Layer 3 Firewall Deny/All rule

[Johann]

Hi all,

Does anyone have a definitive answer on why the Meraki Firewall rules does not end in a Deny All Rule, as is considered to be best practice when setting up firewall rules in general? As I understand it, currently if none of your firewall rules match incoming traffic, the Allow All rule will allow all traffic in. Any insight will be appreciated.

Thanks.

[CptnCrnch · Accepted solution]

Simplified management I'd guess, Merakis mantra.

On the othe rhand, nothing / nobody prevents you from using this best pratice and place a "deny all" rule directly above the last line of "defense" 😉

[Roger_Beurskens]

I would aks myself if an "outgoing layer 3 deny all rule" is still best practice...

what would the reason be to block ALL outgoing traffic to internet. 

Yes it is the most secure... secure what? 

Malware wil just use normal ports and without something like AMP, of layer7 firewalling it wil just make a connection to some server on a default http or https port because 99% of the firewalls have that allow rule..