Meraki ACL help

[snagrat]

(Sorry if duplicated, I swore I posted this but cannot see it anywhere)

 

I am setting up ACLs on our Meraki switch network.

 

We have multiple VLANs, one of which is a guest network (main WiFi, but could be wired). We want to only allow internet access.

 

DHCP is provided by the core switch, and we are using public DNS for this VLAN.

 

I cannot see how I can set 1 ACL to only allow internet access. It appears I have to set 2 - one to block everything, then one allow rule for the WAN gateway VLAN.

 

Does this look correct and what others are doing?

[Davit2005]

No experience with Miraki assuming the ACL works top to bottom the below might be suitable

 

Source Guest vLAN IP range - Allow ports udp 67-68 to the core switch IP for DHCP

Source Guest vLAN IP range - Block all other internal destination IP ranges

Source Guest vLAN IP range - Allow any to 0.0.0.0 ( Alternatively and would be better you could allow jus some basic ports for http, https, dns and some email ports to 0.0.0.0 ) that would cover most bases.

Source Guest vLAN IP range - Block anything else (some switches have an implicit deny rule but if in doubt jus block anything and place at the bottom)

Edited April 13, 2023 by Davit2005

[RedwayNetworks_Michael]

Had one of the engineers take a look at this for you, Please see below

 

 

Your current setup looks good, but there are a few things you could do to improve the ACL rules:

 

I assume that the address of 10.167.0.254 is the core switch, also acting as the DHCP Server.

 

Currently, your first ACL rule allows any traffic from the guest SSID to reach your core switch. A guest user could attempt to access the switch via SSH, HTTPS or other unauthorised protocol. To make this a little more secure, you could only permit ports 67 and 68, which are used for DHCP.

 

Your second AP rule blocks access to the 10.167.60.0/24 subnet. However, it would allow access to other private IP addresses (if any are in your network or any are added in the future). You could block the following private address ranges to encompass all private IP addresses.

 

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

 

I hope that helps.