MX Firewall Rules (Layer3) only applying to LocalLan networks?

[YoinkZ]

Hi all,

Is it correct that only the Firewall rules applied under the "Site --> Security & SD-WAN --> Firewall --> Layer 3 --> Outbound Rules", that these rules only apply for the local switched network?

I have a lot VLANs with different networks, that is being routed in the MX appliance. So far the rules seems to be working - locally.

BUT, all other rules, where I want to allow or block access to my other Hubs doesn't seem to be working at all.

I need to go to "Security & SD-WAN --> Site-to-Site VPN --> Orginzation-wide-settings --> Site-to-Site outbound firewall (beta)". Is that correct understood?

I'm finding it a bit difficult to understand, why it is not located the same place as the other rules, as this seems more logic to me?

Thanks 🙂

[GreenMan · Accepted solution]

The VPN firewall rules only apply to traffic that will hit the VPN - it's a component of your VPN deployment, hence it being located with the rest of your VPN-related configuration.

[YoinkZ]

Alright thank you. Just needed a confirmation. Even though it is tied together with the VPN-related configuration. Then it still makes more sense to me if this was handled on the specific layer 3 part. It will still be traffic that comes from those "interfaces".

[alemabrahao]

It's correct for SD-WAN the rules are defined on Security & SD-WAN > Site-to-Site VPN > Orginzation-wide-settings > Site-to-Site outbound firewall 

And Local network on Security & SD-WAN > Firewall > Layer 3 > Outbound Rules.

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior

[YoinkZ]

Thanks for the documentation. I went through some of it, but it still doesn't made 100% sense. It is probably just a matter of getting used to it coming from another appliance :).

[alemabrahao]

It's how Meraki works. 

[alemabrahao]

Why doesn't it make sense to you? In other firewalls you can work with security zones, so we can interpret them as different zones, at least I think so. The system was programmed to work like this, independently.

[YoinkZ]

I believe the reason it because I have been used to work with the ASA Firewalls, where most of these rules defined whether you wanted to go to another network locally or if you tried to reach another network via your IPSEC tunnels. 

That's basically it. So now I just have to think different and the fact it is "splitted".
If you ask me in one month, when I have created, changed and deleted rules then I might say it makes a lot of sense 🙂

[YoinkZ]

And now I clicked accept on the wrong post here. Can I change that :)?