Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About HScar
Community Record
18
Posts
11
Kudos
1
Solution
Badges
May 20 2022
11:00 AM
Totally agree. I'm so disappointed in their current design in L7/NBAR Firewall. Just a side note, I have had some success using FQDN's in Layer 3 to bypass country blocks.
... View more
May 20 2022
10:22 AM
2 Kudos
I guess I'll pile on the list here. Awesome NBAR is blocking Google Chrome Sync on TCP 5228. Thinks it's Google Hangouts/Streaming Video Category on Layer 7. NBAR 1087. Also blocking OpenDNS under NBAR ID 1087. UDP 53 and thinks it's Google Hangouts too. There's another thread on this. Who designed this garbage?
... View more
May 12 2022
5:03 PM
Sorry to hear that! I really wish Meraki would fix their L7/NBAR and add a stinkin' allow list. It's laughably inaccurate with the categories for just about any of them.
... View more
Mar 28 2022
9:04 AM
2 Kudos
I would say that's disappointing if that's their plan to resolve this. As many have said, there should be an allow option for L7 rules and/or an allow option for NBAR categories in the dashboard.
... View more
Mar 22 2022
8:56 AM
Hi Everyone, Was hoping to start a thread on general best practices specifically for Meraki devices in regards to President Biden's call for private companies to increase their cyber defense focus. The list of best practices was put out and I've got the link here: https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/21/fact-sheet-act-now-to-protect-against-potential-cyberattacks/ How are you implementing these defenses with your Meraki devices?
... View more
Mar 21 2022
9:29 AM
This is exactly what is holding me back as well. They had this in the beta of 16 and eventually fixed it. I'll be very happy to drop Brightcloud and move to Talos. They're much more on top of it.
... View more
Feb 15 2022
2:25 PM
The confusing part for me is why these events are showing up in syslog, but not the Meraki dashboard's event log or Security Events. There are dozens of these events that come up each month. I'd prefer not to add these hashes all the time. I've tried whitelisting the download.windowsupdate.com domain and they still show up in syslog.
... View more
Feb 15 2022
9:24 AM
Hi, I'm trying to investigate what are most likely false positive IDS events that are being outputted by our MX via syslog. Here's an example of one: MX100 security_event security_filtering_file_scanned url=http://download.windowsupdate.com/c/msdownload/update/others/2022/02/36119907_fbffd9be78a28e77092640722a86ff95490d20b4.cab src=XX dst=XX mac=XX name='' sha256=6f8fd79ae33f21e589f4d02fdecbc9ee547c079fecc31672a0de8b12f2b05a47 disposition=malicious action=block The SHA256 turns up no hits on Virus Total and there are no reports of this showing up in the Event Log or the Security Center. This has been happening for sometime for us on various windows machines doing updates and I haven't been able to get to the bottom of it. Any help would be appreciated.
... View more
Feb 7 2022
3:42 PM
4 Kudos
We are also suffering from false positive blocks. I can't believe Meraki doesn't allow any kind of whitelisting on NBAR because it's not super accurate. +1 on the feature request.
... View more
Jan 24 2022
11:20 AM
Nice. Sounds like we've narrowed the problem. Do you use an internal DNS or any kind of DNS filtering service? I would start investigating there to see why(and where) it's resolving.
... View more
Jan 21 2022
2:18 PM
1 Kudo
Next I would try doing NSLOOKUP and see what IP address that site is resolving to from your DNS. It's resolving to 50.116.60.143 and working properly with https for me. You can also play with this from the Meraki dashboard, under appliance status and, clicking on the Tools button and using DNS Lookup. After that, you may want to check your firewall flows and do some packet captures to see if traffic is going to the correct IP. You need to export to a syslog server to see flows on an MX. Good luck!
... View more
Jan 20 2022
6:46 PM
1 Kudo
I would start by checking the Event Log on the MX Dashboard to see if it's blocking the website. You can also enter that domain/website under the content filter to see if it'll be blocked.
... View more
Jan 20 2022
6:39 PM
I would also like to recommend that Meraki add more ways to Whitelist NBAR. It's a real pain to have to create group policies for devices and lose our 2 way MX firewall rules. As a school, we can't realistically turn off Peer to Peer and NBAR blocks too many false positives.
... View more
Nov 18 2021
11:59 AM
Thanks! Adding the IP to the content filter whitelist solved the issue.
... View more
Nov 17 2021
4:12 PM
Hi, We are on the latest Stable RC 16 for our MX100 and finding that's it's blocking a lot of things that it shouldn't. Is there anyway to make exceptions for certain websites or IP Addresses? For example, we can't access our Camera DVR system because it says it's using Statistical Peer to Peer. As we are a school, we can't unblock Peer to Peer everywhere, but need a simple exception for this device. Thanks for any help!
... View more
Feb 12 2020
5:57 PM
Sorry I didn’t make that more clear. I mean block ALL websites that don’t return a category.
... View more
May 10 2019
12:21 PM
1 Kudo
Hi, We are seeing AMP blocking websites and not logging as well. We are on 14.39. Nothing in Dashboard Event logs or syslogs. An example website is espressif.com
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 2709 | Jan 21 2022 2:18 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 20420 | |
| 2 | 18015 | |
| 2 | 19935 | |
| 1 | 2709 | |
| 1 | 2724 |
© 2024 Cisco Systems, Inc.
