Event logs and Unique Client Identifier

[CyberSam]

We switched to the Unique client identifier a while ago for client tracking since we have a merkai firewall and meraki layer 3 switch and for the most part it works fine, but I've noticed that when I look in the event logs, any content filtering blocked URL events don't have the correct client shown.

Instead of reporting the MAC or IP address on the device that tried to accessed a blocked site it shows the MAC address of the layer 3 switch. 

Has anybody else seen this issue before?

I contacted support about this and they just said to not use the Unique client identifier tracking option. 

[PhilipDAth]

Yes, that is expected.

You can do content filtering globally, but you can only do per-user content filtering when the MX is the default gateway for the client.  Content filtering is based on the MAC address.

Unique client identifier is only used for reporting in the dashboard.