IPS/IDS Whitelisting without Traffic Exclusion

[LeonardoTNS]

Hi,

I have a cloud based threat & vulnerability scanning solution, it's not possible to white list the IP to allow Port scanning device subnets on the LAN side of an MX?

The customer MX doesnt support 18.2

Regards

[alemabrahao]

Meraki MX does not support direct port scanning of LAN subnets from external (WAN) sources unless you configure port forwarding or NAT rules to expose internal devices.
Even then, only the public IP of the MX is exposed, and internal devices are not directly reachable unless explicitly configured.

MX Firewall Settings - Cisco Meraki Documentation

[LeonardoTNS]

Hi,

I explained wrong sorry, Nessus is located at the Customer DC, the Customer DC have VPN connectivity with all the customer sites.

The MXs are blocking the scan from Nessus.

Its possible to allow the IP of Nessus at the MX?

[alemabrahao]

In this case, you cannot whitelist the IP in IDS/IPS directly, but you can allow the traffic using Layer 3 firewall rules and adjust IPS settings to avoid blocking the scans.

[RaphaelL]

Without MX18.2++ and Trusted Traffic Exclusions

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Trusted_Traffic_Exclusio...

I don't see any viable solution