BUG - Layer 7 country block list uses different engine than what security center geo-location uses

[alceryes]

I currently have a case oven with Meraki support on this issue. Basically, the source country for any give IP can be different between what is being displayed in the security center and the actions you may take under layer 7 blocking (at the least). I've been experiencing hack attempts on FTP server over the last week. Security Center reports that the IP is from Seychelles. I go and block Seychelles but the hack attempts continue. WTF???

Well it appears that the security center uses Cisco SourceFIRE but layer 7 blocking uses Maxmind. I can't believe that cisco wouldn't make sure that the information given in security center matches, across the board, with all other functions within Meraki. Isn't this what we're paying for?

Oh, and the exact words from Meraki support - "So if you want to block it in layer 7, you have to put "netherland" (and "turkey" maybe) instead of "seychelles""

Turkey, maybe...? Great! Meraki support doesn't even know.

[Adam]

Can you just block the specific IP(s)? But this is good to know.  Also worth noting that if you do blacklist a country there is no way to whitelist certain legitimate IPs from within that country yet.  We've had some IPs misidentified and had to unblacklist an entire country until the IP was properly categorized.  

[Pegasus79]

I have the same issue with voip... We expose port 5060 for our soft clients,  now China is blocked but we can still see registration attempts from china.  Our PBX has an internal firewall and blocks the Attempt but seriously what is the point if the MX does not stop it.   Another way to stop it from hitting our pbx is to create a Rule in the switch.

[creepingdeth]

Came upon this same issue today.  We've blocked many foreign countries due to several attempted attacks.  We have no reason to pass or receive information to/from any of these countries so there's no need for them to be Whitelisted.  We blocked traffic from France and we still had attempts.  Not sure what else to do.

[Pegasus79]

Well I was on the phone with the support guys from Meraki when I had the Advanced License.  So basically what they said was if you have a layer 3 firewall rule 1 to 1 nat or port forwarding that allows IP addresses from any the Layer 7 Firewall Rules will ignore the country you are blocking, since the layer 3 comes first.   A work around will be to get the offending IP or IP's and place it in the Cisco Meraki Switch ACL Rules.  I know  its stupid ...

[creepingdeth]

That is stupid. That is what I did this morning after finding the offending attempted attack. Thanks for the reply.

[Richard_W]

Any clarification from a Meraki Employee here would be nice