Meraki support confirmed this behavior does exist. You can ping 8.8.8.8 from an MX, but when the India filter is enabled, traffic from the LAN to 8.8.8.8 is dropped (I replicated it on 3 MX's running firmware 14.42 - deleting specifically "India" allows it to work). Meraki support's explanation is that Google moved their 8.8.8.8 server to India recently and the solution is to unblock India. Their assessment is incorrect since 8.8.8.8 is an "anycast" address that routes the traffic worldwide (https://developers.google.com/speed/public-dns/faq#locations). In my case, the traffic remains in the United States, so including 8.8.8.8 in the India layer 7 rule set is a bug. It's just as bad as blocking the Google homepage and claiming that it's in India, when it's hosted worldwide. We do use DNS servers other than Google's, and we have used the OpenDNS/Umbrella servers before, but unfortunately we have 3rd party solutions on the LAN that use the 8.8.8.8 so we have to either unblock India or create a group policy that allows for a layer 3 "allow" rule to override the layer 7 country rule. If you've tested your ability to pass traffic from your LAN to 8.8.8.8 with firmware 14.42 and the India layer 7 filter enabled, perhaps there is some kind of intermittent mechanism occurring? According to support, it should be blocked...
... View more
