Anyone have a slick way to block all Remote Access Tools?

Red-Five
Here to help

Anyone have a slick way to block all Remote Access Tools?

I was hoping to find a Content category that would block remote access tools (gotomypc, logmein, etc) but didn't find one.  Anyone have a good way to setup a generic block to these types of connections?

 

Thanks

5 Replies 5
Make_IT_Simple
Meraki Alumni (Retired)
Meraki Alumni (Retired)

I don't believe there is an easy way. I would personally search for all known ports used by remote access tools and block them. 

KarstenI
Kind of a big deal
Kind of a big deal

Many of these tools have an automatic fallback to TCP/80, TCP/443 or even HTTP/S. This will likely not work.

If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.
Make_IT_Simple
Meraki Alumni (Retired)
Meraki Alumni (Retired)

Did you try blocking all remote monitoring & management?

Make_IT_Simple_0-1647639394159.png

 

lambrit
New here

Anyone have an update on this...checking talos on this most of the remote desktop tools are categorized as online meetings.    So teamviewer/anydesk is categorized the same as Teams...which fundamentally makes no sense.  

Curious if this has evolved?

Dunky
Head in the Cloud

Can you not Deny at Layer 7 as below:

Dunky_0-1726672705803.png

 

And add L3 Deny rules for teamviewer.com etc provided the MX has seen the DNS lookup, or if using internal DNS setup a teamviewer.com domain and resolve to 127.0.0.1 ??

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels