topic Re: Network Appliance L3 Firewall Rules in Network Platform API

Network Appliance L3 Firewall Rules

as_ — Thu, 09 Mar 2023 05:04:04 GMT

Suppose you have an mx64 with outbound L3 firewall rules in place that are denying traffic to all three private subnet ranges, but then allowing to any other destination. Will the host be able to reach internet, or traffic will be denied unless you specifically allow traffic to the gateway IP address for the host subnet on the MX?

Re: Network Appliance L3 Firewall Rules

sungod — Thu, 09 Mar 2023 08:21:09 GMT

The default outbound rule is allow any-any.

Any additional rules you add are higher priority than the default rule.

Traffic is tested against each rule, top-down in priority order.

If traffic does not match any of the deny/allow rules that you added, it will eventually match the default rule and be allowed.

This explains rule processing in more detail: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewall_Processing_Order

Re: Network Appliance L3 Firewall Rules

as_ — Thu, 09 Mar 2023 15:48:52 GMT

Thank you for the link. I am just wondering if a host is able to talk to it's gateway IP address on the MX, if you deny all private IP addressing.
So for example, lets say you have a hosts on 192.168.0.0/24, with mx 192.168.0.1 and host is 192.168.0.5.
And you first firewall rule say 192.168.0.5 is denied to 192.168.0.0/24. Will the host still be able to reach the gateway? Thank you.

Re: Network Appliance L3 Firewall Rules

Raphael_L — Thu, 09 Mar 2023 16:07:13 GMT

It won't block intra-vlan traffic ( L2 ). Simply L3 trafic.

Re: Network Appliance L3 Firewall Rules

joey.debra — Thu, 09 Mar 2023 21:25:42 GMT

You don't need to allow traffic to your MX IP for clients to be able to connect to the internet. The MX will evaluate SRC and DST IP's by the rules that are configured. So if a deny to private addresses is present but an allow any behind it then your devices will reach the internet just fine. This is in fact the way you can have internet only VLANs.

Re: Network Appliance L3 Firewall Rules

as_ — Thu, 09 Mar 2023 22:42:04 GMT

So for example, if you have a host 192.168.0.5 that needs to talk to the gateway 192.168.0.1/24, and your first outbound l3 firewall rule is that 192.168.0.5 is denied to 192.168.0.0/24, traffic will still go through because it's intra-vlan traffic, right?