This article is meant to serve as a guideline for RADIUS issues that require more detailed debugging when requested by Meraki Support for more complex or hard-to-pin-down issues. It is meant to be used in conjunction with monitor-mode .pcaps for wireless clients, and with Support enabling verbose RADIUS logging on our hardware to form a complete picture of what all involved parties see during the transaction.
The "AP failed (auth failure: must change password)" error means that the AP received an Access-Reject reply from the RADIUS server stating that authentication failed and that an MSCHAPv2 error was detected, indicating that the user must change the password. This is the error seen when the "User must change password on next login" box is checked on the user object in Active Directory.
A fundamental component of RADIUS is a client's validation of the RADIUS server's identity. This is accomplished by hosting a certificate on the RADIUS server that has been validated by a trusted Certificate Authority (CA). If a self-signed certificate (or any certificate from an untrusted CA) is in use, most clients will reject the connection since they cannot validate the server's identity.
Systems Manager can be used with Cisco Meraki wireless networks to easily deploy certificate-based (EAP-TLS) authentication to iOS, Android, OS X, and Windows 10 clients. This is ideal for customers that want to seamlessly and securely (using WPA2) authenticate users, while avoiding the additional requirements of an external RADIUS server. This article will cover an example of how to implement this solution.
The Cisco Meraki Dashboard provides a convenient test feature that allows you to test connectivity to your RADIUS server. Using this RADIUS Test feature along with examining the Windows 2008 Network Policy and Access Services logs and Security logs will provide useful information in determining the cause and resolving RADIUS Authentication failures.
Systems Manager Sentry Wi-Fi security provides automatic certificate-based EAP-TLS configuration in just a few clicks, eliminating the need for the use of a certificate authority (CA) and the additional management required for each device and user. This article outlines how to integrate SM Sentry with Cisco Meraki MR access points for EAP-TLS wireless authentication.
This document outlines how to configure an iOS or Mac OS X device to authenticate to a Meraki wireless network configured to use the WPA2-Enterprise 802.1X with Google Auth authentication method.
The following steps outline how to configure a Windows 8 or 10 device to authenticate to a Meraki wireless network configured to use WPA2-Enterprise 802.1X with Google Auth
Cisco Meraki MR access points offer a number of authentication methods for wireless association, including the use of external authentication servers to support WPA2-Enterprise. This article outlines Dashboard configuration to use a RADIUS server for WPA2-Enterprise authentication, RADIUS server requirements, and an example server configuration using Windows NPS.
Cisco Meraki access points can be configured to provide enterprise WPA2 authentication for wireless networks using Cisco Identity Services Engine (ISE) as a RADIUS server. This article will cover instructions for basic integration with this platform. For more detailed information on how to configure Cisco ISE, please refer to the Cisco Identity Services Engine User Guide.
This document outlines the steps you will need to take to configure your Meraki wireless network for WPA2-Enterprise encryption with 802.1X authentication against your Google Apps domain. With this feature, your users will be able to use their Google Apps credentials to access your secure wireless network.
When you configure an SSID to use WPA2-PSK as the Association type in Dashboard, you are required to create a passphrase that is 8 characters or more in length. This passphrase is used for authentication and data encryption. The passphrase is also case sensitive.
Windows 2008 Network Policy Server can be used to authenticate and grant access to wireless domain member computers in a Windows Active Directory domain using MAC based authentication.In this example, access is granted to members of the Domain Security Group MAC_Auth placing them on VLAN 500. For more information, please refer to our documentation on enabling MAC-based access control.
With MAC based authentication, domain member computers use the MAC address of their wireless interface as the username and password. Therefore each domain computer requires an associated Windows User account in Active Directory to authenticate. This User account is not the same as its Active Directory computer object. After the User accounts have been created, they can be placed in a Windows security group for authentication.
Cisco Meraki fully supports EAP-SIM in the same way that we handle regular EAP-based authentication types (e.g. EAP-TLS) when the RADIUS server is customer hosted - by forwarding 802.1x requests from the AP to a RADIUS server (specified in Dashboard on the Configure > Access control page). For more basic information on 802.1x and WPA2 encryption consult Cisco Meraki's online documentation.
When using Meraki Authentication for Client VPN authentication or SSID Association requirements, a network administrator can easily create and edit user accounts from Dashboard. Organization administrators can also delete existing user accounts. This article details the necessary steps to create, edit or delete users for network access.
WPA2-Enterprise with 802.1x authentication can be used to authenticate users or computers in an Active Directory domain. The supplicant (wireless client) authenticates against the RADIUS server (authentication server) using an EAP method configured on the RADIUS server. The gateway APs (authenticator) role is to send authentication messages between the supplicant and authentication server. This mean the RADIUS server is responsible for authenticating users.
The following instructions outline how to use the password reset feature for network users. Note: If you are trying to reset the password for an administrator's Dashboard account, please refer to our KB documentation on resetting an Organization or Network administrator password.
By default, SSIDs on Cisco Meraki access points that are configured as WPA2 will utilize a combination of both TKIP and AES encryption. In most cases this will allow support for a wider variety of clients but some devices can respond poorly to these extra options.
This article is to be used as a short reference guide on how to manually set up a WPA2-Enterprise with RADIUS Authentication (IEEE 802.1X) wireless profile on Android devices. This profile will allow the client devices to connect to the SSIDs configured with WPA2-Enterprise with 802.1X authentication as the association requirement.
