topic Re: Meraki firewall on SSID not working in Wireless

Meraki firewall on SSID not working

carl_townshend — Tue, 22 Jul 2025 07:23:38 GMT

Hi All

We are having some issues with some MR42s, basically we have a Guest network and its using the AP in NAT mode, we can ping devices on our LAN for some reason, even though there is a deny rule on the SSID blocking them to reach local networks, we have added a rule also, however it appears to have no effect. They are on MR 30.7.1

Any ideas why this would be?

Re: Meraki firewall on SSID not working

nicdc01 — Tue, 22 Jul 2025 07:40:00 GMT

Hey;
Would check to make sure you are assigning the rule to the correct SSID.

Wireless > Configure > Firewall & Traffic Shaping

Source:
https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Configuring_Simple_Guest_and_Internal_Wireless_Networks

Re: Meraki firewall on SSID not working

carl_townshend — Tue, 22 Jul 2025 07:58:24 GMT

It is indeed attached to the correct SSID

Re: Meraki firewall on SSID not working

nicdc01 — Tue, 22 Jul 2025 08:30:27 GMT

Firmware update or raise a ticket with support.

Re: Meraki firewall on SSID not working

aleabrahao — Tue, 22 Jul 2025 10:33:23 GMT

But is it only ICMP that's working, or can you access other internal resources?

Can you share a screenshot of the SSID and firewall configuration?

Re: Meraki firewall on SSID not working

DainBrammage — Tue, 22 Jul 2025 15:15:23 GMT

To add to what alemabrahao has said , Pinging from where to where and if using ping tools from the dashboard, which screen and tool?...

Also you said your APs are in NAT mode, if it is NAT mode there is no way it can access the LAN. as the AP each run their own private 10.0.0.0/8 DHCP server for NAT with each AP having its default gateway of 10.128.128.128 and performing DHCP and for each client WIRELESSLY on the AP . Is it possible you just think you are pinging clients from a wired connection and are actually pinging other destinations on your LAN because your net uses Class A RFC 1918 on the LAN. See these docs:

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment#NAT_Mode

Re: Meraki firewall on SSID not working

Philip D'Ath — Tue, 22 Jul 2025 21:07:45 GMT

Clients on the guest WiFi should not be able to ping any RFC1918 address on the LAN with this configuration. The APs themselves will still be able to ping LAN clients.

Re: Meraki firewall on SSID not working

DainBrammage — Wed, 23 Jul 2025 20:32:26 GMT

Agreed that why i am asking from where he is pinging, in the dashboard not all pings are L2 pings....