Upstream Firewall Rules for Cloud Connectivity
The Cisco Meraki dashboard provides centralized management, optimization, and monitoring of Cisco Meraki devices. In order to manage a Cisco Meraki device through dashboard, it must be able to communicate with the Cisco Meraki cloud (dashboard) over a secure tunnel. This tunnel is created between Cisco Meraki devices and dashboard to pass management and reporting traffic in both directions.
Because the dashboard is located on the public internet, the tunnel is always initiated outbound from the managed device. Once a connection is established, the device maintains the connection by occasionally sending packets and receiving a response. When a firewall or gateway exists in the data path between the managed device and the dashboard, certain protocols and port numbers must be permitted outbound through the firewall for the secure tunnel to function.
Addresses and Ports to Allow
A complete list of destination IP addresses, ports, and their respective purposes can be found in dashboard under Help > Firewall info.
This list changes dynamically depending on the devices and services added on the dashboard as well as the region the organization is located. The below example will not necessarily reflect your networks' unique requirements.
Download rules to CSV
Below the firewall rules section is a Download button with two options: Rules as CSV and Unfiltered rules as CSV. Rules as CSV will download in the same format as shown in dashboard in which rule consolidation takes place. For example multiple functions using TCP 443 will be combined into one rule. If you download the CSV as Unfiltered rules as CSV the rule set is not combined and shows the each specific function and the corresponding requirements for source, destination, ports, protocol, etc.
Devices Using the "Backup Cloud Connection"
For devices that connect to the dashboard using UDP port 7351 for their tunnel, they will attempt to use HTTP/HTTPS if unable to connect over port 7351. When devices are operating like this, a message will be displayed on the device's status page indicating that the "Connection to the Cisco Meraki cloud is using the backup cloud connection." If this is observed, please ensure that port 7351 is being allowed outbound through the firewall or security appliance traffic from the Cisco Meraki devices it will pass through.
If unable to configure the recommended firewall settings for the backup cloud connection due to security constraints, please note that Cisco Meraki devices will continue to operate normally, but some features of the dashboard may be slower to respond. This includes, but is not limited to:
- Configuration updates
- Live tools
- Firmware upgrades
Unlike other features, Meraki authentication is always sent over UDP 7351 and will not work over a backup connection.
Note: While it is possible for Cisco Meraki devices to operate without the recommended firewall settings in place for the backup cloud connection, the firewall settings for Meraki cloud communication are still required for the devices to function correctly.
Devices Using the "Uplink Connection Monitor"
Cisco Meraki MX security appliances include features to use multiple redundant WAN links for internet connectivity.
These features rely on connectivity tests using multiple protocols to various public internet addresses.
We ask that network administrators allow these common protocols (HTTP, HTTPS, DNS and ICMP) to "any" internet address to allow the connectivity tests to function correctly.
Many Meraki devices perform these connectivity tests including the MX, MR, MV, and MS series of products.
For a more in-depth explanation of Connection Monitor Behavior please refer to the following documentation: Connection Monitoring for WAN Failover
Upstream Firewall Rules for DNS
Meraki devices must be able to reach port 53 of a DNS server that can resolve the hostnames of Meraki servers.
Upstream Firewall Rules for NTP
Meraki devices must be able to resolve pool.ntp.org and reach it via UDP port 123.
Upstream Firewall Rules for Cisco Threat Grid
For the most up to date list of destination address and TCP/UDP ports for Cisco Threat Grid please refer to this document.
- panacea.threatgrid.com → TCP 443 (North America)
- panacea.threatgrid.eu → TCP 443 (Europe)
Upstream Firewall Rules for Cisco AMP
For the most up to date list of destination address and TCP/UDP ports for Cisco AMP, please refer to this document.
- cloud-meraki-est.amp.cisco.com → TCP 443
- cloud-meraki-asn.amp.cisco.com → TCP 443
Upstream Firewall Rules for Cisco Meraki AutoVPN registries
A device sitting upstream of a Cisco Meraki security appliance (MX) will need the following destination subnet(s)/port(s) to be allowed so that the MX can communicate with the AutoVPN registries:
- 209.206.48.0/20 → UDP 9350-9381
Upstream Firewall Rules for MV Sense Settings
In instances where MV Sense is configured to transmit to outbound IP addresses or upstream local resources, the upstream firewall rules will need to be configured to allow for MQTT telemetry and analytics data to be sent outbound. These destination IP address (or hostnames) and ports are configurable on a per-camera basis, so ensure these are recorded in a central location for all devices within your network(s). MQTT commonly uses port numbers of 1883 for TCP and 8883 for TLS.
For Integration with Cisco DNA Spaces, MV cameras need to use port 1883.
MX Connection Tests
Upstream Firewall Rules for MX Content Filtering Categories
Upstream Firewall Rules for MX Cisco Talos Content Filtering (MX 17+)
MS Connection Tests
Meraki Switches (MS) will perform the following tests:
- Pings to 8.8.8.8 every second
- ARP requests for its gateway and its own IP every 150 seconds
- Round-robin DNS lookups every 150 seconds
MR Connection Tests
MRs will perform the following tests:
- Pings to 8.8.8.8 every 5 seconds to computer average latency and loss on the uplink
- ARP requests are sent to the MR's default gateway every 10-20 seconds
- DNS lookups every 60 - 150 seconds