Skip to main content
Cisco Meraki Documentation

Configuring EAP-TLS Wireless Authentication with Systems Manager Sentry Wifi

Systems Manager Sentry Wi-Fi security provides automatic certificate-based EAP-TLS configuration in just a few clicks, eliminating the need for the use of a certificate authority (CA) and the additional management required for each device and user.

We cannot simultaneously support third-party-signed SCEP CA certs and Sentry Wifi. This means third-party-signed SCEP CA certs are not compatible with Sentry Authentication. 

This article outlines how to integrate SM Sentry with Cisco Meraki MR access points for EAP-TLS wireless authentication.

Use Case

Commonly, network administrators want to configure different settings for corporate owned devices, employee owned devices, and guests. Each group of users will likely have their own separate SSID, with an additional SSID for onboarding:


Use Case

Default SSID Policy


Corporate-owned devices only

Full access on Corporate VLAN


Employee-owned devices

Limited Corporate access

Some apps optionally limited

Higher bandwidth than Guest


All others

Filtered Internet

Rate limit

No corporate devices


Onboarding to Corp network only

Restricted to onboarding

Configuring EAP-TLS using Systems Manager Sentry WiFi Security

The following instructions explain how to apply EAP-TLS wireless access to corporate-owned devices tagged as "Corp" in our example Systems Manager network.

  1. In Dashboard, navigate to Wireless > Configure > SSID and enable/name each SSID.
    The example image below shows four SSIDs: SL-corp, SL-byod, SL-guest and SL-corp-onboarding:
    Configuration Overview page
  2. Navigate to Wireless > Configure > Access Control:
    Access Control page

  3. Select the device tags to be associated with EAP-TLS. This automatically creates a Systems Manager profile for the SL-corp SSID to use EAP-TLS and installs a client certificate from the Dashboard for each client (this profile will appear under Systems Manager > Manage > Settings). Note that wireless authentication settings should be provisioned from either the SSID side, as described in this article, or the MDM profile side in Systems Manager > Manage > Settings and not both.

Select SM Sentry Wi-Fi settings

  1. Click Save Changes. EAP-TLS is now configured for all devices tagged corp in Systems Manager.iPad, General settings, profile management

Sentry WiFi Device Operating System Compatibility

Operating System Sentry WiFi Supported
iOS  Yes
macOS Yes
tvOS No
Windows 10/11




Samsung Knox 3.0+

Chrome OS No

1. Local user accounts only. In a multi-user environment on a single device the Sentry WiFi profile will only function successful for a single user.   Users must be logged in to associate to Sentry WiFi SSID.

2. A passcode is required on the device while in Knox mode.  

Certificate-based WiFi authentication with Systems Manager and Meraki APs

Systems Manager can be used with Cisco Meraki wireless networks to easily deploy certificate-based (EAP-TLS) authentication to iOS, Android, OS X, and Windows clients. This is ideal for customers that want to seamlessly and securely (using WPA2) authenticate users while avoiding the additional requirements of an external RADIUS server. This article will cover an example of how to implement this solution.

How it Works

Each device enrolled in Systems Manager is given a unique SCEP certificate. When configured as shown below, this certificate is used by the Cisco Meraki access points to authenticate the device. All completed automatically in the background without a need to manually enter credentials or distribute a certificate.


This method also allows users to authenticate to the same SSID with a username and password, however, user credentials will need to be managed from the Users page.

Authenticating using the username and password


The following instructions explain the process to set up certificate-based authentication, both in Systems Manager, and on the MR configuration side:

Tag Relevant Devices

Providing access to the wireless network from mobile devices using this method is done via manual tags. For more information on tags, read the article on Using and Applying Tags in Systems Manager. In this case, apply the desired tag to relevant devices.


Devices must be enrolled in a Systems Manager network in the same organization as the wireless network they will be connecting to. Android devices must be running Android 4.3 or higher and have the Systems Manager app installed.

Setup the Wireless Network

Setup a wireless SSID that will be authenticated to using the SCEP certificates. This can be a new SSID, or an existing one, as long as the Association requirements are configured as below. 


  1. Navigate to Wireless > Configure > Access control in the wireless network.
  2. Select the desired SSID.
  3. Under Security, select the option for Enterprise with Meraki Cloud authentication.
    Selecting Meraki Cloud Authentication
  4. Below the SM Sentry Wi-Fi click Add Sentry Network and select the desired Network, Scope, and Tag(s). Devices with ANY of the tags listed will be allowed. If the organization has multiple Systems Manager networks, the network name will precede the tag.
    Adding Sentry network
  5. Optionally, perform any additional configuration for this SSID as needed.
  6. Click Save Changes.

Please allow time for the automatic profile and certificate to be pushed down to the tagged devices before connecting to the SSID. Devices must be online and able to check-in with Systems Manager in order to receive updates.

Confirm Profile on Devices

On each device with the relevant tag, a Profile called Meraki Wifi will be applied to the device. This can be seen on the client details page in Systems Manager. 

Confirming profiles on devices

This can also be confirmed on the device. For iOS devices look under General > Device Management > Meraki Management > More Details. There should be a WIFI NETWORKS entry for the SSID (in this case, Meraki-Cert) and one under DEVICE IDENTITY CERTIFICATES titled "WiFi SCEP Certificate".

Wi-Fi networks

Device identity certificates

For Android devices, open the Systems Manager app, and confirm that a profile exists for "Meraki Wifi". The Systems Manager app is required for this functionality.

Systems Manager status

Disallowing Access

To remove a client device's access to the wireless network via certificate, either: