Updated list, 3 new ones at the bottom in the last day.   98.197.21.76/32 98.197.26.56/32 141.98.11.79/32 149.50.116.115/32 185.224.128.74/32 193.177.182.40/32 80.94.95.45/32 185.16.39.29/32 69.69.69.69/32 98.50.117.73/32 98.50.117.56/32 98.50.117.57/32 70.70.70.70/32 198.100.150.85/32 98.27.28.1/32 69.69.69.70/32 98.27.12.6/32 98.27.28.26/32 98.27.28.34/32 98.27.28.31/32 87.120.166.70/32 87.120.166.69/32 87.120.166.231/32 98.50.117.71/32 87.120.166.201/32 80.75.212.46/32 193.111.248.54/32 74.74.74.74/32 ... View more

this is a couple years back, i thought i ask regarding your suggestion.  I have this setup, but using another device, so i can have a 3rd wan (5g).   all seems to be fine, my question is while the 250 wan2 is on dhcp i have a private ip, assuming this will be double nat, it does show the public static ip on wan2.   on my third party device with the secondary internet circuit, i setup port forwarding to the 250's private ip, disable all IPS on the 3rd party device etc.   i am using traffic shaping rules on the 250 on wan2 to prefer some subnets to use, like my guests, iot etc.   tested with load balancing, no issues at all - showing public static ip's ok.   i know some other models have the 3rd wan capability, be nice if they implemented on the 250.   is there anything else you would recommend?  thanks mate. ... View more

Any plans to roll out to 250's? ... View more

another cash grab to update all these older ones. ... View more

same, i just checked it wont allow firmware upgrades higher on MX84.  I got to check when these will be eol. ... View more

Which MX couldn't receive updates?  Which model are you using now?  Thanks ... View more

No dev since 2018 wtf?   Lens flare is killing me. ... View more

3 new IP's - this is getting out of hand.   98.27.28.1 69.69.69.70 98.27.12.6  ... View more

New IP -   msg: SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt   msg_type: security_event   name: xxxx priority: High   protocol: udp/ip   sha256:   shost:   signature: 1:61865:2   src: 198.100.150.85:500   src_ip: 198.100.150.85    src_port: 500   type: ids_alerted   url:   ... View more

2 New IPs -   msg: SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt   msg_type: security_event   name: xxxx priority: High   protocol: udp/ip   sha256:   shost:   signature: 1:61865:2   src: 98.50.117.57:500   src_ip: 98.50.117.57    src_port: 500   type: ids_alerted   url:       msg: SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt   msg_type: security_event   name: xxxxx priority: High   protocol: udp/ip   sha256:   shost:   signature: 1:61865:2   src: 70.70.70.70:500   src_ip: 70.70.70.70    src_port: 500   type: ids_alerted   url:   ... View more

I agree, we should all launch a campaign until it gets sorted.  I'm not closing mine. ... View more

I still have an active ticket open here's the reply.  Unbelievable.     Hey xxxx,   We can escalate but it would be ineffective for changing this behavior. The best way to request a behavioral change would be to submit a feature request through your sales rep. Please let me know if you have any questions.   Thanks,   xxx xxxxxx Cisco Meraki Technical Support ... View more

New IP -   msg: SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt   msg_type: security_event   name:  priority: High   protocol: udp/ip   sha256:   shost:   signature: 1:62808:1   src: 98.50.117.56:500   src_ip: 98.50.117.56   src_port: 500   type: ids_alerted   url:   ... View more

New IP -  src: 69.69.69.69:500  ... View more

No problem, as I get them - they'll be posted here for the community.  High severity logs from the appliances are sent to our SIEM.   I still have an active ticket open, hopefully some intention of actually sorting out. ... View more

New IP -   80.94.95.45 ... View more

Agreed, dragging out since Feb /24. ... View more

I followed up on my open ticket with them 2 weeks ago.   They really need to have this addressed, how are customers going to know there is no issues unless you ask. ... View more

Please share the IP's. ... View more

More attacks today.   src_ip: 185.224.128.74 src_ip: 149.50.116.115 src_ip: 193.177.182.40 ... View more

Here's my response from support today - haven't seen these since the beginning of this thread.  Started seeing them lately from 6/30/24 - current, sent to our SIEM.   Response -   I investigated this further and have provided an explanation below of the behavior you are seeing.  The MX actively listens on UDP port 500/4500 for incoming Client VPN connection requests. We can see that these remote IPs are using UDP port 500, however these incoming connections are not being forwarded onto the LAN. Although it says "allowed", that is just the default IDS event value in the logs when no two-way traffic flow was detected. The MX inbound firewall blocked this connection attempt before SNORT (IDS/IPS engine) was able to complete its packet inspection. Having prevention enabled under Threat Protection will actively scan and filter malicious traffic pattern, so that setting is good.  Here is also a Meraki community thread that talks more about it - https://community.meraki.com/t5/Security-SD-WAN/Security-Center/m-p/224281 I can confirm that the MX and SNORT are doing their jobs as expected. Please feel free to let me know if you have any additional questions. ... View more

Lets keep a active list -  Here's mine in the last 2 weeks.   98.197.21.76/32, 98.197.26.56/32, 141.98.11.79/32, 149.50.116.115/32, 185.224.128.74/32 ... View more