/security-appliance

name: "Meraki Security Appliance"
description: >
  Cisco Meraki MX security appliance review through the hosted Meraki MCP:
  L3, L7 and inbound firewall rules, port forwarding and 1:1 / 1:many NAT,
  firewalled services, organization-wide policy rulesets, site-to-site VPN
  status, VPN firewall rules, third-party peers, threat protection and
  security events, and SSID L3 firewall rules. Changes are produced as an
  exact proposed ruleset diff for a human to apply.
when_to_use: >-
  When reviewing or auditing a Meraki MX -- firewall rules, NAT and port forwards, exposed
  services, site-to-site VPN health, IDS/IPS and malware events -- or when a firewall change is
  requested and needs to be written up for a human. Use when: meraki firewall, meraki mx, l3
  firewall, l7 firewall, port forwarding, 1:1 nat, firewall review, firewall audit, meraki vpn,
  site-to-site vpn, autovpn, vpn down, security events, ids, intrusion, ssid firewall, or
  security appliance.

Meraki Security Appliance (MX)

Overview

The Meraki MX is a cloud-managed security appliance combining routing, stateful firewall, NAT, SD-WAN and Auto VPN. Its policy is spread across several rule lists, each read with its own capability through `execute_api`. Tool schemas and pagination are in `meraki-api-patterns`.

The hosted server is read-only, so firewall, NAT and VPN changes cannot be made from here. A change request becomes the exact proposed ruleset, with a diff against the current one, for a human to apply in the Dashboard.

Anti-triggers

• **A firewall that is not a Meraki MX** -- a Fortinet, SonicWall or Palo Alto ruleset is not reachable from this plugin; `auvik-devices` can identify the firewall but not read its policy.
• **A tunnel that is down because the appliance or its WAN is down** -- check the MX and its uplinks first with `meraki-troubleshooting`.
• **Locating a device or client** -- use `meraki-devices`, or the client search in `meraki-troubleshooting`.

Where MX Policy Lives

Firewall capabilities take `networkId` for an MX network; find those with `getOrganizationNetworks` and keep networks whose `productTypes` include `appliance`. VPN and org-wide rules take `organizationId`.

| What | `capability_id` | Dashboard location | |------|-----------------|--------------------| | L3 outbound rules | `getNetworkApplianceFirewallL3FirewallRules` | Security & SD-WAN > Configure > Firewall > Outbound rules | | L7 application rules | `getNetworkApplianceFirewallL7FirewallRules` | Security & SD-WAN > Configure > Firewall > Layer 7 | | Inbound rules | `getNetworkApplianceFirewallInboundFirewallRules` | Security & SD-WAN > Configure > Firewall > Inbound rules | | Port forwarding | `getNetworkApplianceFirewallPortForwardingRules` | Security & SD-WAN > Configure > Firewall > Forwarding rules | | 1:1 NAT | `getNetworkApplianceFirewallOneToOneNatRules` | Security & SD-WAN > Configure > Firewall > Forwarding rules | | 1:many NAT | `getNetworkApplianceFirewallOneToManyNatRules` | Security & SD-WAN > Configure > Firewall > Forwarding rules | | Services on the MX itself | `getNetworkApplianceFirewallFirewalledServices` | Security & SD-WAN > Configure > Firewall > Security appliance services | | Org-wide policy rulesets | `getOrganizationPoliciesGlobalFirewallRulesets`, `getOrganizationPoliciesGlobalFirewallRulesetsRules` | Organization-wide policies | | Site-to-site VPN firewall | `getOrganizationApplianceVpnVpnFirewallRules` | Security & SD-WAN > Configure > Site-to-site VPN | | VPN mode and exported subnets | `getNetworkApplianceVpnSiteToSiteVpn` | Security & SD-WAN > Configure > Site-to-site VPN | | Third-party VPN peers | `getOrganizationApplianceVpnThirdPartyVPNPeers` | Security & SD-WAN > Configure > Site-to-site VPN | | IDS/IPS and malware settings | `getNetworkApplianceSecurityIntrusion`, `getNetworkApplianceSecurityMalware` | Security & SD-WAN > Configure > Threat protection | | Content filtering | `getNetworkApplianceContentFiltering` | Security & SD-WAN > Configure > Content filtering | | SSID L3 rules | `getNetworkWirelessSsidFirewallL3FirewallRules` (`networkId` and SSID `number`, 0-14) | Wireless > Configure > Firewall & traffic shaping |

execute_api { "capability_id": "getNetworkApplianceFirewallL3FirewallRules", "parameters": { "networkId": "<networkId>" } }

Rule Models

L3 outbound

An ordered list evaluated top to bottom; the first match wins. It governs traffic leaving a VLAN, both to the internet and between VLANs. Traffic over site-to-site VPN is governed by the VPN firewall instead.

| Field | Values | |-------|--------| | `policy` | `allow` / `deny` | | `protocol` | `tcp`, `udp`, `icmp`, `icmp6`, `any` | | `srcCidr` / `destCidr` | CIDR list, `any`, or a VLAN or object reference (FQDNs allowed as destination) | | `srcPort` / `destPort` | port, range or `any` | | `comment` | free text | | `syslogEnabled` | log matches to syslog |

The last rule returned is the built-in default allow (comment "Default rule"). It cannot be removed, so a deny posture needs an explicit deny above it.

{ "rules": [
  { "comment": "Block outbound SMB", "policy": "deny", "protocol": "tcp", "srcCidr": "any", "srcPort": "any", "destCidr": "any", "destPort": "445", "syslogEnabled": true },
  { "comment": "Default rule", "policy": "allow", "protocol": "any", "srcCidr": "any", "srcPort": "any", "destCidr": "any", "destPort": "any" }
] }

The other lists

• **Inbound rules and the site-to-site VPN firewall** use the same ordered rule shape as L3 outbound.
• **L7 rules** are deny-only. Each rule has a `type` (`application`, `applicationCategory`, `host`, `port`, `ipRange`) and a `value`.
• **Port forwarding** rules map a `publicPort` on an uplink to a `lanIp` and `localPort`; `allowedIps` restricts who can reach it, and `["any"]` means the whole internet.
• **1:1 NAT** rules map a `publicIp` to a `lanIp`; each rule's `allowedInbound` entries list the protocol, destination ports and `