Configure Layer 7 Rules on MX64

[cgw]

We have an MX64 that is to be deployed at one of our remote sites (version: MX 18.107.2), to replace a FortiGate Firewall.

Currently looking into the configuration & the FortiGate firewall has the option of configuring policies/rules for cloud based internet services, such as Microsoft-Outlook, Microsoft-Office365 & for Zscaler etc.

Looking at the options for adding a layer 7 firewall rule under Databases & Cloud Services, none of these appear to be listed & the option is to add a rule to Deny only.

Is there another way to add rules to allow these internet services on an MX64, or any other Meraki Firewalls?

[alemabrahao]

Layer 7 rules are for application blocking. What exactly do you need to do?

Perhaps you need the Secure SD-WAN Plus license, but first it would be better to understand your need.

https://documentation.meraki.com/General_Administration/Licensing/Meraki_MX_Security_and_SD-WAN_Lice...

[cgw]

Hi, thanks for the prompt reply.

In the previous deployment using a Fortigate firewall, we have layer 7 policies that allow connectivity to different internet services such as Microsoft applications & a zscaler proxy service. We would like to deploy the same polices on the Meraki MX device.

Are you are saying this is not possible, or is that supported with the SD-WAN Plus License?

[alemabrahao · Accepted solution]

Take a look at this documentation about integration with ZIA.

https://documentation.meraki.com/MX/Site-to-site_VPN/Zscaler_Internet_Access_(ZIA)_Integration

As I informed the rules of L7 are intended for blocking applications.

Cisco Meraki MR Access Points and MX Security Appliances provides the ability to create layer 7 firewall rules to deny certain traffic based on traffic type.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_a_Layer_7_Fi...