Web blocking to block social media sites   added the sites and iPhones and new laptops could get to blocked dites.  Appletv and webtv could not get to blocked sites   so thought web blocking not working on new human devices  had something to do with ip 6.  Asked support and they said gx-50 is not an ip6 gateway.  But, as you know, there is a toggle in gx-50 setup to turn it on.  So I turned ip6 off.  Tested again and same issue new human devices could get to the blocked sites, legacy non human could not.    Checked the human devices to make sure they had ip4 address and no ip 6 addresses.  All ip4.     so support implied that the ip’s had tokens that grants rights and I had to remove the devices and reallow.  Sound fishy to me.  Rebooted everything and no change.   to test the token rights theory by ip, I created a guest network, moved human devices to it for testing.  Verified they had new IPs so old ip tokens would not be at play.  Tested web blocking and still not working on newer human devices while web blocking works on older non human devices.    tried repointing dns from open dns to use up stream dns and no improvement.    Verified that the human devices did not have limit ip tracking, use private ip’ etc which is enabled on device end.     so basically I put in a costly premium network with all Meraki go devices, gx-50, Meraki go switch, Meraki go AP’s, and the security license…and the result is I can only block social media sites to older non human devices and can’t block to newer human devices.         ... View more

Notice that web blocking only works on ip4 devices and web blocking does not work on ip6 devices.     opened a ticket and the came back with “the gx-50 is not an ip6 gateway”   I was stunned by this since the gx 50 issues ip6 addresses.     all human devices on my network are currently requesting and receiving ip 6 address from the gx50.   so in stepping back to reexamine…it must be due to ip6 being encrypted.  So..now I have to check to see if security license content scanning works on ip 6 devices.     ... View more

I have all these sites blocked in web blocking but I can still get to them.  Do I need to turn other things on?     ... View more

i am starting year 2 of my GX-50    couple things I noticed   if you have the optional security license  (aside from cicson restricting you from using your existing open dns account)   if you try to unblock a website that comes up in your security events list......you get an error that the website must be a string.   I think this happens all the time if you are in the higher level if security.   I think a few times I put the system in the lower level of security and after waiting 30 minutes...the unblock feature worked.   then I put it back in the higher level of security.   so after this...if you check the security events....it will show that the website has been unblocked instead of the option to unblock.   also, if you just manually unblock the websites by copy pasting the url from the security events to the exclue urls part of the management software...that seems to work.   BUT...if for some reason you turn off security....then back on again...you will loose both the exclusions from the security events pick off and the manual exclude list.   AND...there is no way of exporting the list and reimporting them.         ... View more

So..after some research I learned that the gx series with optional security license only blocks malware websites and domains….does not block outbound malware by port .   some security firewalls…even low end consumer grade with no subscriptions  us AI to manage the detection of malicious out bound traffic .   I was going to start a block list but that’s a long list and a lot of malware can change their communication ports.   so…since we don’t have that…I guess I have to apply the same approach my previous job did, block everything, allow port by port as needed.   small home network with basic user and some appliance traffic so that would not be impossible.     only problem I see is that the gx series has no logging so I can tell what is good traffic by appliance so I can build the good traffic into the allow list.   my appliances which mainly operate in the lan, but has a  wan feature in some cases to remotely manage.  The remote management ports will be hit or miss.    I’ll start with the standard allow list to see what breaks.   Outbound ports to allow     HTTP - TCP:80 HTTPS- TCP:443 POP3 - TCP:110 (secure POP is typically TCP:995) IMAP4- TCP:143 (secure IMAP is typically TCP:993) SMTP - TCP:25 (secure SMTP is typically TCP:465) DNS - UDP:53 (external lookups)   MS RPC TCP, UDP Port 135 NetBIOS/IP TCP, UDP Port 137-139 SMB/IP TCP Port 445 Trivial File Transfer Protocol (TFTP) UDP Port 69 System log UDP Port 514 Simple Network Management Protocol (SNMP) UDP Port 161-162 Internet Relay Chat (IRC) TCP Port 6660-6669   my appliances that have over the internet management.   wireless mini split system   meriaki go network   hp printer   Network attached storage   secuity cameras           ... View more