Block all internet but allow some cloud services

[Adrian4]

Hello,

We have multiple sites using Meraki MX security appliances, we also use Umbrella secure DNS with Virtual Appliance servers.


I have been asked to totally cut off domain controllers from open internet access, however certain cloud security services still need to function, such as qualys, senson etc

As far as I can tell these services don't rely on hard IP addresses, but domains and API endpoints.

If I...
allow DNS traffic at layer 3 only to our VA servers
block all other outbound at layer 3

then block all domains except the allowed ones in umbrella

- i think I would still need to allow HTTPS at layer 3 in order for the services to work, but I cant see a way to limit it to only allowed domains. I thought maybe block everything at layer 7 and just allow the services domains but you cant create allow rules at layer 7 😞


Not really sure how to go about this - I assume other people must have done something similar? How can you do it with meraki equipment?

thanks

[alemabrahao · Accepted solution]

Force Domain Controllers to use ONLY the Umbrella for DNS and block all outbound traffic from Domain Controllers except HTTPS and any internal networks.

[Adrian4]

but if I allow all https - thats basically the whole internet?

[alemabrahao]

You must block any other DNS servers, allowing only Umbrella VAs, and then let Umbrella decide which domains are allowed or blocked.

Even if you allow any port 443, Umbrella will control that; you just need to create a policy in Umbrella allowing what you want.

[Adrian4]

cheers, seems like this is the best we can do. Only works if DNS is used, any direct to IP traffic on 443 will get through 😕

[alemabrahao]

Another option is to place a Firepower or a Palo Alto between DC VLAN and WAN.

These support true domain-based allow rules via SSL inspection and URL filtering.

[Adrian4]

yea, that was a consideration we faced when we decided to go full Meraki, we made the decision that that didn't really need overly complex options. Guess we are eating that decision now 😛