Troubleshooting Group Policies
Overview
This guide covers troubleshooting for common issues with Cisco Meraki Group policies. Follow the step-by-step instructions to diagnose and resolve problems, minimize downtime, and improve user experience.
This article addresses the following questions:
- Why is my Group policy not applying?
- What is the order of priorities for Group policies?
- How do I completely block or allow list a client?
- How do I bypass a network-wide Group policy for a device?
Troubleshooting Group policy application issues
A client may not be affected by parts of a Group policy, or the Group policy may not be assigned to the client at all.
Troubleshooting steps
After each step, verify whether the policy applies correctly before continuing.
- Disconnect and reconnect the client to the network. A policy does not apply until the device connects to the network.
- Navigate to Monitor > Clients and check the Access column to confirm whether the policy is being applied.
- If the Access column is not visible, select the plus icon to enable it. If the policy is not listed for the client, verify that the client meets the criteria required for the policy to apply.
- Confirm that a higher-priority policy is not overriding the desired policy. Refer to the Troubleshooting Group policy Priority Conflicts section on this page for more information.
- If the non-functioning portion of the policy is a content filtering or Layer 7 firewall rule, confirm that the client is not using HTTPS or a proxy. HTTPS or proxy usage can prevent content filtering from working properly.
- Review the policy to determine whether Blocked Website Categories is set to Override with no categories defined. This setting enforces the network default categories configured under Configure > Content Filtering.
- If possible, delete the policy and verify whether client behavior changes.
- Recreate the policy and repeat the previous steps.
- Create a limited test policy, for example, one that blocks a single website and manually apply the test policy to the client to verify whether any policies work.
If the issue persists, refer to documentation for the affected feature.
Layer 3 firewall rules configured in a group policy are stateless. Configure corresponding rules for return traffic as needed.
Troubleshooting Group policy priority conflicts
Multiple Group policies can affect the same settings or overwrite network default settings. An order of priority determines which settings apply to a client when conflicts occur.
Troubleshooting steps
Group policies are applied in the following order, from highest to lowest priority:
- Manually applied client policies: Policies manually assigned to a specific client on the client details page take the highest priority. This includes allow listing and blocking default rules.
- Network-wide automatic policies: Policies applied automatically by device type, VLAN, SSID, or similar criteria override network default settings. Manually applied client policies override network-wide automatic policies.
- Network default settings: Any policy applied to the client overrides network default settings.
For example, a network has a bandwidth limit of 500 Kb/s. A Group policy for iOS devices limits bandwidth to 250 Kb/s. As a result, all iPhones connecting to the network are capped at 250 Kb/s.
A second Group policy with an unlimited bandwidth setting is manually applied to a specific user's iPhone. Because manually assigned policies have the highest priority, the user's iPhone has no bandwidth limit.
If two policies apply to the same client but do not conflict, for example, policy A affects only bandwidth and policy B affects only content filtering, both policies apply without issue.
If you use Active Directory to map groups to policies, only the first matching policy applies to the user.
Troubleshooting client blocking and allow listing
Group policies allow an admin to set custom limits for specific devices or users. Cisco Meraki devices include two built-in policies for blocking and allow listing clients.
Troubleshooting steps
Refer to the following articles for full instructions on how to block and allow list devices:
Troubleshooting network-wide Group policy bypass for a device
A specific client device may need to be excluded from a network-wide Group policy and restored to default network settings.
Troubleshooting steps
A client-specific Group policy overrides settings applied by a network-wide policy. Refer to the Troubleshooting group policy priority conflicts section on this page for more information.
To restore default network settings for a client affected by a network-wide Group policy:
- Create a generic Group policy that uses network default settings for all options.
- Following the instructions in Applying to a device manually, manually assign the client to the new generic policy.
The manually assigned policy overrides the network-wide policy and restores default network settings for the client.