Dashboard Location: Network-wide > Configure > Group Policies
Group policies in Meraki provide centralized client management and access control by applying consistent network policies to groups of devices or users. These policies enable granular control over bandwidth allocation, VLAN assignment, firewall rules, traffic shaping, and access scheduling. Group policies streamline network administration by allowing policy-based management rather than individual-based access control, and enabling dynamic policy application based on user authentication or device classification.
Name Type Constraint Mandatory Default Value domains List domains No
Name Type Constraint Mandatory Default Value organizations List organizations Yes
Name Type Constraint Mandatory Default Value networks List networks No
Name Type Constraint Mandatory Default Value group_policies List group_policies No
Name Type Constraint Mandatory Default Value settings Choice custom, ignore, network defaultNo bandwidth_ Class bandwidth_ No
Name Type Constraint Mandatory Default Value settings Choice custom, ignore, network defaultNo vlan_id Any Integer[min: 1, max: 4094] or String[matches: `(?:[1-9] [1-9][0-9] [1-9][0-9]2
Name Type Constraint Mandatory Default Value settings Choice custom, ignore, network defaultNo rules List rules No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value active Boolean true, falseNo from String Regex: ^(?:0:00| No to String Regex: ^(?:0:00| No
Name Type Constraint Mandatory Default Value limit_up Integer min: 0, max: 1000000 No limit_down Integer min: 0, max: 1000000 No
Name Type Constraint Mandatory Default Value definitions List definitions Yes per_ Class per_ No dscp_tag_value Integer min: 0, max: 63 No pcp_tag_value Integer min: 0, max: 7 No priority Choice low, normal, highNo
Name Type Constraint Mandatory Default Value comment String min: 1, max: 127 No policy String min: 1, max: 127 Yes protocol Choice tcp, udp, icmp, icmp6, anyYes destination_ Any Integer[min: 0, max: 65535] or String[matches: `(?:[1-9][0-9]3 [1-5][0-9]4 6[0-4][0-9]3 destination_ String Regex: ^(?i:any| No
Name Type Constraint Mandatory Default Value policy Choice denyNo type Choice application, applicationCategory, host, ipRange, portNo value String min: 1, max: 127 No
Name Type Constraint Mandatory Default Value settings Choice append, network default, overrideNo patterns List String[min: 1, max: 1024] No
Name Type Constraint Mandatory Default Value settings Choice append, network default, overrideNo patterns List String[min: 1, max: 1024] No
Name Type Constraint Mandatory Default Value settings Choice append, network default, overrideNo categories List String[min: 1, max: 127] No
Name Type Constraint Mandatory Default Value description String min: 1, max: 1024 No vlan_id Any Integer[min: 1, max: 4094] or String[matches: `(?:[1-9] [1-9][0-9] [1-9][0-9]2 services List Choice[AFP, AirPlay, All Services, Apple screen share, BitTorrent, Chromecast, FTP, Printers, SSH, Samba, Scanners, Spotify, iChat, iTunes] Yes
Name Type Constraint Mandatory Default Value type Choice application, applicationCategory, host, ipRange, localNet, portYes value String min: 1, max: 127 Yes
Name Type Constraint Mandatory Default Value settings Choice network default, ignore, customNo bandwidth_ Class bandwidth_ No
Name Type Constraint Mandatory Default Value limit_up Integer min: 0, max: 1000000 No limit_down Integer min: 0, max: 1000000 No
Example-1: The example below demonstrates group policies configuration.
This configuration creates network access policies based on user groups and device types. The example includes bandwidth limits, firewall rules, traffic shaping, and access controls for different user categories and organizational roles.
Each policy specifies whether scheduling is enabled, bandwidth settings, firewall and traffic shaping rules, splash authentication behavior, VLAN tagging, and Bonjour forwarding.
IOT: Scheduling is enabled 24/7, VLAN 30 is assigned, firewall and traffic shaping are set to custom, and all other settings use network defaults.
Guest: Scheduling is disabled, VLAN 40 is assigned, custom firewall rules allow all traffic to the Internet and HTTPS traffic to code.jquery.com, bandwidth and splash settings use network defaults. Fully qualified domain name (FQDN) destinations require Meraki network support.
BMS: Scheduling is disabled, VLAN 20 is assigned, custom firewall rules allow all traffic to the Internet, bandwidth and splash settings use network defaults.
CORP: Scheduling is disabled, VLAN 10 is assigned, firewall and traffic shaping are custom, and all other settings use network defaults.
Each policy ensures consistent network behavior and segmentation according to the intended group of users or devices.
- name : !env network_name
settings : network default
firewall_and_traffic_shaping :
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
- comment : Guest to Internet
- comment : Client VPN jQuery
destination_cidr : code.jquery.com
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
- comment : Guest to Internet
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
splash_auth_settings : network default
settings : network default
Example-1: The example below demonstrates group policies configuration.
This configuration creates network access policies based on user groups and device types. The example includes bandwidth limits, firewall rules, traffic shaping, and access controls for different user categories and organizational roles.
Each policy specifies whether scheduling is enabled, bandwidth settings, firewall and traffic shaping rules, splash authentication behavior, VLAN tagging, and Bonjour forwarding.
IOT: Scheduling is enabled 24/7, VLAN 30 is assigned, firewall and traffic shaping are set to custom, and all other settings use network defaults.
Guest: Scheduling is disabled, VLAN 40 is assigned, custom firewall rules allow all traffic to the Internet, bandwidth and splash settings use network defaults.
BMS: Scheduling is disabled, VLAN 20 is assigned, custom firewall rules allow all traffic to the Internet, bandwidth and splash settings use network defaults.
CORP: Scheduling is disabled, VLAN 10 is assigned, firewall and traffic shaping are custom, and all other settings use network defaults.
Each policy ensures consistent network behavior and segmentation according to the intended group of users or devices.
- name : !env network_name
settings : network default
firewall_and_traffic_shaping :
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
- comment : Guest to Internet
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
- comment : Guest to Internet
splash_auth_settings : network default
settings : network default
settings : network default
firewall_and_traffic_shaping :
splash_auth_settings : network default
settings : network default
