Limit internet access for some users / machines

[joaquimlopes]

Hi,

i need to have some machines to have internet access limited in 2 scenarios

1. only allow internal sites and office365 or similar cloud services for updating. i'll like to add them manually

2. have open internet access but block some sites, like instagram and similar, i'll like to add them manually

could have the blocking being done on the pc itself or by user(don't know if we need/have a special license to use ad)

Meraki is a bit limited to do those kinds of things if I’m seeing it correctly

What are the best ways to accomplish this?

Thx

[alemabrahao]

You can block all traffic using Layer 3 and 7 rules and Meraki content filtering, and then add specific domains or IP ranges to the allowlist.

For Office 365, Microsoft publishes IP ranges and URLs that you can allow.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Using_Layer_3_Firewal...

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_a_Layer_7_Fi...

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

If you want to apply this only to a specific group of machines or specific VLANs, you can use Group Policies.

[joaquimlopes]

Thx, the Meraki content filtering is not applied as an on/off switch? the same content filtering is applied to everyone?
can you create some granularity like create content filter policy?

[alemabrahao]

I didn't understand the first question.

No, there isn't much granularity in Meraki as you can see in the documentation.

[Main10ence]

Content filtering within group policy can be configured to use the default content filtering (what's configured on the MX), append, or override. 

[Main10ence]

Hello @joaquimlopes ,

I would be better to use group policies and apply them directly to the clients in question. This gives you the most granularity. 

@alemabrahao has provided the necessary documents to help with configurations.