Skip to main content

 

Cisco Meraki Documentation

Access Manager

  1. Last updated
  2. Save as PDF

Cisco Access Manager is an access control product that enables organizations to effortlessly manage network access to their users and endpoints without the need for an external RADIUS integration. As part of the Cisco Meraki dashboard, Access Manager empowers IT teams to enforce, monitor and troubleshoot identity and context-based access seamlessly, eliminating complex configuration and troubleshooting workflows across different management interfaces. Organizations can now quickly and easily scale their network security as their needs evolve by cutting down on infrastructure costs while easing deployment and maintenance efforts.

CAM_Architecture.png

Licensing    

Please see the Cisco Access Manager Licensing and Ordering Guide (cs.co/am-licensing) for all licensing information including trials, procurement of subscriptions or co-terminations or EAs, estimation, consumption, compliance, enforcement and FAQs.

Early Access ended upon General Availability on November 10, 2025 . Contact your Sales Representative, reach out to the Sales Team, or complete a trial form to get your Access Manager licenses (trial, subscription, co-termination, or enterprise agreement).

Demos     

 

Configuration 

Certificates 

Download the Cisco Access Manager certificate and provision to your endpoints' trusted certificates list for the 802.1X + RADIUS authentication process. Access Manager uses the same eap.meraki.com certificate for all RADIUS authentications for all organizations.

Upload any public or private certificate authority (CA) digital certificates that Cisco Access Manager should use to authenticate your endpoint certificates.

▷ Access Manager - Certificate Configuration | YouTube

Endpoints   

Cisco Access Manager can authenticate any endpoints (clients) using IEEE 802.1X, iPSK, or MAC Authentication Bypass (MAB). There is no limits to the number of endpoints a single set of username+password credentials may be used for.

Endpoint (Client) Configuration Guides 

We provide these guides for the various authentication methods supported by Cisco Access Manager. It is highly recommended to use unified endpoint management (UEM) tools to provision and maintain your endpoints' authentication settings with the EAP (extensible authentication protocol) protocols at scale.

Unified Endpoint Management (UEM)     

Unified endpoint managers (UEMs) like Meraki System Manager (SM) are highly recommended for configuring 802.1X and certificates on endpoints. Multiple UEMs are supported if you add their respective CA chain into Access Manager to authenticate their provisioned certificates.

Compliance checking against UEMs is not supported by Cisco Access Manager.

For examples, see ▷ Meraki Minute (cs.co/meraki-minute) > ▷ Meraki SM - Endpoint management

Endpoint (Client) Groups

You may add endpoint MAC addresses to one or more endpoint Client Groups for simplified management and matching in Access Rules. To provision large numbers of endpoint MAC addresses to one or more Client Groups, the use of APIs is highly recommended, at least for export.

Users

Cisco Access Manager only supports Microsoft Entra ID as an Identity Provider (IdP). For configuration details, see Organization Users > Microsoft Entra ID . Support for additional identity providers is planned.

Microsoft Entra ID   

Cisco Access Manager supports Entra ID group lookups for both EAP-TTLS username+password authentication and EAP-TLS certificate-based user and endpoint authentication.

For EAP-TTLS, Entra ID integration synchronizes users, user groups, and user attributes, however password synchronization is not allowed. Therefore, all username and password authentication against Entra ID must be performed every time. This is also why EAP-TTLS authentications are not cached when using Extended Local Authentication.

Permissions

The following Microsoft Graph API permissions (found under Manage > API Permissions) must be granted to the Access Manager application in Entra ID for the synchronization to complete successfully: 

  • Grant Admin Consent for your Entra ID Directory
  • Microsoft Graph > Application > Group.Read.All
  • Microsoft Graph > Application > User.Read.All
  • Microsoft Graph > Delegated > User.Read (Required for Access Manager integration)

The EAP-TTLS+PAP authentication method does not support multi-factor authentication (MFA). You must exclude the Access Manager App Registration in Entra ID from MFA authentication using Conditional Access Policies.

