Skip to main content
Cisco Meraki

Blocking and Whitelisting Clients

In some cases it is necessary to whitelist or block a specific client on a Cisco Meraki Network. This configuration is completed on a client by client basis and will effect the client immediately. Whitelisting and Blocking can be done on both the Cisco Meraki MX Security Appliances and the MR Access Points. At this time it is not possible to white-list or block a client on a Cisco Meraki Switch. 

Client policies are configured on a device once it is listed in the network client list, it is possible to Pre-Configure the network policy for clients that aren't listed.   

Built-in Client Policies

There are two built-in policies that can be configured for a client; whitelist and blocked. Normal is the default setting for every client subjecting the client to all of the network wide settings. If configured, group policies can also be applied to the client in the same manner as detailed below. 


Applies the following settings to a client:

  • Restricted Youtube content will NOT be bypassed by whitelisted clients as it is NOT considered part of Content Filtering.
  • IDS/IPS under Security and SD-WAN->Threat Protection will NOT be bypassed.


Note: The device is still subject to association requirements and per-SSID bandwidth limits on MR Access Points, as well as Uplink Configuration and Security Filtering on an MX Security Appliances. 


Applies the following settings to a client:

  • Firewall rule applied to block all communication with other devices on the Network (Only applies to traffic that traverses the Cisco Meraki Device that has the block is configured)
  • Blocked Splash Page will be displayed when user tries to load a web page


Note: The device will still receive an IP address and will be able to resolve DNS names.   

Blocking or Whitelisting a Client 

There are two ways to whitelist or block a client on the Cisco Meraki Dashboard.

Note: There is a limit of 3000 clients for whitelisting and 3000 clients for blocking. An error will appear when attempting to whitelist or block more than 3000 clients.

Using the Clients List

Navigate to  Network-Wide > Clients, then check the boxes of the clients that you want to whitelist or block. Click on the Policy drop down above the client list, and select blocked or whitelisted. To apply the whitelist or block on a per SSID basis or only on the MX Security Appliance, select Different policies by connection and SSID. To clear the setting, remove the blocked or whitelisted policy and select normal.


Note: The single configuration pane to block and whitelist users on the security appliance and the SSIDs is only available when on a combined network. These settings would have to be completed on each Dashboard Network for uncombined networks. 


After this is completed it is possible to filter clients to determine which ones have a policy configured on them.


If the client has never connected to the network, or is not in the client list, it can still have a policy applied. This is done using the Add client button on the Network-wide > Monitor > Clients page. Enter a friendly name for the device, its MAC address, and then which policy you would like applied. Then click Save changes.

Using the Client Details Page

The current policy will be shown and can be updated at the client details page. Like above, to apply the whitelist or block on a per SSID basis or only on the MX, select the Different policies by connection and SSID. The options listed will allow you to configure blocked or whitelisted per SSID and on the MX Security Appliance. To clear the setting, remove the blocked or whitelist policy and apply normal. Below is where the setting would be configured with a combined network:


If the Dashboard network is a wireless or a appliance network (Not Combined, the client details page looks a little different. The blocked and whitelisted setting is on a per Dashboard network basis and is configured on the Client Details Page in Edit Details:


In the Client Details configuration, the client can be blocked or whitelisted.