GEO Blocking for Cloud Print solution

[rshappel]

Good Day!  We are looking at a cloud print solution from Printix.  All the servers Printix uses are  in the Netherlands.  We GEO Block the Netherlands because of many other bad apples that work from that region.   Is there a way to punch a hole in that GEO block to an IP range?  Can we do it from Layer 3?  We use various MX devices throughout our org.   MX65W, MX64, MX84, MX95, MX100 and have about 95 locations throughout the US, Guam and Puerto Rico. 

Thanks for any help!  

Randal Shappell

Make-A-Wish America

Cloud System Admin

[alemabrahao]

Maybe it can work, but you need to test it first.

On the MX, if traffic matches an allow rule on the L3 firewall, it can still be blocked by an L7 firewall rule.

On the MX, HTTP traffic (TCP port 80) to Facebook.com will be blocked by the L7 firewall, because rule 1 under layer 7 explicitly blocks it, even though the traffic was allowed through the layer 3 firewall.

Layer 3 Rules

1. Matched - Traffic allowed through L3 firewall
2. Not processed
3. Not processed

Layer 7 Rules

1. Matched - Traffic blocked

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewal...

[alemabrahao]

and you can also block it by Ip range.

MX Firewall Settings - Cisco Meraki Documentation

[PhilipDAth]

@alemabrahao has some good suggestions - but on the whole, you can't do this.

Hopefully Printix will be able to offer a cloud hosted solution with a public cloud provider in another region.