See our videos and guides for Entra ID configuration with endpoints:

Meraki Organization Users  

Organization local users are not yet supported for 802.1X username + password authentication.

Devices 

Cisco Access Manager currently requires all network access devices to communicate with the Cisco Meraki Dashboard's secure management tunnel. Any devices (Cisco or non-Cisco) that do not support the Meraki management tunnel are not supported. Please refer to Cloud Configuration: Release Versions and Highlights for the latest

Model 802.1X MAB VLAN GPACL*  TrustSec (Adaptive Policy) URL Redir
Wireless (MR 30.7+)            
MR20, MR70 ✅ ✅ ✅ ✅ - ✅
MR 20/30H/33/42/42E/52/53/53E/74/84 (802.11ac Wave 2)
MR 28/36/36H/44/45/46/46E/55/56/57/76/78/86 (802.11ax)
CW91XX (Wi-Fi 7 802.11be)		 ✅ ✅ ✅ ✅ ✅
802.11ac Wave2+		 ✅
Switching (MS17+)            
MS120, MS125, MS130 ✅ ✅ ✅ - - -
MS130X/R, MS150 ✅ ✅ ✅ MS18 ✅ -
MS210, MS225, MS250,  MS350, MS355 ✅ ✅ ✅ ✅ - ✅
MS390, C9200L, C9300-M : (CS17.1+, IOS XE 17.15+) ✅ ✅ ✅ ✅ ✅ ✅
C9200/CX, C9350, C9500H : (IOS XE 17.18.1+)
See Cloud Configuration: Release Versions for the latest switches and capabilities		 ✅ ✅ ✅ ✅ ✅ ✅
SDWAN            
MX and Z - - - - Only SGT Transport -

*GPACL = Meraki Network Group Policy Access Control Lists

See Adaptive Policy for MX/Z Platforms for the requirements and details on SGT transport capabilities.

Unsupported Features

Some Switch Access Policy features are not yet supported when Authentication Method: Access Manager is selected and will trigger these respective errors : 

Unsupported Switch Access Policy features

 

Access Rules    

The Access Manager > Access Rules page defines a list of rules, evaluated top to bottom, to authorize users and endpoints based on their available Attribute Sources in each RADIUS request. If a rule is not matched, the evaluation process continues to the next rule in the list until the Default Rule is reached. Only supports a single, Default Rule Group. Multiple rules may be added to this group.

The Default Rule is set to Deny Access to ensure security by default. You may change it to Allow Access to monitor access when beginning to deploy access manager or customize it with Allow Restricted Access based on your desired default behavior.

Multiple conditions within a single Access Rule may be compounded with an implicit AND operator to provide granular levels of matching for specific authentication scenarios. A rule will only match if ALL the conditions specified in the "What's Matched" section are evaluated as True. For simplicity, there are no OR operators or condition groupings

