How do you block cryptominig on Meraki MX?

[keewlmer]

Hi,

I've been looking through the content filtering categories and it appears that there is no way to block crypto mining sites on the MX. One article claimed it's within the 'Social Media Networking' category and others are manually adding IOC IPs in the mining category.

For customers who don't have the Enterprise Umbrella license but want to block a category like 'mining' on their Meraki MX (Advanced Security License), this proves very difficult and mind bugging for their SoHo firewall admins.

Any suggestion on options would be appreciated.

Cheers!

[jdsilva]

Are you talking about actual cryptomining, or the hidden browser hijacking crap like coinhive?

If it's the latter that's blocked through IDS/IPS (Snort)

You can set it up under Security & SD-WAN > Threat protection. Ensure the mode is "Prevention" to actually stop it. I'm not sure which rulesets this is included in, but the example above was taken from a network set to "Balanced".

[keewlmer]

Hi jdsilva,

Thanks for the reply and apologies for the late response. I'm aware the latter is already being blocked when in IPS mode, but the former is what my question is particular about. When you look at FTD (NGFW/NGIPS) and Umbrella, this category is available to be blocked but it appears that Meraki doesn't have that among their Content Filtering categories.

I think this is very important to be present for a Small office Home offices who have already paid a lot for one or more Advanced Security Licenses and can't afford to pay for another professional Umbrella license when Meraki MX can easily supplement or cover that gap for them.

Cheers!

[jdsilva]

Hey @keewlmer. I think you're correct in that there's no functionality to block legit cryptomining on the Meraki platform outside of the standard firewall rules and content filtering features. You would have to try and use those tools to block the traffic you want blocked. I don't know enough about the cryptomining protocols to be able to help out with that, or to say if it's possible at all. 

[jese44]

---

@keewlmer wrote:

Hi,

I've been looking through the content filtering categories and it appears that there is no way to block crypto mining sites on the MX. One article claimed it's within the 'Social Media Networking' category and others are manually adding IOC IPs in the mining category.

For customers who don't have the Enterprise Umbrella license but want to block a category like 'mining' on their Meraki MX (Advanced Security License), this proves very difficult and mind bugging for their SoHo firewall admins.

Any suggestion on options would be appreciated.

Cheers!

---

Have found any solution for that? I am also looking for.