Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About CCO
Community Record
9
Posts
2
Kudos
1
Solution
Badges
Jan 27 2020
7:01 AM
Hello Randhall, Many thanks for the update ! I'm currently checking what were the improvements in MR26.x and I see interesting things, such as: - Bug fixe in MR26.1: Facebook app not blocked by Layer 7 firewall rules (All MRs) "My" current version is MR25.14, but the next available Stable candidate is MR26.6.1. I will check this. Regards.
... View more
Jan 15 2020
2:13 AM
1 Kudo
Hello All, For the ones who have been interested by this case, here is finally the outcomes of my investigations and actions. The firmware upgrade did not help to improve the behavior, I mean, I continued to observe Netflix traffic despite the Layer 7 firewall rule. I captured some traffic logs and confirmed that the dest IP addresses were registered for Netflix infrastructure. I applied Layer 3 firewall rules denying those destination IP addresses. Finally, this was successful. 1 month later, only some few kB are now reported against Netflix while I had GB before. Here is the full list of IPs summarized and denied: Thanks again to have shared experience and for the brainstorming. Regards.
... View more
Dec 10 2019
6:10 AM
1 Kudo
OK. Based on the previous post of Geoff, I will try first to upgrade to the latest software version available for MR33 (25.14). Then, if no improvement observed, I will run a trace investigation session to capture the flow and then apply URL rules. I will see the outcomes. Thanks to both for the experience sharing.
... View more
Dec 10 2019
6:02 AM
Hi SLR, Thanks for your post. Do you mean you set dedicated Layer 7 firewall rules against those URLs ?
... View more
Dec 10 2019
4:26 AM
Interesting... I have MR33 Access Points, software is MR25.11. Regards,
... View more
Dec 10 2019
3:11 AM
Hello "Geoff", Thanks for your highlight. In my case, I set the captive portal strength to "Block all access until sign-on is complete". By the way, a colleague of me tried in a LAB, to check if Netflix can be blocked with a Layer 7 firewall rulle set with "Deny Netflix" ... It does not work, he reach Netflix and have some fun ... I am now convinced the security through Meraki AP is not at the level we can expect it should be. Regards,
... View more
Dec 5 2019
10:06 AM
Hi Nolan, Thanks for your reply. That's my problem ... The SSID is a guest one, so no group-policies applied. The rule is set since several months. I receive regularly the monthly report and "oh surprise!" some GB of data against Netflix are reported ... Opened a case .. the answer is "Meraki Layer 7 Firewall is based on Best Effort"... Something I do not understand, if Meraki detect/report the Netflix traffic and a rule is set at Deny, it should be blocked, no brain ... but it is not working.
... View more
Dec 5 2019
9:51 AM
In fact, the traffic I want to block is defined in the list (Netflix). But despite, a rule is set (Deny), I continue to see Netflix traffic to run over the SSID. This is the point, I know that Netflix traffic can flow through CDN, but in my case, the traffic is detected as it is flagged Netflix in the usage, butu despite this it is ot blocked ! How it is possible ? Because the Layer 7 Firewall is not working ... the response recieved is the object of my message (Meraki Layer 7 Firewall is based on Best Effort)... the reasosn why I would be interested to see if someone encountered this kind of behaviour ?
... View more
Dec 5 2019
6:27 AM
Hello Meraki Community, I have been told that the Meraki Layer 7 Firewall solution available in Meraki MR AP dashboard is based on best effort, as it is not able to block certain traffics even if they have been defined within the Layer 7 firewall rules Application list. I'm surprised because despite the traffic has been recognized as a wellknown defined application, it cant' be blocked ... It seems to be very unuseful, do you have such kind of experiences ? Regards,
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 6443 | Jan 15 2020 2:13 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 6443 | |
| 1 | 6875 |
© 2024 Cisco Systems, Inc.
