Event logs and Unique Client Identifier

CyberSam
Conversationalist

Event logs and Unique Client Identifier

We switched to the Unique client identifier a while ago for client tracking since we have a merkai firewall and meraki layer 3 switch and for the most part it works fine, but I've noticed that when I look in the event logs, any content filtering blocked URL events don't have the correct client shown.

 

Instead of reporting the MAC or IP address on the device that tried to accessed a blocked site it shows the MAC address of the layer 3 switch. 

 

Has anybody else seen this issue before?

 

I contacted support about this and they just said to not use the Unique client identifier tracking option. 

1 Reply 1
PhilipDAth
Kind of a big deal
Kind of a big deal

Yes, that is expected.

 

You can do content filtering globally, but you can only do per-user content filtering when the MX is the default gateway for the client.  Content filtering is based on the MAC address.

 

Unique client identifier is only used for reporting in the dashboard.

Get notified when there are additional replies to this discussion.