quite a few solutions in case this happened but was offered the Meraki solution yesterday at a really good price for a 3 year licence

An even better price for the Meraki MX80 but not sure if that will meet our needs.

[AngryTechnician]

I haven't used the content filtering features personally, but I'm not convinced it offers a complete solution. I don't think it does any filtering of HTTPS content, for example.

My advice would be to get in touch with Meraki (or a reseller) and request some trial equipment. They were more than happy to supply me with trial equipment for just a single site; if you wave the potential for sales to 44 schools in front of them they will probably fall over themselves to help you out.

[jamesfed]

We had a go at a MX90 at my old place and after just 30 minutes of using it decided it would be our firewall/filter for the future (not buying until at least 6 months later though) - such a wonderfully simple interface and quite intuitive to use with lots of cool features (traffic shaping and Layer 7 filtering).

I think a MX90 might be a bit overkill for a primary (we were looking at the MX80) but it’s worth getting a loan.

[AngryTechnician]

@jamesfed: how is the user logging? Can you get nice per-user logs of what sites have been accessed? I assume from the fact you are happy with it that it does indeed do some HTTPS filtering, otherwise you'd be seeing problems with Google search now that the default is to use HTTPS for all search.

[staningrimsby]

That would be great if you don't mind as all I have heard at the moment is the sales patter they give you, I have not actually seen it in live operation or anything.

We will be mainly using it for its web filtering side of things at the moment, I am familiar with the Meraki dashboard so does it just link in with that ? Also is it a straight forward system to use as I have a so called technician that may need to administer the system if I’m not available.

Also how does the firewall side of things work ?
Is the system straight forward to setup VPN’s etc and are there any additional licence costs associated with that side of things ? I was told by the sales chap that the staff could take their own Meraki MR12 home plug it in and connect straight away but that sounds an expensive way of creating a VPN.

[AngryTechnician]

All Meraki kit uses the Meraki dashboard - though the wireless and firewall appliances reside in separate sections of it. It all works the same way though. As for VPN, all licences now include use of a client VPN connection directly to the appliance. No special VPN client software is required.

[MatthewL]

I was told by the sales chap that the staff could take their own Meraki MR12 home plug it in and connect straight away but that sounds an expensive way of creating a VPN.

This is similar to what the Aruba kit does, they called is a RAP. Yeah it is an expensive way to create a VPN and I would only use it if I had a number of staff working at that location, for just one home user I would look down the route of having a software VPN on the client or using RDP/VDI if you have it.

[staningrimsby]

I think a MX90 might be a bit overkill for a primary (we were looking at the MX80) but it’s worth getting a loan.

Were looking at the MX90 as I have been told that if you use the appliance to its full functionality an MX80 will only accept around 100 users at a time, where as the MX90 will accept around 250 at any one time as we do have 620 pupils and expecting another 100 in the next 12 to 18 months.

[glennda]

These devices are brilliant, in terms of usage an MX80 should do the trick for you.

Although I am not 100% sure the filtering is as robust/manageable as the likes of a Smoothwall device etc but in terms of a firewall and the ability to Layer 7 traffic shape/firewall they are awesome. Plus site to site VPN's which "Just work"

Also remember you require outbound ports opened for the Meraki Management.

The filtering content lists in the devices is downloaded from a third party. I will find out who supplies the list.

[staningrimsby]

The filtering content lists in the devices is downloaded from a third party. I will find out who supplies the list.

Thank you for that info, I emailed Anjali at Meraki and she said this;

"Our content filtering is through Bright Cloud. There’s about 82 different categories that you can choose to filter from and there’s Active Directory integration as well if you want to set up content filtering policies based on your AD groups."

Need to have a look into Bright Cloud as I have not really heard of them…

[glennda]

Thank you for that info, I emailed Anjali at Meraki and she said this;

"Our content filtering is through Bright Cloud. There’s about 82 different categories that you can choose to filter from and there’s Active Directory integration as well if you want to set up content filtering policies based on your AD groups."

Need to have a look into Bright Cloud as I have not really heard of them…

That's no problem I couldn't remember it from the top of my head after the training - I think for a Business which needs decent content filtering to stop staff its excellent. For an educational environment I would recommend more looking at a Dynamic content filter such as Smoothwall or the others out there. As the Meraki offering using Bright Cloud is purely list based not involving content analysis on the fly (its done centrally by bright cloud and lists generated).

Bright cloud are an intellegence gatherer and integrate their lists/intellegence into third party products such as the Meraki units.

In terms of performance I can't comment on the specs for the content filtering as not used it in anger. A MX80 will give you 250mbs throughput which should be plenty for your needs IMHO.