Meraki

PhilippGreindl · ‎Apr 16 2024

When doing a migration with over 80 fw rules its always good to have a catch all rule to see if traffic is not matched above. Its an allow rule because we dont want to get errors on the user end. If the firewall log is working like any other firewall I could easliy see what traffic matches that rule and make the corrections. But it seems im stuck here. I will open a ticket. Thanks anyway 🙂

PhilippGreindl · ‎Apr 16 2024

Hi there, you guys are right. But most of the time only the L7 entry is shown. Sometimes I can see the associated L3 rule. Its just getting weirder. Because the L3 rule is always shown as #0. I have no #0 rule allowing anything. Before the default allow rule is a deny any rule. Here is a screenshot of the log with L7 and L3 entries: Here a screenshot of my fw rules: Please enlighten me regarding this matter. Regards Philipp

PhilippGreindl · ‎Apr 16 2024

Hello there, yesterday we created about 80 new FW rules after migrating all services to our MX-Cluster. Today I want to see if everything is working and if traffic is getting allowed by the correct rules. In the firewall log I can see almost every entry is allowed by layer 7 default rule. We don't use any layer 7 rules, only layer 3. See screenshot from log. Traffic from 10.10.241.130 should be allowed by rule #1. Is this normal behaviour or am I missing something? Regards Philipp

PhilippGreindl · ‎Mar 4 2024

Well that is underwhelming. But thanks for your answers, we will try to solve this with a workaround.

PhilippGreindl · ‎Mar 4 2024

Hello there, we have a MX85 with different subnets. For simplicity I will just use one in my example. The MX is installed in a data center where other partys are connected to. We have a transfer interface with a static route to the other party. Our subnet: 10.10.200.0/24 Transfer interface to other party: 100.64.26.1/30 Other party subnet: 172.16.23.0/24 Screenshot static route: Now we want to SNAT our subnet 10.10.200.0/24 and mask it so it shows as 100.64.26.1./30. That should be a pretty basic feature because others partys can't always work with our subnets (Duplicate subnets or compliance reasons). But somehow I am unable to find it... Thank you for you help! Regards Philipp

PhilippGreindl · ‎Feb 16 2024

Great question! We have a similar topic with one of our customers. I hope Meraki Support can find a solution for this or enlighten us with a best practice guide.

Meraki

Community

About PhilippGreindl

PhilippGreindl

Community Record

Badges

Re: Firewall log always shows Layer 7 default rule allowed the traffic

Re: Firewall log always shows Layer 7 default rule allowed the traffic

Firewall log always shows Layer 7 default rule allowed the traffic

Re: MX85 - How to SNAT our LAN to other party subnet over transfer interfac...

MX85 - How to SNAT our LAN to other party subnet over transfer interface?

Re: Upgrading MX-Firewalls bound to Template