Cisco Meraki MX84 Networking Branch Security Appliance

Very high quality firewall with cloud based management. Fairly straightforward to set up if you are technically experienced with networking. Do make sure that you purchase a license with it, or acquire one separately, as you will need it for the cloud based management.

Buyer beware...Cisco will not honor their lifetime warranty on this purchase. Cisco considers buying from Amazon to be a "second hand" market. They'll let you set it up and operate it thru their cloud services, but when it breaks in less than a year, Cisco will act like you bought it at the flee market.

Edit: We have used this firewall for 5-6 years now. My review below mostly stands, although I have downgraded my rating to 3 stars for the following reason:The Meraki Cloud is quite inflexible when configuring Level 7 rules. There are no ALLOW rules, only DENY. If the user wants to deny just a few file sharing services from the long list of preconfigured options, you have to create a separate DENY rule for EACH service in order to not deny the rest. Meraki could have provided ALLOW rules to pass through exceptions, or a checklist method to include or exclude specific services, but they have not. Even the Geofencing options require that you type in the name of each country of origin you want to deny instead of providing a simple checkbox listing. Meraki seems to spend more effort refreshing the look of the Meraki Cloud interface without providing time saving features for their customers. The lack of flexibility when applying rules is maddening for the admin that needs to provide a simple exception for a small subset of clients.---Here is my original review:Support is not cheap (although I found a good deal), but it is well built and has some great features, including:1) Automatically identifies clients MAC address, and hostname. Does this almost perfectly.2) Very easy to setup and configure rules, filters, VLANs, and VPNs.3) Customer support is really good and responsive. Wait times are usually 2-5 minutes, sometimes a bit more.4) Two WAN ports with load balancing or failover. Other ports can be assigned to VLANs independently.5) Recent update includes some CISCO AMP security features. (although no sandboxing yet).6) Exclude traffic by country.7) Cloud-based management is generally very responsive. Changes take 1-2 minutes to reach firewall.8) Login credentials can include two-factor ID (password + verification code sent to cel phone).I was initially skeptical about Cloud management, thinking that it was a security risk. With a very complicated password and verification code, I am now comfortable with the decision. I was also concerned about Meraki's own visibility of my devices when not on a support call, but there is a feature that prevents Meraki support from viewing my devices. I sometimes monitor/configure the firewall at work, home, and on trips, so I am using the cloud access much more than I ever thought I would.Some features need some fine tuning:1) The event log interface could be much better. EXPORT LOG feature only exports the 40 entries that are visible on the page, instead of the entire log! There is NO user-defined keyword filter, so it is difficult to find entries buried deep in the log. The basic filters that are provided are somewhat crude.2) I wish the Summary page allowed the user to drill down by clicking on one of the TOP BLOCKED SITES entries to see which clients were involved.3) Only the SUMMARY page allows the user to select a custom-defined period of time. All the other monitoring pages only offer 2 hour, Day, Week, or Month presets. I am not sure why all pages do not have this custom feature.4) The MX84 is a bit flakey about identifying the exact version of a client's OS , and sometimes it just says "Unknown";. Sometimes a Mac is confused for an "Apple iPhone". Minor issue.5) Usage reporting is roughly reported. I have had users that were reported to use 80GB sent+received in a week even though the breakdown of their usage only reflects 22GB of transit. Meraki should have a category for unidentified traffic.6) I have seen log entries that state that "Too many events occurred over a short period, so no logs were recorded". Not cool. I was assured by tech support that the data was filtered securely by the firewall and not simply passed through when that occurs. Still...not cool.7) Technical support has tools that allow them to see MORE information than the customer. Does not seem right.8) Having AppleTVs and/or Apple Airports on my DHCP network has resulted in some phantom IP conflicts, even though the devices are outside of the DHCP range and each have unique IPs. I had to identify each of these devices as "FIXED" in the config in order to avoid the conflicts.

Great

it has all the features needed for securing your business.