Access Control

Open (No Encryption)

An Open SSID has no encryption configured. This means that any wireless client that can see the SSID will be able to associate.

Opportunistic Wireless Encryption (OWE)

An OWE SSID has no input (for example user nor password) in order to associate, however, it is still encrypted and provides more security than an Open SSID.

Password 

An SSID with a Password (a passphrase) requires an end-user to enter a pre-defined password into the wireless device to associate to the SSID. All wireless devices connecting to the SSID must use the same password.

Two password formats are supported:

• ASCII (American Standard Code for Information Interchange). 

Passwords can include uppercase and lowercase letters (A-Z, a-z), numbers (0-9), and special characters and must be between 8 and 63 characters. For example: Secure_Tree@2023

• Hex (hexadecimal)

When using a hexadecimal number for a password, the input is case-insensitive, and must be exactly 64 digits long.

For example: 1234123412341234123412341234123412341234123412341234123412341234

MAC-based Access Control

Selecting MAC-based Access Control will query a configured RADIUS server during client association. If the MAC address of the associating client is configured on the RADIUS server to be allowed than the client will be allowed to associate to the SSID. If the RADIUS server rejects the authentication request then the client will not be allowed to associate to the SSID. For more information about configuring MAC-based Access Control please refer to our Enabling MAC-based Access Control and MAC-Based Access Control Using Microsoft NPS articles.

WPA2-Enterprise (802.1X)

WPA2-Enterprise, also referred to as 802.1X, utilizes either a RADIUS server or the Meraki Cloud to authenticate clients trying to associate to an SSID. This requires clients to provide unique authentication information that must be verified against the server before associating to the SSID. For more information about configuring WPA2-Enterprise with a RADIUS server please refer to our RADIUS Auth with WPA2-Enterprise article.

When configured with Meraki Authentication users must have a user account under the Network-wide > Configure > Users page to be able to authenticate. For more information about configuring Meraki Authentication, please refer to our Managing User Accounts article.

Identity PSK without RADIUS

Provides the ability to configure different PSKs to be used within the same SSID with no need to configure a RADIUS server, different policies can be set to each PSK. Please refer to this document for more information.

None 

Selecting None (direct access) will allow users to access the network as soon as they have fulfilled the Network Access Association and Authentication requirements.

Click-through 

Selecting the Click-through Splash Page will present clients with a Splash Page that must be acknowledged before the client is fully authorized to access the network. When the Click Through Splash Page is enabled the option to configure a Captive Portal is enabled. For more information about the Captive Portal feature, see the Captive Portal / Walled Garden section of this article.

Sponsored guest login

Selecting Sponsored guest login allows the users to be authenticated by a limited amount of time with a specific email domain. More info here.

Sign-on with... 

The Sign-on Splash Page requires users to provide some form of Username/Password combination to complete the Splash Page and fully authenticate to the network. There are several different options available for the Sign-on Splash Page, each with different configuration options.

• Meraki authentication: Users must authenticate with a Username/Password from a configured profile on the Network-wide > Configure > Users page of Dashboard. For more information, check out our Managing User Accounts article.
• my RADIUS server: Users must authenticate to a configured RADIUS server before gaining access to the network. For more information about configuring this option, please check out our article about Configuring RADIUS Authentication with a Sign-on Splash Page as well as RADIUS Failover and Retry Details.
• my LDAP server: Users must authenticate to a configured LDAP server before gaining access to the network. For more information about configuring this option, please check out our article about Configuring Splash Page Authentication with an LDAP Server.
• Active Directory: Users must authenticate to a configured Active Directory server before gaining access to the network. For more information about configuring this option, please check out our article about Integrating Active Directory with Sign-On Splash Page.
• 3rd party credentials: Users must authenticate to a configured 3rd Party authentication service before gaining access to the network. Currently only Google oAuth is supported for 3rd Party Credentials. For more information about configuring this option, please check out our article about configuring Google Sign-In.

Sign-on with SMS Authentication

SMS Authentication: Users must enter a valid phone number and authenticate with an authorization code that will be delivered via SMS before gaining access to the network. For more information about configuring this option, please see the SMS Splash Page section of the Splash Page Overview article.

Cisco Identity Services Engine (ISE) Authentication 

Cisco Meraki access points can be integrated with Cisco ISE for authentication. For more information on this feature, please see the following documentation.

Configuring WPA2 Enterprise with RADIUS using Cisco ISE

Change of Authorization with RADIUS (CoA) on MR Access Points

Central Web Authentication (CWA) with Cisco ISE

Device Posturing using Cisco ISE

Endpoint Management Enrollment 

Endpoint management enrollment requires that the connecting device be enrolled within one of the Organization's System Manager networks before gaining access to the network. If a device is not enrolled within a Systems Manager network in the Organization it will be presented with a prompt to enroll the device into the defined Systems Manager network. For more information about using Endpoint management enrollment on an SSID please refer to our Endpoint Management Enrollment article.

