The sky is blue, and I'm getting wet. ... View more

If I understand correctly you have Android clients bypassing security controls by using an anonymizing VPN?  Have I understood correctly?   Some of these VPNs can be really hard to block.   Start by trying to block the content category "Filter Avoidance". If that is not enough, you'll need to Google for measures others have used to specifically block whatever VPN you are targetting.  Often there will be a DNS name (such as the system used to log into the VPN) that can be targetted.   I think Psiphon often uses DNS ports, so you might need to block all access to port 53 except for the specific configured name servers that the users are allowed to use.       ... View more

Go to Network-wide > Monitor > Clients. Check the boxes of the clients that you want to block. Click on the Policy drop-down above the client list, and select Blocked.   This will immediately block the selected clients from accessing the internet. Please note that this configuration is completed on a client-by-client basis.   If you want to block all devices by default and only allow specific devices, you can create a Deny Any rule in the Layer 3 firewall. Then, you can add the MAC addresses of the devices you want to allow to your device.   Blocking and Allowing Clients - Cisco Meraki ... View more

Welcome to the community! ... View more