Meraki firewall on SSID not working

[CarlT]

Hi All

We are having some issues with some MR42s, basically we have a Guest network and its using the AP in NAT mode, we can ping devices on our LAN for some reason, even though there is a deny rule on the SSID blocking them to reach local networks, we have added a rule also, however it appears to have no effect. They are on MR 30.7.1

Any ideas why this would be?

[nicdc01]

Hey;
Would check to make sure you are assigning the rule to the correct SSID. 

Wireless > Configure > Firewall & Traffic Shaping

Source:
https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Configuring_Simple_Guest_and_Int...

[CarlT]

It is indeed attached to the correct SSID

[nicdc01]

Firmware update or raise a ticket with support.

[alemabrahao]

But is it only ICMP that's working, or can you access other internal resources?

Can you share a screenshot of the SSID and firewall configuration?

[TBHPTL]

To add to what alemabrahao has said , Pinging from where to where and if using ping tools from the dashboard, which screen and tool?...

Also you said your APs are in NAT mode, if it is NAT mode there is no way it can access the LAN. as the AP each run their own private 10.0.0.0/8 DHCP server  for NAT with each AP having its default gateway of 10.128.128.128 and performing DHCP and for each client WIRELESSLY on the AP . Is it possible you just think you are pinging clients from a wired connection and are actually pinging other destinations on your LAN because your net uses Class A RFC 1918 on the LAN. See these docs:

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignme...

[PhilipDAth]

Clients on the guest WiFi should not be able to ping any RFC1918 address on the LAN with this configuration.  The APs themselves will still be able to ping LAN clients.

[TBHPTL]

Agreed that why i am asking from where he is pinging,  in the dashboard not all pings are L2 pings....