Hello!
I create vlans on MX. They work nice, but i have question. I want isolate guest wifi traffic, done it too. But from guest wifi vlan, i can PING gw of another vlan. I trying deny icmp from wifi vlan guest to vlan wifi not guest. Maybe i was wrong anywhere ?
Thank you
Solved! Go to solution.
Hello!
Everyone, my colleague and me find solution. Use Switch - IPv4 ACL and add rule to close ping
What I have done is to deny my guest WIFI traffic to other VLANs
Under Wireless, Firewall & traffic shaping
change to the guest SSID
add a layer 3 firewall rule
Policy: deny
Protocol: any
Destination: local LAN
Port: any
Comment: description of rule
Thank you.
I done it, but still have ping from vlan guest to vlan not guest
I use tcpdump and find who answered on my ping request. It was my.meraki.net
I believe regardless of whatever rules you set up you'll still be able to ping the VLAN gateways. But you shouldn't be able to ping any devices inside of that subnet if you have the proper rules configured.
Yep, i did rules what close access to hosts in another vlan from guest vlan. But i think its dont right if you can ping gw from another vlans.
Thank you for answered
@Adam wrote:I believe regardless of whatever rules you set up you'll still be able to ping the VLAN gateways. But you shouldn't be able to ping any devices inside of that subnet if you have the proper rules configured.
I have a similar configuration to yours and I also thought it was strange but it seems to be the design of their product. In the grand scheme of things, it is relatively low risk being able to ping the Gateways.
@GuiCarvalho wrote:
Alexander,
Take a look at this post. I think that will problably help you:
https://community.meraki.com/t5/Security-SD-WAN/Prevent-inter-VLAN-routing-on-MX/td-p/1437
No, this solution, dont help me with my problem. So how i understand its "new features" in Meraki
Hi,
You can do that by going to Security appliance > Configure > Firewall then configure it like below.
Let's say your WiFi VLAN is 192.168.0.0/24 and your domain is 10.0.0.0/8.
Choose "Deny" and Protocol "Any" so it will not allow 192.168.0.0/24 client ping or access to any domain IP in this subnet 10.0.0.0/8.
Firewall Settings
Alternatively you can do in Wireless > Configure > Firewall & traffic shaping
Wireless Firewallor this should work too
Wireless > Configure > Access Control
Wireless Access Control
Yes, i done it. But ping to gw in another VLan working.
Hello!
Everyone, my colleague and me find solution. Use Switch - IPv4 ACL and add rule to close ping
@AlexanderDrago wrote:
Hello!
Everyone, my colleague and me find solution. Use Switch - IPv4 ACL and add rule to close ping
Marking this as the solution on your behalf, @AlexanderDrago. Thanks for updating the community!!