IPS/IDS Whitelisting

[Lorenzo1]

Hi everyone.

I've followed numerous threads on the subject , but I just wanted to check I've understood the replies correctly.

If I have  a cloud based threat & vulnerability scanning solution, it's not possible to white list the IP to allow Port scanning device subnets on the LAN side of an MX?

[Ryan_Miles · Accepted solution]

If you have a supported MX model and run 18.2 you could look into using Trusted Traffic Exclusions https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Trusted_Traffic_Exclusio...

[RaphaelL]

Yes (maybe?) with MX18.200+ and Trusted IP Addresses/Subnets

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Trusted_Traffic_Exclusio...

but.... I wouldn't run that version in production , seems super buggy. Your mileage may vary.

[Wifikohai]

Hi, 

Does anyone know if I add an Ip addres on Trustestes/network traffic. Traffic on any direction (from and to this host/network) won't be analyzed by the IPS? 

[Geasnox]

I usually just switch the threat level to Detection instead of Prevention when I need something to bypass IPS. It won’t block traffic, but I can still see the alerts.

[Geasnox]

Cloud-based scanners usually come from dynamic IPs, so whitelisting them for MX LAN port scans doesn’t really work. I had to work around this once by using Residential Proxies, which let the scan appear from a consistent IP without messing with the MX rules.