Group Policy intra VLAN

[guitb]

I've set up a group policy for a specific VLAN on my MX.

I have a wired client and a wireless client (connected through a Meraki MR) residing on this same VLAN.

Will the firewall rules within this group policy be evaluated on communication between these two devices on the same VLAN?

[ww]

No, traffic probably won't even hit the mx vlan

[Mloraditch]

Group Policies are not evaluated for Layer 2 traffic. Switch ACLs can be used for this: https://documentation.meraki.com/MS/Other_Topics/Switch_ACL_Operation if you have Meraki Switches.

If you just need no access between clients, isolation is a possibility: https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Wireless_Client_Isolation

https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Restricting_Traffic_with_Isolated_Sw...

You could also just block wireless from wired with Wireless ACLs: https://documentation.meraki.com/MR/Access_Control

Suffice it to say there are several options depending on exactly what you want to do.

[guitb]

I don't have a switch, only an MX68 and an MR36.

A wired client is directly connected to the MX68, and the MR36 is also connected to the MX68.

I require wireless clients connected to the MR36 to be able to communicate with the wired device. I am investigating if any configuration on the MX68 could be blocking this communication.

[GIdenJoe]

For the switch client you need to set the group policy via 802.1X and then you can have your L3/4 rules.
For the wireless client if you block access to the same VLAN range, the AP will block it and since this rule is stateless the switch client will be able to send to the AP client but the AP client will not be able to respond back so in effect you can block traffic between a wired and a wireless client on the same VLAN.

[PhilipDAth]

You could consider using a WiFi firewall rule (it can restrict WiFi to LAN).

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/MR_Firewall_Rules

[Bobcheese2]

How do you want them to communicate? IE is this a L2 broadcast discovery or will they communicate through 'known' IP addresses? I think the issue you may be having is that the ports on the MX are not switch ports so even though they're configured on the same VLAN i don't believe broadcasts will traverse the two ports.

If they will communicate over known IP's you may have more success if you segment them on different VLAN's and subnet's and create rules to allow the traffic to pass through the MX.