MX Security Appliances and MR Access Points can block clients from accessing specific applications using Layer 7 firewall rules. Dashboard lists the most popular applications within each predefined category, but there might be a specific application the network administrator needs to block that is not listed. Consider the example below, for an administrator who would like to block access to the game League of Legends:
Cisco Meraki Access Points and Security Appliances have the capability of creating Layer 7 firewall rules. These rules make the job of a network administrator easier by giving a verbose description of what will be blocked.
Cisco Meraki appliances and access points can be configured with Layer 7 firewall rules to block traffic by application or destination hostname. The MX can also perform "Content Filtering," which blocks access to websites based on their content. The MX can also redirect users to a "This website has been blocked by your network administrator" page, so a user understands why they cannot access a blocked site.
Cisco Meraki MR Access Points and MX Security Appliances provids the ability to create layer 7 firewall rules to deny certain traffic based on traffic type. Where most firewall rules only inspect headers at layer 3 (IP address), 4 (Transport), and 5 (Port), a layer 7 rule inspects the payload of packets to match against known traffic types. To enable a layer 7 firewall rule to deny Peer-2-Peer traffic, for example, follow the steps below:
Pinging the Internet interface of a network edge device is a convenient way to ensure public-facing services such as Client VPN are functioning properly. However, this leaves the network vulnerable to an outside attacks on the LAN.
Traffic shaping rules can be useful in limiting the amount of bandwidth that various applications and traffic types consume. Global limits can also be used to enforce bandwidth limits on a per device basis. A global bandwidth limit applies not only to outbound traffic, but it also applies to inter VLAN traffic on a MX security appliance.
The MX Security Appliance has two uplinks. On the MX, load balancing can be enabled to use both uplinks for all traffic. By default, load balancing is disabled and all traffic will use the primary uplink (defaults to Internet/WAN 1) to forward traffic to the internet unless it is overridden by an uplink preference. The uplink will only fail over to the secondary uplink in the event that the primary uplink can no longer reach the internet.
If a traffic shaping rule is defined on a Cisco Meraki MX Security Appliance to include a DSCP tag, the DSCP tag will remain in the IP packet as it traverses the VPN tunnel to the remote end. This is because DSCP exists at layer 3 and as such is routed from network to network. Cisco Meraki MX Security Appliances use IPsec Encapsulating Security Payload (ESP) in conjunction with tunnel mode, so the IP packet is fully encapsulated and thus survives NAT traversal. When the ESP packet is de-encapsul
Traffic shaping can be used on Cisco Meraki MR and MX/Z devices to limit client throughput based on different rules. This allows less desirable traffic to be throttled, while allowing more important traffic to be processed normally. It can also be used to limit the throughput for individual devices, to prevent a small number of clients from saturating the network, while other clients are unable to function.
In certain circumstances, traffic analysis will report data that should be blocked by the L7 firewall. This occurs most often with encrypted P2P traffic. The rest of this article discusses how the L7 firewall operates and makes decisions about the observed traffic.
In order to shape the traffic of a local subnet (an RFC 1918 address range) on the LAN side of the MX Security Appliance or MR Access Point, it is necessary to use a Custom expression in the traffic shaping rule definition. It may be necessary or desired to have one subnet or host's bandwidth capped or unfettered. If this is the case, follow the instructions below to achieve this.
Layer 3 Firewall rules provide an administrator granular access control of outbound client traffic. With the MR series, outbound traffic refers to client traffic originating from the wireless network that is destined for the wired LAN or Internet.
Traffic priority is a way of ensuring that specific applications or subnets are guaranteed a certain amount of the uplink bandwidth at all times. Traffic priorities only come into play when the network is using all of the pre-configured bandwidth on the uplink. Take note that this bandwidth can change when link aggregation is enabled because the uplink changes per stream based upon the ratio specified.
No articles with the article type topic could be found.
