What's the best way to block traffic between site-to-site tunnels

[bill_berry32]

We have an MX-250 at corporate configured as a hub.  Remote locations connect with MX-67c's.  What's the best way to restrict traffic from each remote location to only the corporate office?  Basically, deny traffic from one vpn to another?

[Nash]

So you're using AutoVPN, and you want to grant remote sites access to home base, but you don't want Remote-A to talk to Remote-B? Just to confirm?

[PhilipDAth]

The best way is to have all the remote AutoVPN spokes in a single supernet.  Then just create a VPN firewall rule at the top that is a "deny" to and from this supernet.

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Firewall_Rule_Behavior

For example, if all the sites can be placed in the supernet 192.168.8.0/21, then create a rule to deny all traffic from 192.168.8.0/21 to 192.168.8.0/21.

[BrechtSchamp]

What @PhilipDAth said. Also don't forget that you have to use the site to site firewall for that and not the regular firewall.

[MarcP]

---

@BrechtSchamp wrote:

What @PhilipDAth said. Also don't forget that you have to use the site to site firewall for that and not the regular firewall.

---

Very good point 😉