Disable routing on the core

[Adam5]

Good morning, 

Looking for something that can be done in the event of a cyber attack. We completed a table top last week and it came up that when we need to pull the plug for the entire network is there a way to disable all routing on our Meraki cores without deleting all the routes? This would help to mitigate the spread laterally across the network if something were to happen. Looking to see if there would be some other way around it or a script that could be run to accomplish this. 

Any advice would be appreciated. TIA

Adam

[KarstenI]

What about a script that disables all ports that are not infrastructure? For the routing I am not aware of a ways to just disable it, but removing and adding back the SVIs could also be automated with a script. Just make sure you don't remove config that is needed for the infrastructure itself.

[Adam5]

Thanks for the reply. Could be a possibility. We are looking for an overall "Kill Switch" that doesn't kill the config in case of a cyber attack. We could always unplug the cores but it wouldn't help us in our recovery if we are bringing things back online in a systematic way. 

[KarstenI]

A remotely controlled PDU like the MT40 or something from APC? 

[PhilipDAth]

This is probably a better use of an ACL.  You can even create an ACL in advance that is a "permit any any", and the procedure will be to change that one "permit" to a "deny".

https://documentation.meraki.com/MS/Other_Topics/Switch_ACL_Operation 

An ACL will also allow you to bring up parts of the network as it gets restored (by adding in additional "permit" entries").