topic Re: Upstream firewall rules in Wireless

Upstream firewall rules

ToryDavenport58911 — Wed, 13 Jan 2021 15:28:13 GMT

Would someone be able to explain to me what this rule is doing?

Control traffic?

The customer has internal RADIUS so my understanding is that the firewall should allow RADIUS east/west though zones but this is inbound, and to seemingly private IP addressing.

Tory

Re: Upstream firewall rules

ww^ — Wed, 13 Jan 2021 15:40:53 GMT

Thats the radius ip and port you configured. Its should be able to communicate to the meraki mr manamgement IP. So in case you have any fw between mr and radius server that fw should allow that flow

Re: Upstream firewall rules

ToryDavenport58911 — Wed, 13 Jan 2021 16:14:52 GMT

@jdb1
Okay, I think I'm following. So I am interpreting the rule wrong the document says inbound ..

https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity

so not inbound from the outside zone but inbound from the network the AP MGMT is on, destined for those 172 addresses.

So the addressing under destination IP (172.19.0.25/32 and 172.25.0.25/32) are just examples then? I would put Source ip = Meraki MR Management IP
Destination = RADUIS server

Thanks for your help in advice.

Re: Upstream firewall rules

ww^ — Wed, 13 Jan 2021 16:30:44 GMT

That page is just a example.

The fw rules depends on if you configured the radius and on what meraki dc you are hosted etc.. If you dont have a radius server that rule is not present under help> fw info on your dashboard.

Yes source is <you networks ip> (management ip from switch,ap,mx) dst =radius ip

Not sure why i says inbound (that would asume the radius server always initiates the session, im not sure about this), i would allow it both ways

Re: Upstream firewall rules

Karsten Iwen — Wed, 13 Jan 2021 18:31:03 GMT

On my "Help>Firewall Info" page, the field "Destination" is populated with my real RADIUS-server. I think it is taken from the dashboard-config.

For the firewall-rules:

Traffic to 1812/1813 is always from the NAD to the RADIUS-server, traffic initiated by the RADIUS-server is typically a CoA which runs on port 1700.

There is also one situation where this traffic is really "inbound": When the Meraki RADIUS-proxy is used. But I would not use it as long as there is no DTLS support.