After selecting Endpoint management enrollment as a splash page a new section will appear on the Access Control page, directly below the Splash Page section. This section allows further configuration of Sentry.

• Enrollment network: This dropdown is used to select the SM network that unenrolled devices will be prompted to enroll in before gaining access.
• Strength: Each Strength setting allows for adjustment of the scope of devices that will be forced to enroll within a Systems Manager network.
• Enforce On: Select the checkbox for each device type that should be forced to enroll in a Systems Manager network before gaining network access.

Billing (Paid Access) 

If the Billing (Paid Access) option is selected users will be presented with a Splash Page requesting a prepaid access code before being allowed to access the network. Meraki has partnered with several companies to provide this functionality, for more information about configuring a Billing Splash Page please see our Billing for Wireless Access and Splash Pages with PayPal or Credit Card Billing articles. 

Assign Policies by Device Type 

Meraki SSIDs have the option to automatically assign specified group policies to devices based on the detected device type. Each device type can be configured to be automatically assigned to a single policy. For example, iOS devices like iPhones could be set to automatically have a Mobile Devices group policy assigned to them, but other OSX devices like MacBooks could be assigned a different policy upon joining the same SSID.

The following device types can be selected from:

• Android
• Blackberry
• Chrome OS
• iPad
• iPhone
• iPod
• Mac OS X
• Windows
• Windows Phone
• B&N Nook
• Other OS 

For more detailed information about assigning policies by device type and device OS detection, please refer to our Applying Policies by Device Type article.

NAT Mode: Meraki DHCP 

NAT Mode, also referred to as Meraki DHCP, will have the access point assign clients a random address out of the 10.0.0.0/8 pool of IPs. All client traffic from these clients will get NAT'ed to the management IP of the Access Point before being forwarded on the LAN. When using Meraki DHCP each client is isolated from other wireless clients on the same SSID, but may communicate with wired clients on the LAN if the SSID firewall settings permit it. For more information about the operation of NAT Mode: Meraki DHCP, please refer to our dedicated article.

Bridge Mode 

Bridge mode makes the access point operate transparently, which allows clients to pull an IP address from the LAN or use a static IP and operate without any NAT from the access point.

In this configuration, the access point simply forwards traffic directly from the wireless network to the wired network. By default, bridge mode allows devices to communicate to both other wireless clients and to wired LAN clients. Bridge mode also allows for VLAN tagging of client traffic based on the SSID a client is connected to. For more information about bridge mode, please refer to our Client IP Assignment article.

Layer 3 Roaming 

Clients are tunneled to a specified VLAN at the concentrator. They will keep the same IP address when roaming between APs.

VLAN ID

With the Bridge mode or Layer 3 roaming client IP assignment options selected, and VLAN Tagging set to Use VLAN tagging, the VLAN ID configuration section appears.

When Add VLAN is selected, additional VLAN rules appear. APs will tag traffic for this SSID using the values in the VLAN ID column. Keywords entered in the AP tags column identify which APs will use which VLAN IDs for this SSID. To learn more about AP tags, check out our Using Tags to Manage MR Access Points document.

When multiple VLAN rules have been added, rules can be re-ordered or deleted with the options in the Actions column.

Content Filtering

Content filtering on an MR prevents a wireless client from accessing sites that contain pornographic, sexual, or other objectionable adult material.

This feature is configured on a per-SSID basis and is only available when NAT mode is selected for client IP addressing.

There are three possible options with regard to adult content filtering:

• Don't filter adult content: This is the default option. No content filtering is performed. Use this option if you do not wish to restrict any traffic for your users.

• Block adult content: Filtering is performed at the AP level with pre-populated lists of common adult sites. If a user tries to access a blocked site, they will see a splash page stating that the site is blocked by Meraki, and that they should contact their administrator for more details.

This feature provides basic adult content filtering for applications in which advanced filtering techniques are not required (e.g., filtering for guests in the office lobby). If more advanced filtering is required, a separate content filtering solution is recommended, such as content filtering on the Meraki MX product line.

• Use a custom DNS server: This option allows for the specification of a third party DNS server, if the administrator wishes to leverage solutions such as DNS Redirector or OpenDNS Enterprise. If a DNS IP address is specified, the AP will query the specified DNS server for DNS queries sent by a client. More information on this flow is available in our Configuring Custom DNS for an SSID in NAT Mode article.