How to block access to my.meraki.com in a specific vlan ?

[RobertW]

Hi,

I would like to block access to my.meraki.com from selected local networks (vlan). How can I do this? I only see the option of locking in all local networks (Local device status page disabled).

Best Regards,

Robert

[PhilipDAth]

It can either be on or off, but not selected by vlan.

I can't imagine why you would want it off by vlan.  I find it a usefull user feature, asking a user to go to that URL, and then tell me how they connect to the network.

[rhbirkelund]

If you do an nslookup on my.meraki.com, what IP address is returned?

Maybe you could define a L3 Firewall rule, which denies all traffic on port 80/443 to your AP management VLAN.

[PhilipDAth]

It returns the magic IP address of 10.128.128.126.

I'm not confident you can firewall out Meraki traffic. It is "special".

[rhbirkelund]

An ACL on the Switch maybe?

I haven't tested it.

[RobertW]

1. I use Meraki MR33, in bridge mode ("Make clients part of the LAN");
2. Firewall on pfsense, rules for blocking local address 192.168.3.4 (local ip Cisco Meraki MR33) and 10.128.128.126 are not working.

Why want to block - on this page of device it is possible to change basic configuration (of course I changed password), but for security, why not?
 
Best Regards,
Robert