Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Sarv
Sarv
Getting noticed
Member since Jun 14, 2021
Oct 1 2024
Community Record
47
Posts
6
Kudos
1
Solution
Badges
Oct 1 2024
6:59 AM
I found the documentation for this, it states the following: "The inbound firewall overrides the “allowed inbound connections” field for NATs, port forwards, and firewall host services, etc" Here is the link to the complete documentation https://documentation.meraki.com/MX/Networks_and_Routing/NAT_Exceptions-No_NAT_on_MX_Security_Appliances
... View more
Sep 27 2024
9:20 AM
Guess I will just play around with the rules and see how they impact each other. Thanks Sarvjit
... View more
Sep 27 2024
9:19 AM
Default Deny All rule is for Dual Stack and not just IPV6. We haven't touched it so that must be the default.
... View more
Sep 27 2024
8:03 AM
I see a default "deny all" inbound Layer3 rule on our MX. I'm going to assume that Deny All inbound layer3 rule has no effect if you create a NAT Forwarding rule. Is that correct? Just wanted to verify before I start creating Forwarding rules. Thanks Sarvjit
... View more
May 2 2024
11:07 AM
Community If I setup a new Group Policy and select "Custom network firewall & Shaping Rules", are these custom rules merged with the existing "Global" Layer3 rules? or does it ignore those Global rules? I know for the content filtering section you can select Append, but didn't know what it does for Layer3 rules. Thanks Sarvjit
... View more
Aug 4 2023
11:20 AM
2 Kudos
Thanks. I will try that, but ultimately Meraki needs to have a solution for Third Party VPN that allows L3 inbound rules to be created.
... View more
Aug 4 2023
6:00 AM
We are creating a site-to-site VPN tunnel to a third party (MX 250 on our side, Palo 850 on the third party side). Since all of the layer3 FW rules are outbound only including VPN FW rules on the MX, how do I stop IP's on the remote third party side from accessing any subnets/VLAN's enabled over VPN? Bearing in mind that I have to setup the entire remote subnet in the Private subnets setup in our site-to-site vpn tunnel configuration on the MX. I want to allow only a handful of IP's from the remote subnet to access any devices on my side of the tunnel. I can put in DENY rules for outbound but since the FW's are stateful that doesn't stop connections initiated from the third party site. Anyone have any insight into the correct way to secure the tunnel? We do not have any access to the third party FW. Thanks Sarvjit
... View more
Here is the scenario: We will have a setup of switches in a remote data center that we do not control (customer site, controlled by internal I/T). The customer wants a layer2 circuit between our DC and theirs. On the trunk port in our DC (Meraki MS) and the trunk port a the remote customer site DC can we disable RSTP, I don't see any need for this (the circuit between the 2 DCs will be an Metro-Ethernet circuit). I would like our Meraki Switches to the be the root bridges in our DC and Customer would have their Core Stack as the root bridges in their local network/DC. Does anyone see an issue with disabling RSTP on the trunk port between the 2 sites? Thanks Sarvjit
... View more
Labels:
- Labels:
-
Layer 2
Jun 19 2023
1:42 PM
I suspect it will be a hybrid of those 2 approaches above. I will do some testing in our lab. Thanks
... View more
Jun 19 2023
1:23 PM
1 Kudo
I don't think source based route will work in this scenario (internet traffic still needs to go out the local ISP at HQ). Basically, we want all DC subnet traffic to use AUTOVPN as secondary route to the DC if primary route fails (Metro-Ethernet). Thanks Sarvjit
... View more
Jun 19 2023
1:06 PM
I am looking at a solution for the following scenario: Customer has a private Metro-Ethernet connection between HQ and DC. Customer also has MX's in both locations, Customer has 2 ISP's at both locations (HQ and DC), both WAN ports at each location are used by the Primary/Secondary ISP What we would like to do: Metro-E connection terminates at both MX's LAN port (HQ and DC) Enable all DC VLANs/Subnets over AutoVPN Setup up Static Route on MX's to route traffic over Metro-E (assuming static route will take precedence over VPN route) if the Metro-E fails between HQ and DC, would like the traffic to flow across VPN. Is this possible by using static route on MX with condition (use route while device on the other side pings) Thanks Sarvjit
... View more
Jun 13 2023
2:33 PM
If you have the default L3 rule "allow all" and no L7 rules doing any kind of deny. Then you should be good. The problem has to be on the other end (SQL side). Typically for this you want 1433/1434 UDP/TCP open (default ports) for communication to SQL (however that's up to whoever setup SQL on the other end) but as stated you are not denying outbound traffic so you should be good on your end. I would check with the other side to see if they are blocking inbound connectivity to the SQL instance.
