Meraki MX firewall rules are stateful and processed in a top-down order. The first rule that matches the traffic’s criteria (source, destination, port, protocol) is applied, and processing stops. Therefore, the allow rule for the server’s IP, placed above the general block rule, will match first and permit the traffic.

The decision between a single or multiple SSIDs fundamentally balances operational simplicity against network segmentation. A single SSID is easier for users but applies one policy to all devices. Multiple SSIDs allow for different VLANs, security settings (e.g., WPA2-Enterprise for employees, WPA2-Personal for guests), and bandwidth policies for different device classes, but add management complexity.

A Layer 3 rule with source=’Internal Subnet A’, destination=’Any’, and action=’Allow’ permits devices in Subnet A to initiate connections to any other network, including the internet and other internal VLANs (if inter-VLAN routing is enabled). This is a very permissive rule. Caution is needed as it may violate the principle of least privilege; more specific rules are generally recommended to restrict access to only necessary services and networks.

If clients can associate (Layer 2 connection is good) but cannot get an IP address (Layer 3 fails), the issue is typically with the network path for DHCP requests. In ‘Bridge’ mode, the SSID tags client traffic with a specific VLAN ID. If this VLAN is not trunked to the DHCP server, does not exist on the upstream switch, or is blocked by a firewall rule, DHCP discovery broadcasts will be dropped, causing this exact symptom.

Meraki Systems Manager uses a cloud-managed, policy-based approach. An admin defines a ‘SM Application’ (like a required software package) within a policy in the dashboard. This policy is then assigned to tags, groups, or specific devices. The SM agent on the device periodically checks in with the cloud dashboard, receives its assigned policies, and enforces them (e.g., installing mandatory software) autonomously, regardless of user login state or network location.

For guest networks, using ‘NAT mode’ (enabled via Client IP Assignment settings) is a best practice. It performs Network Address Translation, making all guest devices appear to the internet as coming from the MX’s public IP. This conserves public IP addresses, provides a layer of privacy/obfuscation for guests, and critically, simplifies security by ensuring outbound guest traffic originates from the MX, making it easier to apply consistent filtering and policies.

The error ‘DNS resolution failed’ indicates clients can reach the network (Layer 3 connectivity) but cannot translate domain names to IP addresses. The most common cause is incorrect DNS server configuration. Since the Meraki MX often acts as the DHCP server, the first step is to check the DHCP settings (Security & SD-WAN > Configure > DHCP) to confirm that the DNS server IPs being handed out are correct and reachable from the client subnet.

While traditional Layer 3/4 firewall rules filter based on IP address, port, and protocol, Layer 7 (Application Layer) rules add the ability to identify and control traffic based on the specific application or service generating it (e.g., blocking ‘Netflix’ or prioritizing ‘WebEx’). This allows for much more granular and intent-based policy enforcement without needing to know every IP address those services use.

This requires both application-aware prioritization and a time-based control. The Meraki Traffic Shaping feature allows you to create rules based on Layer 7 application types (e.g., ‘WebEx’, ‘Zoom’) to set priority levels (e.g., high). Furthermore, these rules can have schedules attached to them, enabling the prioritization policy to be active only during specified hours (business hours), making it an efficient and automated solution.

Meraki MX firewall rules are stateful and processed in a top-down order. The first rule that matches the traffic’s criteria (source, destination, port, protocol) is applied, and processing stops. Therefore, the allow rule for the server’s IP, placed above the general block rule, will match first and permit the traffic.0