10 Meraki Firewall Rules Best Practices

The Cisco Meraki firewall is a powerful tool that can be used to protect your network from a variety of threats. However, configuring the firewall can be a complex task, and it is important to follow best practices in order to ensure that your network is properly protected.

In this article, we will discuss 10 best practices for configuring Meraki firewall rules. By following these best practices, you can be sure that your Meraki firewall is properly configured to protect your network.

1. Block traffic by default

When you block traffic by default, it means that all traffic is blocked unless you specifically allow it. This is the most secure way to set up your firewall because it prevents any unauthorized traffic from getting through.

The only downside to this approach is that you have to be very careful about which traffic you allow. If you accidentally allow something that you shouldn’t, it can cause serious security problems.

However, if you take the time to carefully consider which traffic you need to allow and which you don’t, blocking traffic by default is the best way to protect your network.

2. Allow only the necessary ports and protocols

By only allowing the ports and protocols that are absolutely needed, you’re reducing your attack surface and making it more difficult for attackers to find a way in.

It can be tempting to allow all traffic on all ports in order to make things easier, but this is a security risk. Take the time to understand which ports and protocols are needed and then configure your firewall accordingly.

3. Use a separate VLAN for guest access

When you use a separate VLAN for guest access, it limits the amount of damage that can be done if a malicious user were to gain access to your network. By isolating guests onto their own VLAN, you prevent them from being able to access sensitive data or systems on other parts of your network.

Additionally, using a separate VLAN for guest access makes it easier to monitor and manage traffic on your network. You can use Meraki’s built-in traffic shaping and bandwidth controls to limit the amount of bandwidth that guests have access to, and you can easily see which IP addresses are generating the most traffic.

Finally, using a separate VLAN for guest access allows you to take advantage of Meraki’s built-in captive portal feature. Captive portals allow you to require users to authenticate before they are able to access the Internet, which is a great way to prevent unauthorized access to your network.

4. Enable content filtering

Content filtering is a firewall feature that allows you to block or allow access to specific types of content on the internet. For example, you can use content filtering to block websites that contain adult content or that are known to host malware.

Content filtering is an important part of keeping your network safe and secure. By blocking access to dangerous or unwanted websites, you can help protect your users from malware and other threats.

To enable content filtering on your Meraki firewall, log in to the Meraki Dashboard and navigate to Security & SD-WAN > Configure > Content filtering. From here, you can add sites to the blocked or allowed list, as well as configure other settings such as SafeSearch enforcement and time limits.

5. Disable unused services

When you enable a service, you’re essentially opening up a port that can be used to access that service. If the service is not being used, there’s no reason to have the port open. By disabling unused services, you’re reducing your attack surface and making it more difficult for attackers to find a way into your network.

To disable a service, simply go to the Firewall section of the Meraki Dashboard and click on the Services tab. From there, you’ll see a list of all the available services. Simply toggle the switch next to any services that you’re not using to disable them.

6. Implement firewall rules to block malicious IPs

If an attacker gains access to your network, they can use your IP address to launch attacks against other networks. By blocking malicious IPs, you can prevent attackers from using your IP address to launch attacks.

Additionally, blocking malicious IPs can also help protect your network from denial of service (DoS) attacks. DoS attacks are a type of attack where the attacker attempts to make a network or system unavailable by flooding it with traffic.

By blocking malicious IPs, you can reduce the chances of your network being used in a DoS attack.

7. Set up port forwarding

By default, the Meraki firewall blocks all incoming traffic that is not in response to an outgoing request. This is a good thing, as it prevents unsolicited traffic from reaching your network.

However, there are times when you need to allow specific types of traffic into your network. For example, if you want to set up remote access to a server on your network, you will need to open up port 3389 (the standard RDP port) on the Meraki firewall.

Port forwarding allows you to specify which traffic is allowed into your network, and where that traffic should be directed. To set up port forwarding, go to the Configure > Firewall page in the Meraki Dashboard and click the Add a rule button.

Specify the protocol (TCP, UDP, or both), the port or port range, and the IP address or range of IP addresses that should be allowed to access the specified port(s). Then, specify the destination IP address and port (or port range) for the traffic that is being allowed through.

Click Save Changes when you’re done, and the new rule will be added to the firewall rules list.

8. Use an outbound NAT policy

When you use an outbound NAT policy, all of the traffic from your LAN will be translated to a single IP address. This is important because it means that all of the traffic from your LAN will appear to come from a single source IP address.

This is beneficial for several reasons. Firstly, it makes it much harder for attackers to target specific devices on your network. Secondly, it means that all of the traffic from your LAN will be treated as if it came from a single source, which can make it easier to manage and monitor.

Finally, using an outbound NAT policy can help to improve the performance of your network. This is because all of the traffic from your LAN will be going through a single gateway, which can reduce congestion and improve speeds.

9. Create multiple SSIDs

If you have multiple SSIDs, you can segment your traffic and better control which devices have access to which resources. For example, you could have a guest SSID that only allows internet access, while another SSID gives employees full access to the company network.

Not only does this make it easier to control access and improve security, but it also makes it easier to troubleshoot issues since you can isolate problems to specific SSIDs.

Creating multiple SSIDs is easy to do in the Meraki Dashboard, and we recommend doing it for all deployments.

10. Configure client VPN

When you configure client VPN, all traffic from the client device will be routed through the VPN tunnel. This means that the traffic will be encrypted and your client’s IP address will be hidden.

This is important because it provides an extra layer of security for your network. It also means that your clients will be able to access resources on your network that are not publicly accessible.

To configure client VPN, go to the Meraki dashboard and navigate to Security & SD-WAN > Configure > Client VPN.