MX84 - Access list not applying

[Dougbert]

So we just got an MX84 to handle our guest internet traffic. We use Umbrella to provide basic filtering via DNS (block adult sites, malware, p2p, illegal sites, etc) and I created a rule to allow DNS to Umbrella's servers but block DNS to anything else, but the firewall still appears to allow the DNS traffic to pass to google's DNS (8.8.8.8) when I manually set DNS on a client on the network. I did a wireshark on the client to confirm the traffic is in fact going to port 53/UDP and it is but the firewall is NOT applying the configuration. The appliance says it's config is up to date. 

[CptnCrnch]

Well, if using Umbrella via MX, you're applying those via Group Policy to endpoints / users. How do those (that are using Umbrella) look? Are you by any chance allowing DNS freely there?

[PhilipDAth]

First thing of note - you do realise DNS uses both UDP and TCP?  UDP is typically used for small queries and the initial query.  TCP is often used for larger responses (over 512 bytes).  Many DNS responses these days are over 512 bytes.

https://support.microsoft.com/en-us/help/556000#:~:text=DNS%20uses%20TCP%20for%20Zone,information%20... 

Typically you use the option to directly integrate the MX with Umbrella.  This causes it to intercept the DNS queries.  The client's think they are still talking to 8.8.8.8 (for example) but they actually get redirected to Umbrella.

https://documentation.meraki.com/MR/Other_Topics/Manually_Integrating_Cisco_Umbrella_with_Meraki_Net... 

Then you would create a group policy and apply it to your guest VLAN interface.

https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Creating_and_Applyin... 

[Dougbert]

Philip,

Thanks for the reply, I'm aware of TCP/UDP, however when I wiresharked on my laptop from the network, it was passing the traffic over UDP. I will investigate Group Policy settings next. Appreciate your time and attention on this!

Doug