Firewall rules - applying to specific vlans

[CarlT]

Hi All

There are some limitations currently with the firewall rules, specifically around incoming traffic to the mx etc.

We have routers on the inside of the firewall that we route too and from, it would be good to be able to apply firewall rules to these vlans.

is this feature coming or been asked for before ?

[alemabrahao]

But what exactly do you need to apply? There are limitations, but depending on what you need, there may be another way to do it.

In any case, you can make a feature request to Meraki.

https://documentation.meraki.com/General_Administration/Other_Topics/Give_your_feedback_(previously_...)

[CarlT]

I want to be able to apply "inbound" rules coming in from certain vlan (MPLS vlan) that have been routed from other networks, these MPLS routers do not sit behind the "WAN" ports

[alemabrahao]

In this case, you can apply it to the outbound rules as I mentioned in the other discussion you opened.

MX is a little different, so if you want to make the inter-VLAN restriction, just create the ACLs in outbound rules.

[ww]

You can also look into using a group policy and apply that to the vlan

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

[PhilipDAth]

I feel where you are coming from @CarlT , as the Meraki approach seems different.

As @ww has said, you can create firewall rules in a group policy and apply them to a VLAN.  HOWEVER, these are stateless.  You have to have rules that allow return traffic.

As @alemabrahao has mentioned, you can do this with the outbound firewall rules. These are stateful. I use this approach the most.

You can also take a more holistic view, and if you have mostly Meraki kit with C9300 switches, you can also use Adaptive Policy.  This lets you apply tags to devices, and then the traffic is filtered as it enters the port of the network.  This is the info on using ACLs with Adaptive Policy.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Adaptive_Policy_Confi...

Personally, for my larger clients, I am going to start using Adaptive Policy as the primary mechanism for policy enforcement. Then, outbound firewall rules, and lastly, group policy attached to a VLAN for simple cases (like a guest network, an IoT network, etc.).

[Brash]

^ This right here.

Although it's worth noting that Adaptive Policy requires Advanced Licensing for switches