Group policy on Meraki site to site vpn

[CML_Todd]

Do group policies apply to traffic in Meraki site to site vpn?

Network A and Network B are connected via a Meraki site 2 site vpn tunnel.  I have site to site vpn firewall rules setup to block RDP from computers in Network A from accessing computers in Network B.  And there are also site to site vpn rules setup to block RDP from computers in Network B from accessing computers in Network A.  

However, I need IT staff in Network A to be able to remote desktop into computers in Network B.  I've created a group policy in Network A with no restrictions and applied it directly to the IT staff computer in Network A.  This computer still can't remote into the computers in Network B. 

This leads me to believe the group policy with no restrictions doesn't apply to site to site vpn traffic. Does anyone know if this is true? 

[Inderdeep]

@CML_Todd : Check this to understand in detail on group policies 

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying... 

[CML_Todd]

Inderdeep,

I've read this document, and it doesn't mention anything about whether the group policies apply to site to site vpn connections.  I couldn't find any documentation that mentions it.  

Thanks for the reply.

[Bruce · Accepted solution]

@CML_Todd as you’ve discovered, the Group Policy doesn’t override the site-to-site VPN firewall - that’s always been my understanding. The Group Policy rules can override the global Layer 3 firewall on the MX, and on a MR, and allow for Group Policy ACL on MS (depending on model and firmware). 

You will need to put the IT staff in a separate VLAN to achieve your outcome.

[CML_Todd]

Bruce,

I haven't found any official documentation saying Group Policies don't override site to site VPN firewall rules.  I wanted to see if anyone else could confirm my findings before I created a separate IT staff VLAN at all of my locations. 

Thanks for the input, I appreciate it!