Type Status Name What’s Matched Authorization
Rule Group ✅ Default Rule Group Any  
└Rule ✅ Employees_TTLS_Entra Network Access: EAP Protocol = EAP-TTLS
Entra_Org:Account Enabled = true, Group = Employees		 Adaptive policy = Employees
└Rule ✅ Employees_TLS_Entra Network Access: EAP Protocol = EAP-TLS
Endpoint certificate: Issuer - Common Name = My_Org
Entra_Org:Account Enabled = true,Group = Employees		 Adaptive policy = Employees
└Rule ✅ Guests Network Access: SSID = Guest Adaptive policy = Guests
└Rule ✅ Phones Endpoints: Client group = Phones VLAN = VOICE
Voice domain
└Rule ✅ Cameras Endpoints:Client group = Cameras VLAN=CAMERAS
Adaptive policy = Cameras
└Rule ✅ Printers Endpoints:Client group = Printers Adaptive policy = Printers
└Rule ✅ Wireless_IOT_iPSK Network Access: SSID = IOT
Endpoints:Client group = IOT		 Adaptive policy = IOT
Policy based iPSK
└Rule ✅ APs Endpoints: Client group = APs Adaptive policy = Infrastructure
└Rule ✅ Scanners Endpoints: Client group = Scanners Adaptive policy = Scanners
Policy based IPSK
└Rule ✅ MAC_is_Private Endpoints: Private MAC = true Adaptive policy = Guest
└Rule ✅ MAC_OUI_Match Radius: Calling-Station-Id [Starts with] 01:23:45 Adaptive policy = IoT
└Rule ✅ MAC_Exact Radius: Calling-Station-Id = 01:23:45:67:89:ab Adaptive policy = IoT
└Rule ✅ Exceptions Endpoints: Client group = Exceptions Adaptive policy = Guest
  ✅ Default Rule Any (Deny Access)
Attribute Sources  
Certificate Attributes Endpoints Network Access  Meraki (Device)  Radius EntraID
Issuer - Common Name
Issuer - Country Name
Issuer - Distinguished Name
Issuer - Domain Component
Issuer - Email Address
Issuer - Locality
Issuer - Organization
Issuer - Organizational Unit
Issuer - Serial Number
Issuer - State Or Province Name
Issuer - Street Name
Issuer - User Id
Serial Number
Subject - Common Name
Subject - Country Name
Subject - Distinguished Name
Subject - Domain Component
Subject - Email Address
Subject - Locality
Subject - Organization
Subject - Organizational Unit
Subject - SAN
Subject - SAN - DNS
Subject - SAN - RFC822
Subject - Serial Number
Subject - State Or Province Name
Subject - Street Name
Subject - User Id
Template Name
Valid To		 Client group
Description
MAC address
Private MAC
Source		 Authentication Method
Connection Method
EAP Protocol
Network
SSID		 Meraki-Ap-Name
Meraki-Ap-Tags
Meraki-Device-Name
Meraki-Network-Name		 Called-Station-Id
Calling-Station-Id
NAS-IP-Address
NAS-IPv6-Address
NAS-Identifier
NAS-Port
NAS-Port-Type
Service-Type
User-Name		 Account Enabled
City
Department
Display Name
Given Name
Job Title
Postal Code
Preferred Language
State
Surname
Operators

Most attributes are strings with the default string operators: [Starts with, Ends with, Contains].
Number type operators are: [Equals, Greater than, Greater than or Equal, Less than, Less than or Equal].

Some attributes offer specific, enumerated values to choose:

Endpoints

  • Client Group : [Match all, Match any]
  • Private MAC : [True, False]
  • Source : [Discovered, Provisioned]

Network Access 

  • Authentication Method : [EAP, MAB]
  • Connection Method : [Wired, Wireless]
  • EAP Protocol : [EAP-TLS, EAP-TTLS]
  • Network : [choose one or more network names]
  • SSID : [choose one or more SSID names]

RADIUS 

  • NAS-Port-Type : [Ethernet, IEEE 802.11, Virtual]
  • Service-Type : [Call Check, Framed, Login]
Authentication         

There are several authentication options supported for users and endpoints:

  • IEEE 802.1X : the industry standard network authentication protocol that uses Extensible Authentication Protocol (EAP):
    • EAP-TLS : certificate validation a trusted certificate authority uploaded to the Organization > Certificates page
    • EAP-TTLS : username+password validation against the list of available users in the Organization > Users page
  • Identity Pre-Shared Key (iPSK): a unique, wireless, pre-shared key is defined in an Access Rule's Authorization and returned to the access point to enforce for association. 
  • MAB (MAC Authentication Bypass) : a Client MAC address or Client Group containing the MAC address is matched within an Access Rule
Authorization     

Each Access Rule allows you to customize the Access Permissions from the following choices:

Permission Value
Deny Access Default: RADIUS Access-Reject. No session.
Allow Access RADIUS Access-Accept: use the default access permissions on the device.
Allow Restricted Access Allow Access and override the device session defaults with one or more of these:
  • VLAN ID/Name : Assign this VLAN name or number (dynamic VLAN assignment)
  • Voice Domain : Send the Cisco Vendor-Specific Attribute to use the Voice VLAN Domain
  • Adaptive Policy : Classify this session's traffic with this Adaptive Policy (TrustSec Security Group Tag)
  • Identity PSK : Require this iPSK value for this endpoint to associate wirelessly
  • Group Policy : Apply the named Meraki Network Group Policy to this session

For more details about these segmentation options, see these documents:

 

Scale  

Cisco Access Manager is available globally except in Canada, mainland China, India, and the Meraki FedRAMP cloud.

