Splash Page

MR Splash Page Options

Once you navigate to Wireless > Configure > Access Control in the dashboard and enable splash page, you will need to choose what type of authentication/network access you would be using for your splash page. A client device is prompted with a splash page after the client is associated to the wireless network. More information on the different association options is found on the Wireless Encryption and Authentication Overview document. 

• None (direct access)

     Users can access the network as soon as they associate.

• Click-through

Users must view and acknowledge your splash page before being allowed on the network. The appearance of this page can be customized.

 

• Sponsored guest login

You will need to choose Sponsor email domains when you select this option. When guests receive the splash page, they will be asked to enter their own name and email address first, then a valid sponsor email address within the sponsor email domain they chose.  The owner of the sponsor email  will receive a  request from the user for network access and the request should be approved to be allowed on the network.

 

 

• Sign-on with Meraki Authentication / My Radius server / My LDAP server / Active Directory / Google Sign-In

Users must enter a username and password before being allowed on the network.

 

• Sign-on with SMS Authentication

Users enter a mobile phone number and receive an authorization code via SMS.After a trial period of 25 texts, you will need to connect with your Twilio account on the Network wide settings page. 

 

• Cisco Identity Services Engine (ISE) Authentication

Users are redirected to the Cisco ISE web portal for device posturing and guest access.

 

• Systems Manager Sentry enrollment

Systems Manager Sentry enrollment requires that the connecting device be enrolled within one of the organization's System Manager networks before gaining access to the network. If a device attempts to connect with the network and is not enrolled within a Systems Manager network in the organization, the device will be presented with a prompt to enroll the device into the defined Systems Manager network. (See the picture below)

 

 

After selecting Systems Manager Sentry enrollment as a splash page, a new section will appear on the Access Control page, directly below the Splash Page section. This section allows further configuration of Systems Manager Sentry.

• Enrollment network: This dropdown is used to select the SM network that unenrolled devices will be prompted to enroll in before gaining access.

• Strength: Each setting allows for adjustment of the scope of devices that will be forced to enroll within a Systems Manager network.

• Enforce On: Select the checkbox for each device type that should be forced to enroll in a Systems Manager network before gaining network access.

• Billing (paid access)

      Users choose from various pay-for-access options, or an optional free tier (possibly subject to a bandwidth limit). The splash page will look like the picture below. You can determine the pricing plans for users as you like and if you check the box for Hide bandwidth numbers?, the bandwidth limit you choose for the pricing plan will not be displayed for users on the splash page. 

 

When clients purchase network access, they receive a receipt by email. The Reply-to-address is the email address you want to use for the interaction with the user, or for setting a no-reply for billing emails.

MX Splash Page Options

If VLANs are configured on the Security & SD-WAN > Configure > Addressing & VLANs page, splash settings are configured separately for each VLAN. Use the Select VLAN drop-down at the top of the Security & SD-WAN > Configure > Access Control page to choose the VLAN you wish to modify splash settings for.

Splash page network access options for MX devices are limited compared to the options available for Meraki MR. The access control options available for MX devices include:

 

• None (direct access)

Users can access the network as soon as they associate

• Click-through

Users must view and acknowledge your splash page before being allowed on the network

• Sign-on with  My Radius server / 3rd Party Credential    Users must enter a username and password before being allowed on the network

The following options can be configured for the captive portal that users are placed in before they have passed through the splash page:

• Captive portal strength
  • Block all access until sign-on is complete: Users who have not yet passed through the splash page have no network access, except to hosts that have been added to the walled garden.
  • Allow non-HTTP traffic prior to sign-on: Users who have not yet passed through the splash page cannot send or receive traffic on TCP port 80 (HTTP) except to hosts that have been added to the walled garden, but can pass other types of traffic normally to any destination.

• Walled garden: Enabling the walled garden allows you to specify a list of IP addresses and domains that users can access before passing through the splash page. Items in this list should be separated by spaces or separate lines, and domains can include wildcards in the form of an asterisk ( * ).
• Controller disconnection behavior: Specifies how to treat clients when the Cloud Controller is unreachable. There are three options.
  • Open: Splash is disabled when the Cloud Controller is unreachable.
  • Restricted: Only white-listed clients and clients who have already passed through the splash page will be able to access the network.
  • Default for your settings: Automatically sets the controller disconnection behavior based on the splash mode. If Click-through splash is enabled, the default behavior is Open. If Sign-on splash is enabled, the default behavior is Restricted.