MX Umbrella integration

[MK2]

Hi everyone,

I have a question for you about the Umbrella integration in Meraki. Is the point on the following screenshot a global setting for all subnets on the MX or does it only refer to MX's with integrated WLAN? The setting is under MX > Threat Protection at the bottom.

If I want to configure something specifically for subnets or clients, I would do this via the Group Policies, right?

[alemabrahao · Accepted solution]

Yes Manually Integrating Cisco Umbrella with Meraki Networks - Cisco Meraki Documentation

[MK2]

But if I unlink Umbrelle here, it shows this:

And this belongs to WiFi or not? So it seems not to be a general configuration? 

I have already read the documentation you suggested up and down.

[alemabrahao]

Have you tried simply ignoring the message and linking with a group policy?🙂

[MK2]

Just going to test drive the Umbrella solution. So your recommendation would be to ignore the setting in the screenshot and work with group policies?

[alemabrahao]

In fact, you have to configure it in the way that best suits you.

In my case, I configure via Group policy because I have specific policies for each network in the umbrella.

[MK2]

Just another question 🙂

Are the global layer 3 firewall rules attached to a group policy or ignored?

[alemabrahao]

If you configure custom network firewall & traffic shaping group policy the answer is yes as long as you apply it directly to the VLAN interface.

Otherwise, this statement is only valid for the clients you apply it to.

Just a note from the documentation itself:

When a group policy is applied to a VLAN, that policy becomes the new "network default" for any other group policies applied to clients in that VLAN. Since this policy is the new "network default," the client devices will still show a "normal" policy applied under Network-wide > Monitor > Clients.

For example, a group policy named "Guest Network" with more restrictive layer 3 firewall rules than the network-wide configuration is applied to the guest VLAN, and a second group policy "Low Bandwidth" has a custom bandwidth limit, but is set to Use network firewall & shaping rules. If the Low Bandwidth group policy is applied to a client on the guest VLAN, the client will use the layer 3 firewall rules configured on the Guest Network group policy, not the network-wide layer 3 firewall rules configured on the Security & SD-WAN > Configure > Firewall page.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

[bradly]

Hey @alemabrahao 

About the below: 

---

@alemabrahao wrote:

If you configure custom network firewall & traffic shaping group policy the answer is yes as long as you apply it directly to the VLAN interface.

Otherwise, this statement is only valid for the clients you apply it to.

Just a note from the documentation itself:

When a group policy is applied to a VLAN, that policy becomes the new "network default" for any other group policies applied to clients in that VLAN. Since this policy is the new "network default," the client devices will still show a "normal" policy applied under Network-wide > Monitor > Clients.

For example, a group policy named "Guest Network" with more restrictive layer 3 firewall rules than the network-wide configuration is applied to the guest VLAN, and a second group policy "Low Bandwidth" has a custom bandwidth limit, but is set to Use network firewall & shaping rules. If the Low Bandwidth group policy is applied to a client on the guest VLAN, the client will use the layer 3 firewall rules configured on the Guest Network group policy, not the network-wide layer 3 firewall rules configured on the Security & SD-WAN > Configure > Firewall page.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

---

I've got a problem that I am unsure about that you have touched on here. 

We have a bunch of VLANs, and we want to enable Umbrella for some specific VLANs using group policies linked to Umbrella. However, to do this, we need to enable Custom Firewall & Traffic Shaping on the VLAN group policy. 

The VLANs we want to enable Umbrella DNS snooping on, currently have mx network wide layer 3 firewall rules in place. 

If we enable Custom Firewall & Traffic Shaping on our VLAN group policies, which activates the group policies layer 3 ruleset. Will this....

A) Override the firewall settings for any devices on that VLAN, that do not have a group policy applied to them in any other way? 

B) Override the firewall settings for any devices on that VLAN, that do have a group policy applied to them in any other way? 

[MK2]

Tested it again. 

It is a global setting, even if it says something with SSID that makes me think of WLAN. 

The problem is the MX firmware MX 18.208, with which there seem to be problems when sending requests from the MX clients via LAN, funnily enough WLAN works - there is no response from the Umbrella DNS servers.

Thanks for everything, now I'm smarter again

[alemabrahao]

It's not the stable version.