Challenge assigning group policy

[AlexisM]

I want to apply a group policy to restrict video and gaming to certain devices.

I created the policy via "Network Wide => Configure => Group Policies."

I created a custom "SSID and Firewall shaping rules"; with a Layer 7 policy to deny Gaming & video, which I then applied to the specific SSID (via Wireless => Configure => Access Control) by Enabling/Applying group policy by device type. I then assigned the policy I created to iOS and Android devices, and after applying the policy, I can see that the policy applies to (in my case) 4 devices which match those criteria. 

However, I am (while connecting to the right SSID) still able to run the application on the device (youtube in this case, on iphoneX running iOS 11.2.6). So essentially the L7 policy was not applied in the end... Any advice or pointers to make it work ? Using an MR18 AP. Thanks.

[PhilipDAth]

Layer 7 rules only apply to new flows.  Have you tried disconnecting and reconnecting to the SSID in question?  Sometimes it takes 5 minutes for new group policies to kick in.

[AlexisM]

Thanks for the reply. I have tried disconnecting & re-connecting but that did not help. Also waiting for a while.

As the standard L3 rule is permit any to any (can not remove it) I added another L3 rule to deny a random IP destination address - since I thought the L3/ L7 precedence and decision making structure kicked in. The outcome remains the same and it did not block the traffic somehow.

[PhilipDAth]

Lets simplify this for a test.  If you disable dynamic group policy, and just apply the group policy manually does it work?

[AlexisM]

I now assigned a static policy (blocked for all iPhone devices), going through Wireless => Configure => Access Control.

I turned wifi on/off on my iphone, I renewed IP address lease on the device, closed all applications/sessions, but still the iPhone has access to web applications on that SSID... So the policy (block all iphone) does not seem to have been applied.
I must say that with renewing the IP lease, the same IP address is assigned, but I guess that is not a reason why the policy should not apply.