Intrusion detection and prevention

[ITDUDE]

does VPN to VPN traffice pass though the Intrusion detection and prevention threat proteection  or does it bypass this?

[KarstenI]

IPS is done on the MX where the traffic enters the AutoVPN system; not on the Hub if you have Spoke -> Hub -> Spoke traffic.

But if I remember right, IDS would still be done on the Hub.

[Jinbe]

That is correct, security inspection such as Content Filtering and Threat Protection is done locally on the MX. The hub/concentrator MX will not inspect traffic from the remote VPN subnets.

You can find this information referenced here: https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering_and_Th...

[pdeleuw]

Sorry for the late reply ... But there is a discrepancy between your answer and Karsten's answer. My understanding is, that Threat Protection includes IPS/IDS and AMP. Karsten mentions, IDS is done on the hub/concentrator. Your answer says, there is no inspection with Content Filtering and Threat Protection on the hub/concentrator. Please, clarify: Is IDS/IDS done on the concentrator for the remote subnets?

[KarstenI]

There doesn't have to be a discrepancy. IPS is always done on the ingress MX. The second sentence was about pure IDS. I remember seeing alerts from the hub device when there was no IPS on the Spoke, but I could have remembered this wrong. Most importantly, for real protection, the Hub is not used and the function has to be implemented on the spoke.

[KarstenI]

Just found it, it's even documented:

[pdeleuw]

Thank you, Karsten. IDS and IPS have different behaviors. Very new finding for me ...