Security Center

[JessIT1]

Morning all: Saw this Source - IP with Action - Allowed on (2) of our firewall's external WAN IP's as the Destination.

Not sure why it was allowed..

I immediately added 95.214.52.173:500 & 95.214.52.173 to our Meraki Content Filtering - URL Filtering Block List and added a Layer 7 Deny rule for 95.214.52.173:500

[ABR1988]

It shows allowed on some models and/or depending on their utilisation which isn't ideal.

There is also a concern that so many Meraki customers are seeing the same alerts

[dunky]

Yes, I saw the same - we had HA MX84's at one site which had >75% utilization and reported as ALLOWED in Security Centre. Have recently replaced these with HA MX85's - utilization has dropped to <10% and Security Centre now reports these events as BLOCKED.

[jphipps]

We have an MX250 with low utilization, always under 25%, and just upgraded it from 18.211.2 to 19.1.11. I was hoping this would start showing BLOCKED after this upgrade, but it is still showing ALLOWED.

[dunky]

Well that isn't great news!

[acaudill]

A year and a half later and I still get these alerts almost daily.