Meraki MX L7 features behind Firewall

[Blink]

MX85 MX 18.211.2

We are soon changing internet service provider and the new ISP will have a standard L3-L7 firewall policy on all outbound internet access.

Could be a non issue, but will MX L7 features work ok behind a firewall. URL filtering, AMP, IPS...

It's also a VPN hub but apparently this will work (via cloud brokering) on high UDP ports which are allowed through standard ISP policy.

I do understand that we will obviously only see what the external FW allows through but would any functionality on the MX actually break due to any L7 packet manipulation on the outside ISP FW? I have casually asked about whitelisting this device completely but might be a pain to do for all devices in the future.

[KarstenI · Accepted solution]

The "?" in the top right corner of the dashboard has a section "Firewall Info". Just make sure that the ISP isn't blocking any of this communication and at least the Meraki Part will be fine.

[Blink]

Thanks very much I'll get this verified

[Blink]

Might sound like a stupid question but would these IPs in the Firewall Info section be susceptible to URL category blocking? ..for example they could be load balanced by URL and DNS mechanisms and resolved to either of these IPs. Or they maybe programmed in as IPs directly in the Meraki software which I would then assume would not be susceptible to URL category blocking.

[KarstenI]

Theoretically, they can be subject to any filtering. But I wouldn't expect any ISP to do that.

[Blink]

Well there is this on their outbound policy but we'd be unlucky to be categorised as Malware.

Blocks by URL from Malware Categories - silent

[Brash]

Yeah I wouldn't expect it to be categorized as malware.

They would likely pull from the same sources that other security vendors/firewalls pull from anyhow.