Finding source of Content filtering hits in a core switch routed enviornment

[CaptainBeRad]

Hello,

I have a setup where the core switches are the default gateways for many of the VLAN's in our environment. Then we have a transit stub network to connect all of those VLANs to the MX firewalls. The problem I see here is when things hit the content filter the source mac/ip is the interface on the transit VLAN. It's tough to find the device where the traffic has originated from. Anyone have any good methods for this?

-Brad 

[Ryan_Miles]

Did you change the MX client tracking mode? https://documentation.meraki.com/MX/Networks_and_Routing/MX_Addressing_and_VLANs#Client_tracking

[CaptainBeRad]

@Ryan_Miles I did change it, we're on the cusp of a code upgrade. I think it's supposed to happen this weekend. The environment is Meraki top to bottom, so it's AP's, switches, and FW's all meraki. I have client tracking set to "Unique Client Identifier" but it has a little "Beta" text next to it. It doesn't seem to work really well so far. I have a lot of client tracking problems where the clients are showing discovered on switch uplink ports instead of their wired port in a stack downstream. I also see the issue in the original post a lot. 

[CaptainBeRad]

Also of note here is the IP address option is ghosted out for some reason

[PaulMcG]

Track by IP is not supported in a combined network.  You would need to split up the network if you want to try it.