Block Internet Access but Allow Auto VPN Communication on MX75

[overblower]

There is Auto VPN between the locations using MX75, and it works well.

I want the devices connected to the MX75 to not access the internet, but still be able to ping other locations.

How can I set this up?

Thank you in advance.

[alemabrahao · Accepted solution]

Create a Group policy, then in the Layer 3 rules, create a rule allowing communication with the target subnet and a final rule denying everything.

Then apply it to the VLAN interface or directly to the clients.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

[overblower]

failed. I have two locations, D1 and D2. They should connect to each other, but clients must not have internet access. SCADA programs talk across the two locations.

[alemabrahao]

Please share the rule that you have created.

[alemabrahao]

Try some think like this.

[overblower]

D1: Security Appliance: 143.161.65.1/24

D2 Security Appliance: 143.161.64.1/24

[alemabrahao]

You need to specify the destination for Any.

[RWelch]

Wouldn't your entries need to be adjusted?

D1: Security Appliance: 143.161.65.1/24 to 143.161.65.0/24 (subnet) or 143.161.65.1/32 specific device IP

D2 Security Appliance: 143.161.64.1/24 to 143.161.64.0/24 (subnet) or 143.161.64.1/32 specific device IP

[overblower]

Done. 

By the way, here's the current network setup:

• D1:

  • Security Appliance IP: 143.161.65.1

  • Client Subnet: 143.161.65.0/24

• D2:

  • Security Appliance IP: 143.161.64.1

  • Client Subnet: 143.161.64.0/24

I have already created a group policy for D2.
As mentioned earlier, my goal is to block internet access for both D1 and D2 clients, while still allowing them to ping each other internally.

Current situation:
Clients in both D1 and D2 can access the internet and ping each other at the same time.

Now it is time to apply it to the VLAN interface ? And any screenshot or steps?

[alemabrahao]

Take a look at the link I sent you.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

[overblower]

The group policy is ready. We just need to apply it. We'll test it first over the weekend and then implement it. Thank you very much, @alemabrahao !