Feature Scale
Users  
Maximum Microsoft Entra ID Identity Providers (IdPs) 10 / org
Maximum Users synced from Microsoft Entra ID 150,000 / org
Maximum Microsoft Entra ID Groups 100,000 / org
Maximum Microsoft Entra ID User Attributes 15
Clients  
Maximum Clients (MACs) 500,000
Max client sessions per user Not configurable
Access Rules  
Maximum Rule Groups 1
Maximum Rules 50
Certificates  
Maximum Trusted Certificates 10
Maximum CRLs 10

 

APIs 

Cisco Access Manager has many application programming interfaces (APIs) available for use in the Cisco Meraki Dashboard APIs under Early API Access and Products > nac.

You may test API GET requests directly from your browser:

  1. Login to your Cisco Meraki Dashboard account normally for your browser to be authenticated and authorized
  2. Enable Early API Access under Organization > Configure > Early Access if you haven't already
  3. Open a Meraki Dashboard API GET request within your browser, replacing {orgId} with your organization ID:
    https://api.meraki.com/api/v1/organizations/{orgId}/nac/license/usage?startDate=2025-10-01
  4. You should see the respective JSON (JavaScript Object Notation) output returned for either type of request

Alternatively, use curl or another tool to GET / POST / PUT / DELETE requests using environment variables for your MERAKI_ORG_ID and MERAKI_DASHBOARD_API_KEY :

export MERAKI_DASHBOARD_API_KEY=1234567890123456789012345678901234567890
export MERAKI_ORG_ID=1234567
curl --header "Accept: application/json" \
     --header "Authorization: Bearer $MERAKI_DASHBOARD_API_KEY" \
     --request GET "https://api.meraki.com/api/v1/organizations/$MERAKI_ORG_ID/nac/license/usage?startDate=2025-10-01"
Get your Meraki Dashboard API Key, in the Dashboard under Organization > Configure > API & Webhooks

 

Features & Feedback   

Cisco Access Manager is a new product with many features planned! Please submit your new feature requests using the Give your feedback button in the footer of any Access Manager page of the Meraki Dashboard.

CAM_Footer_Feedback.png

 

Troubleshooting 

The Access Manager > Session Log page shows all attempts to authenticate against Access Manager and their outcome. The Status and Details columns provide insight into What the authorization result of an authentication attempt was and Why.

Unexpected Authorizations

If an endpoint matches an unexpected authorization rule in the Access Manager > Access Rules page, there are several things to check:

  • The first match always wins! It is generally recommended to put more specific rules at the top and more general rules at the bottom (default rule)
  • Inspect an endpoints' authentication request attributes in the Access Manager > Session Log page to verify they match your expectation for the scenario
  • You may need to include a different attribute or multiple attributes to match the conditions of your desired scenario

You will need to balance the ordering of rules by specificity and authentication frequency to avoid increased latency when checking for scenarios that rarely happen.

Missing Authentications

It is possible that an authentication attempt does not reach the Access Manager RADIUS services. If this occurs, there will be no data populated in the Access Manager > Session Log table. This could happen for many reasons

  • the endpoint (Windows, macOS, iOS, Android, Linux, etc.) may not be configured correctly
  • the devices (switching, wireless) may not be configured correctly including licensing, network security choice, Access Policies configuration
  • local and WAN network routing, firewalls, and general internet connectivity into the Cisco Meraki regions hosting Access Manager

Troubleshooting should begin on the authenticator device to ensure that the configuration is correct and the authentication is occurring as expected.