Assign group policies by device type via Meraki API

[JavierM]

Hello!
I need to "assign group policies by device type" on my entire Meraki network. I want to do it through Meraki Dasboard API but I can't find a way to do it. I can't find the corresponding field.

To be clear, I mean the following option within an SSID:

Do you know if it exists?

Thanks a lot
A greeting

JM

[PhilipDAth]

This feature does not tend to work that well.

Try it out manually before investing too much effort in trying to configure it.

[JavierM]

OMG........ 

I do not understand when a manufacturer puts a service that does not work correctly ......

Thanks for the answer PhilipDAth

[PhilipDAth]

Have a read over this as well about how it detects the OS.

https://documentation.meraki.com/MR/Group_Policies_and_Blacklisting/Applying_Policies_by_Device_Type 

[Bruce]

As @PhilipDAth said, and based on my experience too, that feature doesn’t work overly well. You’ll always get some devices which are incorrectly identified.

If you really want to identify the devices then I’d suggest that you look at Cisco ISE (or one of the other third party offerings). Yes there is a price, but they’re a lot more accurate and you can tune them (and they can also offer other features too, e.g. guest workflows, RADIUS), and they’ll likely have REST APIs you can use too (I know ISE does).

[TestingGuy]

Hi Javier, All,

Yes, it exists. I use the deviceTypeGroupPolicies API.

Since Device Type policies are applied to the SSID and not the network, you must repeat this process for every SSID on your network:

PUT https://n490.meraki.com/api/v1/networks/L_YOURNETWORKidHERE/wireless/ssids/SSIDidHERE/deviceTypeGrou...

I use that API with this JSON configuration:

{
'enabled': True,
'deviceTypePolicies': [
{'deviceType': 'Android', 'devicePolicy': 'blocked'},
{'deviceType': 'BlackBerry', 'devicePolicy': 'blocked'},
{'deviceType': 'Chrome OS', 'devicePolicy': 'blocked'},
{'deviceType': 'iPad', 'devicePolicy': 'blocked'},
{'deviceType': 'iPhone', 'devicePolicy': 'blocked'},
{'deviceType': 'iPod', 'devicePolicy': 'blocked'},
{'deviceType': 'B&N Nook', 'devicePolicy': 'blocked'},
{'deviceType': 'Mac OS X', 'devicePolicy': 'blocked'},
{'deviceType': 'Other OS', 'devicePolicy': 'allowed'},
{'deviceType': 'Windows', 'devicePolicy': 'allowed'},
{'deviceType': 'Windows Phone', 'devicePolicy': 'blocked'}
]
}

You may adjust it with your own policy.

I saw other comments claiming that this feature doesn’t work at all. I agree it’s not perfect; however, I think you have to understand how it works first before using it.

In this case, maybe you noticed that I allow access to Windows and Other OS devices.I have to allow Other OS since the process to determine the OS is a best-effort. In some cases, Windows machines may be blocked because there isn’t enough information to decide it is a Windows device, and the access is denied because it was detected as Other when the Other OS device type was blocked. Later, with more network traffic, it will decide that the device is Windows, changing the device type from Other OS to Windows.

However, if Other OS device type is blocked, the device type will never change from Other OS to Windows.
As I said before, it's not perfect, but it's better than nothing.

Regards,
/Christian