Blocking Layer 7 in MX not working but Logged

[EdgeFarming]

Hi, 

I`m blocking some apps in Layer 7 Firewall (Youtube, Instagram and Sports)

They are never blocked but you can see the match in Event Log, Why? Am I missing anything? Thanks

[michalc]

Hi there,

Could you clarify what is not being blocked? Are the clients using web versions or apps on their phones?
If apps on the phones than the QUIC protocol is being used. I'd recommend blocking UDP 443 using L3 but please check for collateral damage. 

[EdgeFarming]

Hi Michalc, 

None of them, youtube, instagram, and any sport page like. nba, nfl, nike, etc.

Clients are using we version.

[michalc]

There's been a lot of similar topics on the forum regarding this with accepted solutions.

Please see some of those threads below

1 

2

3

[Mloraditch]

Do the clients in question have an overriding group policy? I wouldn't think so based on the logs you've shown, but that's the only thing that should override the Layer 7 rules. If not it sounds like some sort of bug you would need to contact support about.

Layer 3 is also processed before Layer 7, but I don't believe you'd get that log entry if you somehow had a layer 3 rule overriding the layer 7

You sound familiar but here is the reference documentation: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_a_Layer_7_Fi...
https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Layer_3_and_7_Firewal...

[PhilipDAth]

I quite like using layer 3 FQDN firewall rules.  Then just block access to the DNS name "youtube.com".