Content filtering not working at 2 schools

[Aquatoes]

We have 2 schools with MX devices and content filtering. This has been working fine for years and suddenly started having intermittent issues.

SSID is tagged to VLAN for students with Group policy setup with content filtering.

Meraki support and engineers recommended blocking UDP 443 and 80 with a layer 3 outbound rule for QUIC protocol

This has not yielded and resolution and we are still seeing intermittent connectivity to multiple blocked websites.

Has anyone else experienced this and or have a potential solution?

[tnco]

@Aquatoes 

Regarding content filters, if you use the Quic protocol, it may not be possible to block it due to the nature of the protocol.

This is described in the Meraki documentation. Therefore, it is possible to block such communications by blocking UDP 443 with an L3 firewall, but in that case, if a client terminal uses Quic for web communication, it may affect the communication.

Therefore, it may be possible to avoid this by disabling Quic on the client terminal, but I thought that it would be difficult to do so easily if the scale is large.

Also, this may not work in the case of umbrella web policy, and the workaround was to disable Quic.

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering/Conten...

https://support.umbrella.com/hc/en-us/articles/360051232032-What-Are-the-Problems-with-Google-Servic...

[Aquatoes]

No device is using QUIC and with the Layer 3 UDP rule to block port 443 and 80 in place content is still getting through. Meraki engineers think there is a bigger issue, however this is affecting multiple locations. So I believe it is a bug in recent firmware that just has not surfaced.

[DarrenOC]

Unfortunately this is why I’ve struggled with MXs in the edu space - filtering and real-time reporting.

The majority of my edu customers are using securely and comes highly rated.

[RaphaelL]

Are you using the latest firmware ? I have seen a bug about TLS fragmentation causing issues.

[PhilipDAth]

I bet it is DNS over HTTPS.

Try blocking the category "DoH and DoT".

Are these machines managed?  If so, create you can create a group policy to disable this.

You can do this on individual machines by following these instructions:

https://techdocs.akamai.com/etp/docs/disable-doh-browsers

[PhilipDAth]

If they are Apple devices it could also be iCloud Private Relay.  You could try turning that off.

https://support.apple.com/en-nz/102602

[VKE]

Same problem facing in school