Content filtering rules based on AD groups? org wide?

[KrisOlaf]

So we have many sites and people work at multiple locations, but all the same domain. I'd like to apply a global content filtering policy and put people into AD groups and assign policies: 

GeneralAccessGroup - has most things blocked in 'Threat categories' and 'Content categories' and would be the default access policy unless they are in one of the other groups.

SocialMediaGroup - allowed to access social media and job sites. HR, Marketing, VIPs.  All'Threat categories' blocked

AllAccessGroup - only blocks 'Threat categories'

Is this possible? 

[alemabrahao · Accepted solution]

Yes, but it is necessary to configure each MX to authenticate with AD.

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Direc...

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

[Aamir]

hi, How to achieve the same if customer has Azure AD?

[PhilipDAth]

If they only have Azure AD you can't.

[Aamir]

So what's the purpose of Azure AD integration with MX via SAML? is that just for Anyconnect? Does it mean for AnyConnect users that get authenticated via Azure AD i can do webfitering (based on group policy) but not for internal clients?

[PhilipDAth]

I can think of two SAML integrations.

The first is for AnyConnect, as you have noted.  It lets users login in with Azure AD credentials.  Their is a beta that lets you apply a group policy for VPN users.  Applying group policies via AzureAD and SAML is very painful.  You really want to be using another SAML provider like Cisco Duo to keep life simple.
https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SA...

The second is for logging into the Meraki Dashboard.
https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_S...

[jimmyt234]

---

@PhilipDAth wrote:

Their is a beta that lets you apply a group policy for VPN users.

---

Is there documentation / more information about this Beta feature? 

[PhilipDAth]

Not that I am aware of.  You can send an email to meraki-anyconnect-beta@cisco.com and request to go on the AnyConnclect SAML group policy beta.

But you need to have a good understanding on SAML to be able to configure this - and EntraID makes it particularly difficult. 

[jimmyt234]

I will email them - thanks 😊

[Aamir]

Hi,

Just to re-confirm if i have local AD then i make sure each MX authenticate with AD. all the VLAN default gateway is MX. So for eg. i have a user John, from HR, he logs on to his windows machine using AD credentials, and MX will be able to block youtube.come for John, similarly Andrew from HR gets facebook.com blocked even though both users are coming from HR Vlan but belong to different AD groups in AD? 

[PhilipDAth]

Also note that the MX must be the default gateway for the users for this to work.