This article is meant to serve as a guideline for RADIUS issues that require more detailed debugging when requested by Meraki Support for more complex or hard-to-pin-down issues. It is meant to be used in conjunction with monitor-mode .pcaps for wireless clients, and with Support enabling verbose RADIUS logging on our hardware to form a complete picture of what all involved parties see during the transaction.
The "AP failed (auth failure: must change password)" error means that the AP received an Access-Reject reply from the RADIUS server stating that authentication failed and that an MSCHAPv2 error was detected, indicating that the user must change the password. This is the error seen when the "User must change password on next login" box is checked on the user object in Active Directory.
A fundamental component of RADIUS is a client's validation of the RADIUS server's identity. This is accomplished by hosting a certificate on the RADIUS server that has been validated by a trusted Certificate Authority (CA). If a self-signed certificate (or any certificate from an untrusted CA) is in use, most clients will reject the connection since they cannot validate the server's identity.
This document outlines how to configure an iOS or Mac OS X device to authenticate to a Meraki wireless network configured to use the WPA2-Enterprise 802.1X with Google Auth authentication method.
The following steps outline how to configure a Windows 8 or 10 device to authenticate to a Meraki wireless network configured to use WPA2-Enterprise 802.1X with Google Auth
Cisco Meraki MR access points offer a number of authentication methods for wireless association, including the use of external authentication servers to support WPA2-Enterprise. This article outlines Dashboard configuration to use a RADIUS server for WPA2-Enterprise authentication, RADIUS server requirements, and an example server configuration using Windows NPS.
This document outlines the steps you will need to take to configure your Meraki wireless network for WPA2-Enterprise encryption with 802.1X authentication against your Google Apps domain. With this feature, your users will be able to use their Google Apps credentials to access your secure wireless network.
When you configure an SSID to use WPA2-PSK as the Association type in Dashboard, you are required to create a passphrase that is 8 characters or more in length. This passphrase is used for authentication and data encryption. The passphrase is also case sensitive.
With MAC based authentication, domain member computers use the MAC address of their wireless interface as the username and password. Therefore each domain computer requires an associated Windows User account in Active Directory to authenticate. This User account is not the same as its Active Directory computer object. After the User accounts have been created, they can be placed in a Windows security group for authentication.
Cisco Meraki fully supports EAP-SIM in the same way that we handle regular EAP-based authentication types (e.g. EAP-TLS) when the RADIUS server is customer hosted - by forwarding 802.1x requests from the AP to a RADIUS server (specified in Dashboard on the Configure > Access control page). For more basic information on 802.1x and WPA2 encryption consult Cisco Meraki's online documentation.
IPSK without RADIUS allows you to configure multiple PSKs for a single SSID. Further, the feature allows you to assign group policies in Dashboard based on the PSK used by the client device to authenticate to the WiFi network.
MAC-Based Access Control is one method for preventing unauthorized access to the Wireless LAN. This article discusses how MAC-Based Access Control works and provides step-by-step configuration instructions for Microsoft NPS and Dashboard.
WPA2-Enterprise with 802.1x authentication can be used to authenticate users or computers in an Active Directory domain. The supplicant (wireless client) authenticates against the RADIUS server (authentication server) using an EAP method configured on the RADIUS server. The gateway APs (authenticator) role is to send authentication messages between the supplicant and authentication server. This mean the RADIUS server is responsible for authenticating users.
There may come instances where the deployment could include a larger number of Meraki Access-points being installed and require SSID’s with WPA2-Enterprise RADIUS authentication. In such situations, a RADIUS proxy can be set up wherein instead of adding the Access-points as individual clients dashboard IP ranges can be used.
By default, SSIDs on Cisco Meraki access points that are configured as WPA2 will utilize a combination of both TKIP and AES encryption. In most cases this will allow support for a wider variety of clients but some devices can respond poorly to these extra options.
This article is to be used as a short reference guide on how to manually set up a WPA2-Enterprise with RADIUS Authentication (IEEE 802.1X) wireless profile on Android devices. This profile will allow the client devices to connect to the SSIDs configured with WPA2-Enterprise with 802.1X authentication as the association requirement.
