cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Inter VLAN Routing.

SOLVED
Highlighted
Getting noticed

Inter VLAN Routing.

Hi Merakiers!!

 

I`ve been trying to block intervlan routing in my outbound firewall rules, but if i perform a ping from my computer in 192.168.22.0/24 to 172.16.101.0/24 but ping suceed.

 

Screen Shot 2020-04-30 at 4.31.28 PM.png

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Kind of a big deal

Re: Inter VLAN Routing.

That shouldn't be working.

 

I'll tell you the way I tend to do it.  I create a group policy per VLAN, assign the group policy to the VLAN, and then apply the firewall rules in the group policy.

It helps break up big firewall rule bases and makes it obvious might network segment the firewall rules are acting on.

View solution in original post

3 REPLIES 3
Highlighted
Kind of a big deal

Re: Inter VLAN Routing.

That shouldn't be working.

 

I'll tell you the way I tend to do it.  I create a group policy per VLAN, assign the group policy to the VLAN, and then apply the firewall rules in the group policy.

It helps break up big firewall rule bases and makes it obvious might network segment the firewall rules are acting on.

View solution in original post

Highlighted
Meraki Employee

Re: Inter VLAN Routing.

Are you pinging the interface IP of the MX itself?  That might still work due to the process flow.  But if the source and destination of the pings are other devices beyond the MX interface itself, I'd open a support case to assist with a packet walk since it should be blocked, and of course make sure there's not some other alternate path apart from the MX itself to get between VLANs.  Also confirm first, via packet capture on the LAN side of the MX, that you are in fact seeing the ICMP traffic ingress and egress.  Also, as a test, create 2 permit statements for the same traffic and place them higher in the list and see if their hit counters increase, then remove them and test again to confirm they're skipping the deny statements somehow.  

Highlighted
Meraki Employee
Meraki Employee

Re: Inter VLAN Routing.

In addition to what @MerakiDave mentioned, I would try pinging a different device in the other subnet. Or try pinging from a different computer. If you were pinging before you implemented the firewall rule then it will continue to respond to pings and needs time to expire. 

 

 

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.