MX AutoVPN Layer3/7 rules

PatR-31C
Here to help

MX AutoVPN Layer3/7 rules

Can someone clarify the following for me?

 

Do Layer3/7 rules in the Firewall section of the MX affect AutoVPN clients, or only the rules defined in the site-to-site outbound firewall section?.   

 

There seems to be a little confusion on my team and I want to settle the issue.   Thanks.

7 Replies 7
ww
Kind of a big deal
Kind of a big deal

L3/l7 fw is for vlan to vlan and vlan to local internet . Not for vpn traffic

GreenMan
Meraki Employee
Meraki Employee

@ww is spot on.   If you want to filter traffic passing over AutoVPN, you'll need VPN firewall rules, configured under Security appliance > Configure > Site-to-site VPN.

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Settings#VPN_Firewall_Rules 

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior 

Thank you both for responding.   Let me be clear, we are not looking to filter traffic over AutoVPN.   Quite the contrary, we ran into an issue with one of our locations that uses AutoVPN to connect to the corporate network.   

 

They were connecting to an on-prem application that was delivering an HR training video and they were having issues with the video not coming up, or being intermittent.   A packet capture does show some sort of block happening in which you can see the http://wired.meraki.com:8090/blocked.cgi URL being served up along with the URL of the "offending" item which in this case was an MP3 file on the on-prem server.   The block on that item causes the video the stop running or they get a spinning circle forever.   Of course that started the chants of "It's the network!", so we started with standard network testing and we verified the network was in good shape.   

 

While I was out of the office last week, a support ticket was opened and the Meraki support tech appeared to imply that L7 rules might be the cause (see below).   

 

"What is the address for the application that you are trying to access across the VPN?
I do see some Layer 7 rules on West Nyack MX84-A and I am wondering if any of those rules are restricting/blocking traffic"

 

As you have indicated, AutoVPN should not be affected by L7 rules which I do agree with and is the reason for the post.  I'm trying to understand what could be causing the block as well as calm down my management who now think AutoVPN connections as being filtered with L7.

Are you sure the destination for the video session resolved to an address within the VPN?

Are you also sure the client accessing the resource was in a subnet defined within the VPN?

(Packet capture over the Site-to-site VPN should help with that)

According to the app owners, the video is local content.   I am trying to sift thru packet captures to confirm.

Clients are on a subnet defined in AutoVPN.   They access the application daily, just this particular content is an issue.

ww
Kind of a big deal
Kind of a big deal

Any content filtering configured?

Content filtering is ON.   Standard no porn, no malware, no spam, etc. categories.   Using the URL lookup tool, the content resolves are Business and Economy which is not a blocked category.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels