Cloud Firewall egress traffic issues - VPN Exclusion

[0AK13Y]

Hey All we are facing a few issues once we connect sites to secure connect for internet traffic, but issues are immediately resolved once the network is disconnected.

When a site is connected and internet traffic is going through the service connectors we've identified a few issues with devices being able to communicate with public management servers. For example, meraki cameras get an alert that there configuration is out of sync, yet camera feed is working. Also are artic wolf appliances are unable to communicate with their services. There are no blocks indicated in logs, we also took the additional step to whitelist all IP's and URLS in the DNS,WEB and cloud firewall polices. 

The issue seems to be related to the lack of a consistent external ip for egressing traffic from the devices when egressing the internet though the secure connect service connectors out to the internet.

TAC Advised to bypass the traffic to the required destination, which does resolve the issue. 

PROBLEM: We've identified over 50 subnets we must bypass for a laundry list of application that aren't working and having over 100+ MX sites this is time consuming , so I dug into the meraki API templates but can't seem to find the required PUT to update the list on each MX.  Why do we need an SDWAN+ license when the option is available in the web interface? 

NOTHING FANCY:

import requests

API_KEY = "xxx"NETWORK_ID = "xxx" # Replace with your network ID

BASE_URL = f"https://api.meraki.com/api/v1/networks/{NETWORK_ID}/appliance/trafficShaping/vpnExclusions"

headers = {

"Content-Type": "application/json",

"Accept": "application/json",

"X-Cisco-Meraki-API-Key": API_KEY

}

## additional destination removed 

data = {

"custom": [

{"protocol": "any", "destination": "x.x.x.x/32"},

{"protocol": "any", "destination": "x.x.x.x/19"}

]

}

response = requests.put(BASE_URL, headers=headers, json=data)

print(response.status_code)

print(response.json())

########

{'errors': ['Configuring Major Application VPN exclusion rules requires the SDWAN+ license']} 

[alemabrahao]

The SD-WAN Plus license is required for application-based VPN exclusion rules. This is because these rules involve more advanced features, such as layer 7 (application) based local internet breakout, which are not available with the standard license.

https://documentation.meraki.com/General_Administration/Licensing/Subscription_-_MX_Licensing

[0AK13Y]

Why am I able to save the configuration in the dashboard then without the licensing?

Security & SDWAN > SDWAN & Traffic Shaping > Local Internet Breakout

Thanks! 

[0AK13Y]

All the bypasses we're trying to add are L3/L4 Rules.

[alemabrahao]

No, it's not possible.

[0AK13Y]

Would it be a new feature request for a the local internet breakout API then?

[alemabrahao]

I don't think so, in your case it's a lack of correct licensing.

[0AK13Y]

I may be miss understanding, how can I bypass the traffic in the dashboard and validate that the traffic is being split locally with our existing licensing? 

screenshot:

[alemabrahao]

Have you tried to capture packets via dashboard?

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi...

[0AK13Y]

Packet capture was an early step, We opened up a case with Arctic wolf, since the wan IP changes constantly its unable to establish a connection, dropping traffic locally resolves the issues. 

[jimmyt234]

VPN Full-Tunnel Exclusion (Application and IP/URL Based Local Internet Breakout) - Cisco Meraki Docu...

You only need the SDWAN+ license to do major application VPN breakouts, you can still do custom expressions (IP/DNS) with the non-SDWAN+ license.

The major applications list is fairly short anyway:

[0AK13Y]

Why do we encounter the following error message when attempting to add a CIDR address via the API PUT, despite the fact that this feature is supported under our existing licensing agreement?

{'errors': ['Configuring Major Application VPN exclusion rules requires the SDWAN+ license']} 

0 Kudos

[Nick_B · Accepted solution]

Try setting the majorApplications=[]

[0AK13Y]

Thanks Nick!