I'm trying to streamline and organize my firewall rules a bit more and I noticed that when creating a Layer 3 rule, I can put multiple CIDRs and IP Addresses separated by commas.  I was going to allow traffic in and out to a specific device, but I assumed I'd have to make a rule for each direction.  This is how I've usually done it when allowing traffic for both directions:     Is it possible to make 1 rule and allow traffic in and out by separating by comma?  Is this good practice?  Like this?   NOTE: I'm blocking all other traffic on this subnet, I just want to allow access to this one device.  I'll probably break it apart by port if this actually is ideal.   Also, are there other keywords I can use in these SOURCE and DESTINATION (like ANY)?  Such as WAN or LAN?  Or just use the gateway address maybe?   Thank you ... View more

I'm trying to setup more efficient vlans on my network.  When I inherited this network over a decade ago, it was a single broadcast domain on a single subnet with no VLANs.  Over the years I've implemented IP cameras, IP telephones and better network equipment.  I have an MX84 appliance with 3 Extreme X440-48p-G2 switches that are stacked.  Technically the 3 Extremes are stacked as a single switch though.  This is a single network (nothing remote I'm trying to connect between...yet).   In the last few years I've tried to segment devices by vlans.  First my IP phone system, and most recently our virtualization host.  Now I'm working on IP cameras but I'm running into issues.  I'm not sure if it's the MX configuration or the extreme, or a mix of both.  I'll try to be brief and concise, but please know my VLAN experience is minimal, though I've learned a lot recently.   My MX is configured with 4 subnets/vlans.  Instead of typing them all, I'll provide this screenshot from my appliance.     As you can see, there are 4 subnets, each with an MX IP and VLAN ID.  The 200 subnet is my main with all my workstations, clients, etc...   The nutanix subnet (vlan 10) is where my virtualization host resides, though I should mention that the servers that it host are technically in the 200 subnet.  Telephony and cameras are self explanatory.  My domain controller provides DHCP to all these subnets (no dhcp requests are handled from the MX or my switches).  You can also see that Port 3 is trunked to my switch stack (port 1 on the switch, vlan 200), and that it drops untagged traffic, but allows all VLANS.  I'm not sure if this is the correct way to configure this or not.  Right now I only have a couple rules setup on the meraki, which was setup with the help of my virtualization vendor when we setup the virtualization host and it's vlan.  I believe they are used to allow traffic between the virtual server vlan (nutanix 10) to my inside vlan (inside 200)  They look like this:     Now, I tried moving all my cameras to the camera 30 vlan (they have always resided on vlan200, with all my workstations and servers). They get a dhcp address, however the only way I can get them to connect to my camera server (which is on the inside 200 vlan, per manufacturer request) is to have Port 1 tagged on the camera vlan.  But this unfortunately gives the vlan access outside to the internet and everything else on my network.  I tried removing the port 1 tagged from the camera vlan and adding a rule on the meraki which allows traffic (only on ports needed) from the cameras the camera server in vlan 200 but that wouldn't work either.  Even with InterVLAN routing turned on in the switch for the vlan 30, it won't work.  I want this VLAN to only have camera traffic on it, and setup a rule to allow traffic from the cameras to the camera server (I did this, but  never got hits on the rule).  The same goes for my telephony vlan.  Currently, all my IP phones (on telephony vlan 20) are pingable from all the other vlans, which I thought defeated the purpose of vlans.  The telephony vlan also has port 1 tagged (as do all the vlans).  If I remove port 1 tagged, I lose connectivity to the gateway which of course is needed for them to work.  It's either all traffic, or nothing in regards to port 1 tagged on each vlan.  I'd like the phones (as well as cameras) to be segmented off my other vlans.   Here's how the vlans are setup on the extreme switches.  Instead of pasting each vlan config here I'll link to a text paste of them:  https://pastebin.com/sn99iBAm   My question is (for starters) is this an effective setup?  I was reading up on other vlans similar to this and they suggested NOT setting IP addresses on the vlan and instead use the meraki for routing.  Currently, all my vlans have an IP address.  Ideally I would like to move my virtual servers to their own VLAN as well, but I'm very confused about where routing should be setup for the vlans, on the switch or the firewall?  How do I allow only specific traffic between the vlans when I need? I apologize if this is enigmatic and all over the place.  This has been a bit frustrating because the tagging isn't working as I expected.  I also made a diagram of the network as it is (to the best of my ability).  The only difference is that the cameras are currently connected to vlan 200 instead of being in camera vlan 30.  Here is the diagram.   Thank you!         ... View more