MX65W layer 7 firewall rules only to apply when on cellular ?

[FrancisDorta]

We have USB dongle cellular connected to the MX65W as a fail over, and that works well, but we need to limit its data usage only when on cellular to avoid being charged too much when the line fails and the cellular takes over, is there a way to do it ?

[jdsilva]

There's two ways. 

You can rate limit the cellular in the Security > Traffic shaping page

And you can write ACLs to restrict traffic on the cellular link under Security appliance > Firewall

[FrancisDorta]

is there a way to get L7 FW rules to apply only when failing over to cellular ? I need to get L7 rules but only when in cellular is there a way, the issue is that once it goes on cellular I can block for example software updates, social media, etc etc that already exist on L7

[jdsilva · Accepted solution]

Oh, sorry @FrancisDorta, I'm not reading your question properly. 

No, you are limited to L3/4 rules only for cellular failover. There's on option to do L7 rules. 

[FrancisDorta]

One last question do those rules on cellular failover apply to VPN traffic ?

[jdsilva]

Hah! That's the big question isn't it!

Unfortunately, in my testing the answer is No. The cellular failover rules seem to apply to the egress direction of the WAN interface, meaning by the time all traffic hits the rules it's already IPsec encrypted and you can no longer distinguish what it is.   You can filter Internet bound traffic, but not traffic inside a IPsec tunnel.

😞

[FrancisDorta]

Good stuff