Whitelist incoming IP address

[CarlosCoque]

Hello,

We use an MX-64 Security Gateway as our internet gateway at the office.

We're planning to run a vulnerability scanner from outside and they gave us 2 IP addresses to be added, so tests won't be blocked by any security feature at the firewall level.

I've been researching a way of doing that in our Meraki firewall, but haven't found it yet.

We have another firewall from SonicWall and we did that in the IPS feature.

Thanks,

Carlos

[alemabrahao]

I'm not sure if it's possible.

[DAlleman]

By default the MX is going to block all inbound traffic unless it was initiated from inside, so the scan would be blocked or only scan the public IP of the MX.

Please reference either document below for further explanation:

https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Blocking_Inbound_Traffic_on_MX_Security_...
https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings

[CarlosCoque]

Hi @DAlleman, thanks for the article.

I've read that and apparently, the only way to partially do that is to configure a NAT 1:1, which is not exactly what I'm looking for because I don't have a specific LAN IP address I'd like to use.

Do you think there is another way to achieve that requirement? (below)

Do you think there is anything I can do to achieve this?

[DAlleman]

If what you are trying to achieve is an external scan of your environment and you have no NATs configured, then it's only going to scan the MX as that is all that is exposed to the internet.

If you're planning to scan your servers or other resources then you will need to move the scan onto an internal host.