Yes I'll do that now that dgander has reconfirmed his position with MX v18 and Snort 2.9   ... View more

I spoke with Meraki Technical about this again recently and they are telling me that the only way to run Snort 2.9 is to go all the way back to MX v15. Obviously this contradicts what dgander was saying earlier about their experience with MX v18 and Snort v2.9. It would be great if we could get a definitive answer from Meraki as to whether MX v18x and Snort v2.9 is doable. This combo sounds like it's about the least bad workaround for the moment. ... View more

Did Meraki say anything about whether Snort v2.9 has had previous vulnerabilities sorted? My understanding is that there was a vulnerability in Snort 2.9 which was addressed when they went to Snort v3.  ... View more

I'll be very interested to hear how you get on with v18 variants and what Meraki technical say. I'd not heard that a flavour of v18 was meant to have a fix. We've had an MX100 running 17.10.5 with IDS set to "Prevention" and using the "Connectivity" ruleset for about two weeks now. We get about 650meg throughput tops on this MX100. Prior to Snortv3 this particular MX ran IDS on "Prevention" using the "Security" ruleset and had a throughput of around the 850-900 meg mark.  ... View more

We are going to try taking one of the MX100s we have that is running v15 (locked) at the moment up to 17.10.5. We've been discussing this with Meraki TAC again recently. We have been told to go to 17.10.2 first and then 17.10.5. Once the MX100 is running 17.10.5 our intention is to try changing the Intrusion Detection and Prevention config to use the Connectivity ruleset. Our understanding is that this should get us to a position where throughput on the MX will be around 600/700 meg. Obviously I'd much rather stick with the Security ruleset but this hurts the throughput an MX100 running v17 or v18 too bad. Will report back on how we get on. ... View more

Yeah, seeing lots of this from multiple MX networks. Virus Total does not show any vendors identifying it as malicious.   I notice the following relating to the file in Securtiy Centre: downloaded from [http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3d3c4265-57fd-450e-9bda-9fb5f4612029..... So it's come from microsoft.com  Feels like a false positive I'd say ... View more

The latest I've heard from Meraki Tac is that 17.10.2 does contain a fix for the Snort performance issue. However, there is a significant caveat, they say IDS needs to be set to the "Connectivity" ruleset. We've only done some initial tests so far and it's a bit inconclusive as yet. Strictly speaking, this should bring the MX100 back in to line with the performance figures quoted on the sizing guide. I'll update once we have more testing done...  ... View more

As far as I'm aware 17.10.2 does contain a fix for the IPS/IDS performance issue but I'd be more than happy to be proven wrong. I'm awaiting an update from Meraki TAC as and when the fixed is brought out.  ... View more

Hi dgander, We've not tried 17.10 on an MX100/SNORT yet but Meraki TAC tell me that 17.10 does not contain the fix for this particular performance issue. I'm told they are still working on producing the fix.   ... View more

Thanks eyre-jr,   Yes the hash looks the same. Security centre reports the threat as: W32.D73298C7C8-69.SBX.VIOC ... View more

Sorry, everyone, I accidentally hit "accept solution" when I was just meaning to hit reply! Just to be clear, I don't have a solution for MX100 as yet. Unfortunately I can't seem to spot a way to un-accept a solution that I've accidently marked as accepted...   ... View more

Hi Rob2041, Meraki TAC tell me that the MX running v17 and Snort v2 still has the Snort vulnerability. They also tell me that the performance issue is now sorted for MX250/450 in v17 and they are continuing to work on a fix for other MX models running newer firmware than v15. ... View more

Hi Rob2041, that's very interesting to hear. I was unaware that a version 17 variant could be run with Snort on V2. Do you know if the snort vulnerability in V2 has been addressed in this particular scenario?   ... View more

I see that if we follow the link to the rule details in Snort this rule now shows as "deleted". I guess this means we can switch off the whitelisting of this rule if it has actually been deleted? ... View more

We've now got multiple MXs with IDS set to prevention and the whitelisting of Rule ID1-60381. All looks to be working OK now.   ... View more

Hi JessIT1, I'm just waiting to hear if the IDS allow has worked for actual users... ... View more

Just off the phone with Meraki TAC, engineer was very helpful. They have just now added an IPS rule called OS-Microsoft Windows IIS denial-of-service attempt 1:60381. We should be able to allow this rule if we wish as a form of workaround for the moment.  Seems that it is a Microsoft update related issue but I'm not too clear on it yet. ... View more

 We are also seeing lots of "Microsoft Windows IIS denial-of-service attempt" occurances on multiple MXs. Appears to impact on google drive too if using the app as opposed to browser.  ... View more

That's intereasting dgander. For us it looks like it's related to Snort v3. When running versions 16 or 17, performance seems OK as long as IDS is switched off. As soon as IDS is enabled again the throughput drops by about half. We tried 16.16.4 most recently but still had the same issue. ... View more

Thanks Thomas.      ... View more

Thanks ww, yeah, we thought about twinax as a possibility. Copper/RJ45 is going to be easier given the physical ports on the server and distance. ... View more

Thanks very much for the kind offer of trying an fs.com transceiver. I'll be very intereasted to hear how you get on. ... View more

Meraki TAC have told me that it's a recognised issue and they are working on a fix. I'll update this thread as and when I get more news.  ... View more