Did the destination happen to be across an AutoVPN tunnel, and you’re using a full tunnel with this MX as the exit hub? If that’s the case then the IDS/IPS only operates in IDS (i.e. non-blocking mode) for traffic destined across the AutoVPN tunnel. (Reference, https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings, first blue highlighted box). ... View more