Yes it would ... View more

Globs (*) aren't necessary.   If you add logmein.com to the list, it will implicitly permit any sub-domains of logmein.com ... View more

As has been noted in this thread, bareword zip should work with the way we parse URLs and domains.   If you are having issues with this, please open a Support case ... View more

The ability to block statistical P2P (NBAR 1889) as a category was disabled before the Holidays in 2022 as I noted in this response: https://community.meraki.com/t5/Security-SD-WAN/MX-NBAR-blocking-Statistical-Peer-to-peer-traffi/m-p/179500/highlight/true#M42349 This includes removing it from all aggregate or "All X" rules it may have been a part of ... View more

FYI, as the answer in this thread ultimately alludes to, we require a self-signed root as part of the uploaded chain in addition to any intermediates required to validate the end-device certificate. ... View more

Yes, that's still correct. ... View more

That is correct. ... View more

Support already has access to an interface that can do this for what it's worth - I cannot comment on why this hasn't been exposed to customers unfortunately ... View more

AutoVPN performs PMTUD across the entire topology, and will maintain a consistent one across every hop based on the lowest detected value. ... View more

I can't comment on any sort of roadmaps as a whole unfortunately, but if you want to try and confirm this is the problem, take a pcap on your MX and look at the RADIUS traffic. If the last thing you see is an access-challenge packet containing the AVP I described above, yeah that's confirmation on the problem. ... View more

I'd be willing to bet what you're describing might run into the compatibility issues described here: https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#Multi-Factor_Authentication_with_RADIUS_or_Active_Directory_as_a_Proxy   If the MFA request is coming in the form of an additional access-challenge packet that has an attribute-value pair prompting users to enter an OTP, that's not currently supported, and I don't know of a timeline in which it will be.   The only way MFA is supported right now is if the server sends out a prompt directly to your users (e.g. a push notification) and then sends an access-accept to the MX after the OTP has been entered by them. ... View more

I naturally cannot go into more details about the nature of the defect, but I will say, I was the one who scoped that internally, and I got quite the laugh when I determined the scope. "Wired 802.1X client traffic dropped when port VLAN ID < 256 && VLAN ID % 16 == 0" is certainly one of the more absurd bug subjects I've ever submitted 😁 ... View more

I see, so there isn't a way to have it load balance to a range of hostnames. That's the detail I was missing here. ... View more

Apologies for being obtuse here, but you wouldn't be able to purchase a SAN cert for Azure to use that contains the DDNs names of each MX? I.e. CN=vpn.companyname.com   SAN DNS:mxddns1, DNS:mxddns2, ... DNS:mxddnsN ... View more

If your clients are connecting to the Azure manager, and then being redirected to an MX, it sounds to me like they're getting a warning that the name on the initial cert doesn't match that of where they're ultimately getting redirected to. If that's true, have you considered doing something like creating a cert with an SAN that covers all of the devices you're load-balancing to? https://support.dnsimple.com/articles/what-is-ssl-san/#san-restrictions Depending on growth and scale here, it might be feasible. ... View more

What I'm not clear on is *why* dynamic certs won't work - is there anything you can do to elaborate on why? ... View more

@MangoAnyConnect wrote: I understand but using profile doesn't help my scenario.  Since I've four MXs on four different countries with users  who are traveling a lot ,I am using Azure traffic manager(DNS load balance) to select  the nearest MX.   Dynamic cert doesn't work with my load balance name and users get trust warning message which is not a good sign for them.   I've also created different profiles with AnyConnect profile editor and tried to enable OGC but it doesn't work as it. It just select the first VPN in the list.   That's why I am thinking about custom certificates. If you choose to maintain the Azure DNS load balancing, I'd also be curious to learn more details about the Dynamic cert trust issues you're having - there may be solutions there we can pursue. ... View more

I cannot comment on feature developments in that regard right now unfortunately. ... View more

@PhilipDAth wrote: I'm kinda thinking only statistical models with an accuracy of at least 99.9% should be considered when it comes to blocking (as opposed to just monitoring).   Even at 99.9% accuracy, 1 in a thousand applications will be misclassified and incorrectly blocked.   The NBAR team really needs to also publish the confidence level for these models.  Does "best effort" mean the machine learning model was 68% confident, 95% confident, what? This is great feedback - I will bring definitely bring this up and see what additional context we can get. ... View more

The above post from @Isack2230  is correct - after some discussions with the folks who maintain the NBAR protocol packs, we got some clarification from them that the "statistical" rules are all considered "best-effort" on their part. Per some requests, the protocol pack documentation has been updated to ensure it's more clear these rules may not be as accurate as others: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/prot_lib/config_library/nbar2-protocols/nbar2-protocols/s.html#wp2346607100   For now, because of the continued issues we've seen reported with its accuracy and false positive rate, the rule has been disabled on Dashboard, and should no longer be configured or configurable.   Side note: it remains to be seen if complaints come up with any of the other "statistical" rules in the protocol pack, since they're all similarly flagged as potentially being inaccurate in the PPACK documentation. We aren't currently entertaining ideas to disable any other rules, but we'll be keeping an eye on complaints and case data that might prompt us to reconsider this position in the future. ... View more

I also agree with Phil here, and want to give a bit more technical context on this response.   A DDoS falls under the broader umbrella of what's known as a resource exhaustion attack: https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-015_Denial_of_Service   While I've seen varying descriptions, in general, any resource can fall under such an Umbrella, including network bandwidth. If someone's saturating your uplink with garbage downlink traffic, there's very little mitigating it on your network perimeter would really accomplish anyway. In a more traditional sense, we can't mitigate against a DDoS consuming CPU or memory either; processing that many inbound packets through our IPS and inbound firewall is always going to consume both. ... View more

Just to give fair warning, in its current form,  it's a *very* limited support feature, and it's far from being something Meraki Support can recommend using. ... View more

The only way it might be possible is if the app does any sort of separate peer-to-peer communications for file sharing, or  establishes a session with a distinct subdomain for it, but I've never used the app, so I have no clue on either. ... View more

SFTP is all tunneled over SSH, which removes the need for such NAT hacks. Past experience has dictated that any sort of NAT considerations for FTP aren't likely to be implemented given that FTP is a cleartext protocol that transmits usernames and passwords unprotected.   As for the the firewall rules, "implicit" implies that it's an unspecified behavior, which is not the case. Yes, there's a default allow rule, but it's very much explicit. ... View more

In this case, you have two options, depending on the nature of your setup: Configure the non-Meraki device to expect the private IP address of your primary uplink on the MX as the presented ID Configure the peering on Dashboard so that the LocalID of the MX is whatever public IP its traffic is getting NAT'd to ... View more