Meraki Group Policy vs Firewall Rule: What Wins
On the 500-220 exam, questions that mix group policies with firewall rules trip people up because both can block or allow the same traffic. The trick is knowing where each control attaches and which one is evaluated first.
Contents
Quick summary
| Takeaway | What it means |
|---|---|
| Different scopes | A group policy attaches to a client, an SSID, or a VLAN, while firewall rules apply broadly at the network or SSID layer. |
| Group policy is more specific | When a group policy applies to a client, its L3 and L7 settings override the broader network firewall rules for that client. |
| Rules are ordered top-down | Within any rule list, the first matching rule wins and evaluation stops there. |
| L7 is not the same as L3 | Layer 7 rules match applications and categories, and they are evaluated separately from Layer 3 rules. |
| This costs Implementation marks | The 500-220 Implementation domain is 25% of the blueprint and leans on knowing which control wins. |
Two controls, two different jobs
A group policy and a firewall rule can both stop the same packet, so candidates assume they do the same thing. They do not. A firewall rule is a filter you write once and apply to a whole network or SSID. A group policy is a bundle of settings, including its own L3 and L7 firewall rules, traffic shaping, and VLAN tagging, that you attach to a narrower target.
The key idea for the 500-220 exam is scope. Firewall rules cast a wide net. Group policies are surgical: they override the wide net for the specific clients, SSID, or VLAN they are bound to. When a question describes a client behaving differently from the rest of the network, a group policy is almost always the reason.
Where a group policy attaches
A single group policy definition can be applied in more than one place, and where it attaches decides who it affects.
Per client
You can pin a group policy to an individual client from the client detail page. This is the most specific binding and it overrides the SSID and network defaults for that one device.
Per SSID
Under Wireless > SSIDs you can set a default group policy that applies to every client joining that SSID unless something more specific overrides it.
Per VLAN or by device type
Policies can also be applied to a VLAN or assigned automatically based on device type rules, letting you shape whole segments without touching each client.
How firewall rules layer in
Firewall rules on Meraki come in two flavours you must not confuse on the exam. Layer 3 rules match on protocol, source, destination, and port. Layer 7 rules match on applications and application categories, such as blocking a specific service regardless of the port it uses.
Both L3 and L7 rules can exist at the network or SSID level as the broad baseline, and both can also exist inside a group policy. When a group policy is in effect for a client, the L3 and L7 rules defined in that policy take priority over the broader firewall rules for that traffic. Think of the group policy as a more specific statement that wins over the general one.
- Layer 3 rules: protocol, IP source and destination, port.
- Layer 7 rules: application and category matching.
- Both can live at network, SSID, and group policy scope.
The order of evaluation
Two ordering ideas apply at once, and holding both in your head is what the exam rewards.
First, specificity decides which set of rules governs a client. A per-client group policy beats an SSID default, which in turn beats the plain network firewall rules. Once the applicable policy is chosen, its rules are what get consulted.
Second, within any single rule list, evaluation is top-down and first-match. The dashboard reads from the top, and the first rule whose conditions match the traffic is applied, after which evaluation stops. This is why rule order inside a list matters as much as the rules themselves. A broad allow near the top can silently mask a specific deny below it.
Reading an exam scenario cleanly
When a 500-220 item gives you a scenario, resolve it in a fixed sequence so you do not guess. First ask which client the traffic belongs to. Then ask whether that client has a group policy applied, and at what scope. If it does, use that policy's L3 and L7 rules. If it does not, fall back to the SSID or network firewall rules.
Only then walk the chosen rule list top to bottom and stop at the first match. Doing this in order stops you from arguing about a network-wide rule that a group policy has already overridden for the client in question.
- Identify the client and its most specific applied policy.
- Select that scope's rule list.
- Walk the list top-down and apply the first match.
- Remember L3 and L7 are separate lists, checked in their own right.
Group policy versus firewall rule on Meraki
| Aspect | Group policy | Firewall rule |
|---|---|---|
| What it is | A bundle of settings including its own L3/L7 rules, shaping and VLAN | A single filter matching traffic |
| Where it attaches | Per client, per SSID, per VLAN, or by device type | Network-wide or per SSID |
| Scope | Narrow and specific | Broad baseline |
| Precedence | Overrides broader firewall rules for the clients it applies to | Applies where no more specific policy overrides it |
| Layers covered | Can carry both L3 and L7 rules | L3 and L7 kept as separate lists |
| Evaluation within its list | Top-down, first match wins | Top-down, first match wins |
Try CMSS Professor
CMSS Professor uses an original Dashboard-style simulator to rehearse selected SSID, group-policy, and firewall-rule decisions without a licensed organization. It does not reproduce the live product. Practice estimates only reflect activity inside the product and do not predict an exam result. A free public preview is available before any one-time purchase.
Frequently asked questions
If a client has a group policy, are the network firewall rules ignored?
For traffic the group policy addresses, the policy's own L3 and L7 rules take priority. The broader network rules still apply where the group policy does not define anything more specific.
Do Layer 3 and Layer 7 rules interact?
They are evaluated as separate lists. A Layer 7 rule can block an application even if a Layer 3 rule would have allowed the port, so check both when a scenario mentions applications.
Which wins when two rules in the same list match?
The first matching rule wins because lists are read top-down and evaluation stops at the first match. Rule order is part of the answer, not just the rules themselves.
Can one group policy be applied in more than one place?
Yes. The same policy definition can be set as an SSID default, applied to a VLAN, or pinned to individual clients, and the most specific binding is the one that takes effect.