NBAR fail - we need to be able to add categories!

[cmr]

We have been upgrading our MXs to the 16.x release train to take advantage of the newer classification achieved using NBAR, however in our experience it seems worse as now ~90% of our traffic is classed as unknown.  At least before it would come up as Non-web TCP - [remote hostname] and be divided by the remote hostnames:

Here we can see two internal clients talking to one external host, however now, as seem below, this traffic and a load more is all lumped together...

Here we can see that almost all traffic is now unknown, you can see when we upgraded...

[PhilipDAth]

Well, that sucks.

Does it make any difference if you change to "Security Appliance" clients?

[cmr]

I'd like to try that @PhilipDAth, but it is an MX only network...  However the Meraki support team are looking into it so hopefully it will improve soon 🤞

[BlakeRichardson]

+1 on custom categories. I find MX is lacking behind the competition in this space. Content filtering on MX in general isn't very good IMO. 

We recently reivewed and rpelaced our firewall, and MX was one of the firewalls we reviewed but it lacks a decent content filtering system and reporting for use in education I found. 

[ChesterX]

What did you choose instead?

[cmr]

Well, since the last update we now have over 95% of traffic marked as unknown, progress of sorts!

[Inderdeep]

@cmr : Well i saw similar issue for NBAR recognize apps in our Viptela SDWAN device. i think this is something NBAR database sync, Later it was resolved.