Inbound Firewall settings for VPN to 3rd party

lpopejoy
A model citizen

Inbound Firewall settings for VPN to 3rd party

I need all users to have access to a 3rd party subnet.  However, I do not want any of the remote subnet to have access to the us.

 

We are behind an MX84, remote is an AWS VPN which we have no control over.

 

There is a site-to-site inbound firewall, but it doesn't appear to work:  Just wondering if anyone else has run into this and how it was solved. 

4 REPLIES 4
Nash
Kind of a big deal

Hello!

 

As you have noticed, yes. The inbound firewall does not work. Meraki is aware as per this document, but the GUI element remains on the website.

 

On my linked document, I'd read the "Considerations for VPN Firewall Rules" section.

jdsilva
Kind of a big deal

Yeh... So this has been a thing for as long as I've been working with Meraki, about 2.5 years. 

image.png

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior

 

There's also another section down lower that reads:

 

image.png

 

So I think you're out of luck here 😞

Thanks @jdsilva .  It seems really strange that they leave disfunctional GUI elements in the page. 

 

I understand that VPN traffic should be stopped closer to the source - my preference as well.  Just not an option in this case.

 

It does say that this error will be resolved in a future dashboard update - does that mean this functionality will begin working at some point? 

 

Anyone inside Meraki know when this bug is slated to be resolved?

Nash
Kind of a big deal

Based off the VPN considerations section - I wouldn't hold my breath about getting inbound rules. It explicitly states that the Meraki MX can't block inbound traffic initiated by non-Meraki peers. Not currently cannot - can't.

 

My guess is that the "error" to be resolved is the existence of the inbound firewall rules section.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels