Best Practice? Implicit Deny

[Daniel24]

I have just recently switched over to MXs for Firewalls. I assume like most firewalls its recommended to have an implicit deny as your last firewall rule? Trying to plan for any unplanned impact would this impact any connectivity with Meraki switches, AP's, camera's etc from their connection to the cloud. 

[RWelch]

By default, the rule already exists.

[RWelch]

MX Firewall Settings 

Using Layer 3 Firewall Rules 

Creating a Layer 7 Firewall Rule 

[DarrenOC]

That’s the implicit deny inbound rule.

By default, outbound everything is allowed.

I would suggest that you configure your outbound rules as required with a final Deny Any Any at the end.

[Mloraditch]

If you want a deny deny any on your outbound rules, you would have to program rules allowing your meraki devices to connect before that deny.

This is the documentation for that: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Clo...

[GreenMan]

Absolutely correct for anything downstream of the MX;   Meraki switches, access points, cameras etc.  In my experience the MX will permit anything that it relies on itself, by way of comms with Dashboard resources.

As pointed out by others;   by default all traffic is permitted between VLANs by the MX and from inside VLANs outbound towards the Internet.

Note that if you're using VPN / SD-WAN,  the firewall rules that affect in-tunnel outbound traffic are controlled under the Org-wide element of the Security & SD-WAN > Site-to-site VPN configuration.   By default all traffic within these tunnels is permitted, for VLANs which are VPN-enabled.