Org wide group policy for some clients

[jamesw]

If you have 5000 networks, and you want to apply a custom group policy to some clients across your org, how can this be achieved without creating 5000 group policies (one per network) and mapping the client to each network's created group policy?

Basically, we are looking to assign some clients a particular policy across the estate.

Also, how many clients can be added to a group policy? We need potentially 100k+.

Thanks

[RaphaelL]

You would need network templates. Which is not always possible.

[alemabrahao]

One more thing to add.

Note: There is a limit of 3,000 clients that can have a group policy manually applied per network. 

[jamesw]

Thanks @RaphaelL and @alemabrahao.

I thought as much.

I read the same about the 3,000 limit for group policies. I've tested, via API, adding tends of thousands of client MACs and it's accepted it just fine, so now not so sure:

If using network templates, can you do group policies within them?

Thanks

[RaphaelL]

Yes. You will only have to maintain '1' GP since it is shared to all networks bound to that template.

[jamesw]

So if I apply all networks in the org to a template, and add the clients to a group policy defined on the template, the clients will get assigned the policy on ALL networks mapped to the template?

[RaphaelL]

No , that will save you from creating the same GP on all your networks. 

[jamesw]

I don't follow.

1. You create a template and add all your networks to it.

2. You create a group policy inside the template.

3. You assign clients to the group policy.

As the group policy is mapped to the template, isn't any client added to the group policy mapped to all networks?

Are you saying that despite having a group policy at template level, you still have to go into each network separately and add a client to the group policy, for the same MAC?

[alemabrahao]

The Group Policy can be created in the template, but you must apply it to the clients individually in each network, as the clients do not appear in the template.

[jamesw]

Thanks.

As per above then, is there a limit of clients? Meraki's group policy page says 3,000 for manually applied, however I've been able to add 70,000 without error...

[alemabrahao]

I don't know if you will exactly get an error.

For such a large number of clients I prefer to apply Group Policies via Active Directory Group.

But this limit is per network, okay?

[PhilipDAth]

What you'll find is that although you managed to add them via API, other things will now be broken, like using the Dashboard to edit certain group policy settings.