... View more
Jun 13 2023
1:57 PM
One additional note, make sure you don't have a Layer7 rule blocking access to this SQL resource, again that rule would apply to outbound traffic only.
... View more
Jun 13 2023
1:54 PM
It almost sounds like you want to access a SQL server (somewhere on the internet) from inside your network. If that is the case the default L3 rules I believe are allow all (unless you are denying outbound). If you do not have a L3 rule denying then you should be good to go accessing any services. You also do not need an inbound rule for this traffic as the FW is stateful and will allow that same traffic (initiated from internal network) inbound. If the SQL server is on your internal network and you want to allow access to this server externally then you will need a Port Forwarding rule (1:1 NAT rule or 1:Many Nat rule if you want to use a Public IP other than the one you have assigned to your WAN interface, assuming you have multiple public IPs allocated to your company). BTW: from a security perspective I would not allow inbound access to your SQL server directly, since I dont know what application you are using I can't make any recommendations on how to best to allow secure access.
... View more
Jun 12 2023
2:33 PM
I received another response from Meraki support on this. Same thing as before. Anyone from Meraki look at issues in this forum? Response from Meraki: they are aware of this on-going issue and have attached my case/ticket to the parent case. As I stated I opened a case for this at least 6 months ago with the same type of response. I can only say that I am disappointed that Cisco/Meraki does not take these type of issues seriously or they would have had a fix by now.
... View more
Jun 12 2023
2:15 PM
When you setup the configuration of the SPARE you are giving it the configuration it needs on the WAN side (just make sure the WAN is cabled up to the spare). Once you boot up the spare the configuration will be deployed to the spare. I believe the configuration is deployed to the spare via the Primary FW (assuming everything is cabled properly on both WAN an LAN side, its important that the LAN side be cabled up on both primary and spare and all VLAN's on the LAN side properly presented to both primary and spare from your switches)
... View more
Jun 12 2023
2:11 PM
During the spare configuration it asks you if you want to use the existing PRIMARY MX WAN IPs, or if you want to use a VIP configuration (each MX would have its own PUBLIC IP's + a VIP Public IP -- So you would need to have at least 3 Public IPs in that scenario assuming you only have one ISP). Then boot up the Spare and it should work, in essence you are configuring the WAN links for the SPARE without booting up the spare first.
... View more
Jun 12 2023
1:32 PM
one additional item to note, once you add the spare you need to configure how the spare (while it is still powered off), you have to decide on using the mx uplink IPs (WAN) or virtual uplink IP (WAN side as well). Once that is done, power on the spare and should be good to go.
... View more
Jun 12 2023
1:27 PM
We have always cabled up the spare (while powered off) (identical to the Primary). Then added the spare via the dashboard to the network. Then powered on the spare, this has worked for us every time. We have never configured anything on the spare in the past, assuming everything is cabled up properly (WAN and LAN ports).
... View more
Jun 12 2023
1:23 PM
1 Kudo
Its not supported, however, we have aggregated ports from multiple switches/ports (physical switch stack) and it seems to work (in production enviornment), we have been using this configuration for almost a year without issue. The switchs (stacked) will use spanning tree to block one of the aggregated ports. We have tested by unplugging one of the aggregate ports from the switch side, traffic flows across the 2nd aggregated switch port almost instantaneously. I'm not suggested you try it but just replying with my experience.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 399 | Oct 1 2024 6:59 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 882 | |
| 1 | 1586 | |
| 1 | 3557 | |
| 1 | 974 | |
| 1 | 1356 |
© 2024 Cisco Systems, Inc.
