L7 confusion

[merakiinsanity]

Hi

I'm in the process of migrating from a couple of Watchguard's to a couple of MX450s.

I'm looking at utilising the L7 firewall rules but have become utterly confused. Unless I'm total out-of-date, best practice for firewall rules is to have a catch-all deny rule at the bottom of the ACL, so you deny everything except for traffic you explicitly allow.

L7 firewall rules only come into play on MXs if the traffic has been allowed by L3, at which point L7 can deny it. However, surely, if you have a catch-all deny rule as is best practice for firewalls, the L3 rule will be denying a lot of these services anyway.

What would be infinitely more useful would be being able to configure *allow* rules at L7, so that if the traffic is denied at L3 based on non-wellknown port number for example, it then allows it through at L7 because it matches that particular service.

[DarrenOC]

hi @merakiinsanity , good post.  I believe you've read this document:

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewal...

As you state, if the traffic is explicitly blocked at L3 then the traffic won't move onto the L7 rules.  I believe that holds true with a catch-all deny rule.  The traffic has been blocked so won't progress any further.  I prefer this route, helps me sleep better at night.

[Inderdeep]

@merakiinsanity : Hope you understand 

[Iridium79]

Does this also apply to 1:1 Nat Scenarios when you are allowing certain ports to come in from any, Will the layer 7 rule country blocking kick in or will the traffic still pass.

[Inderdeep]

@Iridium79 : check 1:1 Nat and country specific l7 rules on MX

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings

[Bruce]

When you create the 1:1 NAT and allow traffic inbound via that NAT you are effectively creating an inbound Layer 3 firewall rule (although you never normally see it). Since the Layer 3 firewall rules on the MX are stateful this will allow the returning traffic back out. However, the Layer 7 rule are stateless.

So even if the outbound traffic is returning to a remote host due to the stateful operation of the Layer 3 firewall, it will still be blocked if it matches a Layer 7 firewall since these are stateless. (This can work in your favour in some instances, and in others it creates a headache).