Traffic Blocked by Layer 7 Rule
The MR access point and MX security appliance differ slightly in their processing of L7 firewall rules after the L3 firewall. On the MR, if traffic matches an allow rule on the L3 firewall, that traffic will bypass the L7 firewall altogether.
On MR, default L3 rules do not act as a bypass for L7 rules. Only allow custom rules will bypass L7 rules.
On the MX, if traffic matches an allow rule on the L3 firewall, it can still be blocked by an L7 firewall rule.
On the MX, HTTP traffic (TCP port 80) to Facebook.com will be blocked by the L7 firewall, because rule 1 under layer 7 explicitly blocks it, even though the traffic was allowed through the layer 3 firewall.
Layer 3 Rules
- Matched - Traffic allowed through L3 firewall
- Not processed
- Not processed
Layer 7 Rules
- Matched - Traffic blocked
https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewal...
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.
