Question about MX and Sonic WAll from POS company

[EliseNemeth]

Question team,

A customer is using a Sonic Wall that is provided by their payment vendor, and the POS machine can be the ONLY device behind it.  If the customer was to use an MX for SDWAN /FW/threat protection features for all their other devices could it be turned off for a specific port for the Sonic Wall? 

[DHAnderson · Accepted solution]

@EliseNemeth 

Are you talking about putting the MX in front of the Sonicwall?  If so, you can specify a unique VLAN for the port the Sonicwall is connected to.  You cannot disable the MX threat protection features by port though.  There should be no drawbacks to having the Meraki Threat protection ahead of the Sonicwall.  You can also do port forwarding to the Sonicwall port, if the payment vendor is remotely managing it.

PCI compliance has a concept called Scope.  Basically anything on the same network as a PCI device (typically a card reader or POS) should be PCI certified.  That would not be possible if the PCI devices were on the same VLAN as computers, printers and other devices.  So typically I set up a PCI specific VLAN that all PCI devices are on. 

The other thing I do to secure the PCI VLAN, is that I tighten outgoing rules so the only destination is the IP address or URL of the processing company.  Doing this has two benefits:

• This means any non-PCI device that gets on that VLAN will not work. 
• Any malware or skimming device in or on a PCI device will not be able to talk home.

If you do all this, you may not need the Sonicwall.

-Dave

[EliseNemeth]

thank you for that information