Limit VPN so only A-B and C-D can talk

[overblower]

Hi Team,

I have 4 MX devices in different locations.

Let’s call them A, B, C, and D.

Right now, all of them can ping each other.

But I only want communication between A-B and C-D.

That means devices in A and B should be able to ping each other, and devices in C and D should be able to ping each other.

How should I configure this?

Br
Tayfun

[ww]

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior#:~:text....

You would need rules like:

Allow A-B   (you could combine two rules AB-BA)

Allow B-A

Allow C-D

Allow D-C

Deny any

Or

Deny AB -CD

Deny CD - AB

Allow any

[GIdenJoe]

Once you include the source subnets in the VPN they will always be propagated to the other locations.  However you can use the site-to-site outbound firewall rules to filter the traffic between sites.