MX-84 Order of Rules

[DannyR76]

On an MX-84 will a Layer 3 Firewall Rule trump a Layer 7 Rule?

For example: I want a certain address and port configuration in a country that I block with a Layer 7 rule to work, so can I create a Layer 3 Firewall Rule to accomplish that?

Or do I still have to "allow" the country in the Layer 7 Rule?

[RaphaelL · Accepted solution]

Hi ,

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewal...

 MX Series Security Appliances are processed in a top down fashion, with Layer 3 rules being processed, followed by Layer 7 rules. Unless traffic is explicitly blocked by at least one rule, it will be allowed through by a default allow all rule. 

On the MX, if traffic matches an allow rule on the L3 firewall, it can still be blocked by an L7 firewall rule.