2

I manage a small network, and use Meraki devices to run it. Those of us who resolve www.google.com to 172.217.5.238 are able to access Google, Gmail, etc. However, those of us who resolve www.google.com to 172.217.5.228 are not able to access Google, Gmail, etc. Their access is being blocked by Meraki. I don't want Meraki to block Google.

$ curl -v www.google.com
* Rebuilt URL to: www.google.com/
*   Trying 172.217.5.228...
* Connected to www.google.com (172.217.5.228) port 80 (#0)
> GET / HTTP/1.1
> Host: www.google.com
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Location: http://wired.meraki.com:8090/blocked.cgi?blocked_server=172.217.5.228:80&blocked_url=http%3A%2F%2Fwww.google.com%2F&blocked_categories=bc_057
< Content-Type: text/html
< Content-Length: 216
< Cache-Control: no-cache
< Content-Type: text/html
< Pragma: no-cache
< Expires: 0
< Continue: close
<
<html><body>You are being <a href='http://wired.meraki.com:8090/blocked.cgi?blocked_server=172.217.5.228:80&amp;blocked_url=http%3A%2F%2Fwww.google.com%2F&amp;blocked_categories=bc_057'>redirected</a>.</body></html>
* Connection #0 to host www.google.com left intact

I caution you that I am not a network engineer, and I don't play one on TV either.

  • 1
    Who manages your Meraki devices? You need to talk with them. – Ron Trunk Jan 17 '17 at 16:36
  • If you do not control the network, your question is explcictly off-topic here. – Ron Maupin Jan 17 '17 at 16:40
  • I control the network. I set it up. I've not made any changes recently. – Alan C. Jan 17 '17 at 16:42
  • 1
    Look in the firewall log. It should tell you why it blocked that IP (i.e. what rule was used). That information should be enough to figure out how to unblock it. – Ron Trunk Jan 18 '17 at 2:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 18:58
2

Based on your output above, this specific site is matching blocked category bc_057, so something is triggering it.

Under Security Appliance > Configure > Content Filtering what is configured? Check for Web search filtering, Blocked URL patterns and Blocked Website Categories.

If there is nothing obvious under Content Filtering, this may be being applied via Group Policy instead (which may explain why it's a problem for some users and not others).

In Meraki, group policy config overrides the default configuration.

Check under Group Policies and confirm that no Blocked Website Categories, URL patterns or Web Search filtering is applied here.

1

Both of those IP addresses resolve to iad30s07-in-f14.1e100.net (using nslookup). Also, Why would some machines resolve to one while others to the other (unless you have multiple locations, maybe)? Either way, they're hitting the same box.

Curl will misleadingly connect to a RESTful API (a website) while your browser may fail to connect to that same website using the very same method (GET, POST, whatever). The browser has CORS restrictions that curl doesn't.

So, I'd say you might be experiencing issues with your browsers / endpoints rather than with your network.

Identify the problem. Once you do that, you can make some progress. Good luck.

protected by Community Mar 26 '18 at 17:16

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.