Configuring RADSec (MR)

Import company Root CA

1. In the dashboard, navigate to Organization > Configure > Certificates > Upload certificates

2. Select the desired Root CA certificate from the directory

3. Uploaded certificates will be listed in the certificate overview page

Create the Organization CA

1. Generate CA server certificate (one CA per Meraki organization)

2. Trust the root Certificate Authority

3. Download the root certificate to upload to the RADIUS server

Enable the SSID for RADSec

1. In the dashboard, navigate to Wireless > Configure > Access Control

2. Specify RADIUS server configuration

3. Enable RADSec for SSID

4. Save the RADIUS server configurations

5. Save configuration

Editing Certificates

1. In the dashboard, navigate to Organization > Configure > Certificates 

2. Select uploaded certificates on the dashboard and select the edit option to delete or download the certificate.

2. Select Delete the certificate

Enable RADSec Keep Alives

To avoid reestablishing a TLS tunnel between the MR and RADIUS servers, APs can be configured to send "keep-alive" messages to RADSec servers. This feature helps maintain the TLS connection, preventing devices like load balancers or the RADIUS server from closing the connection in case authentications or accounting updates aren't sent.

Within the Radius server settings, specify the TLS idle timeout.

Import company Root CA

This step allows the Meraki Dashboard to know your company's Root CA public key so we can validate the server certificate that is sent during the setup process.

{content} is the output of `cat <root ca>.pem`, this needs to be a single line so the carriage return needs to be replaced with a '\n'.

POST https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/import
Request body: '{ "managedBy":"mr", "contents":"{content}", "description":"create certificate description"}'
Response code: 201
Response body:{"certificateId":{certificateId},"description":"{description}","parentCertificateId":null,"source":"Wireless"}

GET https://api.meraki.com/api/v1/organizations/{organizationId}/certificates?certManagedBy[]=mr"

DELETE https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/{certificateId}

Create the Organization Root CA

Create an organization's RADSec device Certificate Authority (CA). Call this endpoint when turning on RADSec in the firmware for the first time. This CA signs all the certificates that AP will present when establishing a secure connection to RADIUS servers via RADSec protocol.

POST https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/radSec/deviceCertificateAuthorities
Response code: 201
Response body: { "status": "generating", "contents": null, "authorityId": null }

GET https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/radSec/deviceCertificateAuthorities/{authorityId}
Response code: 200
Response body: {"status": "untrusted","contents": "-----BEGIN CERTIFICATE---...","authorityId": "1234"}

GET https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/radSec/deviceCertificateAuthorities
Response code: 200
Response body: [ { "status": "trusted", "contents": "-----BEGIN CERTIFICATE---...", "authorityId": "1" }, { "status": "untrusted", "contents": "-----BEGIN CERTIFICATE---...", "authorityId": "2" }, { "status": "untrusted", "contents": "-----BEGIN CERTIFICATE---...", "authorityId": "3" } ]

Set the CA to be trusted

Update an organization's RADSec device Certificate Authority (CA) state. Once the CA is trusted, the AP will generate a CSR and Dashboard will generate device certificates.

PUT https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/radSec/deviceCertificateAuthorities/{authorityId}
Request body: '{"status": "trusted"}' 
Response code: 200
Response body: { "status": "trusted",  "contents": "-----BEGIN CERTIFICATE---...", "authorityId": "1234" }

GET https://api.meraki.com/api/v1/organizations/{organizationId}/certificates/radSec/deviceCertificateAuthorities/{authorityId}/revocationList 
Response code: 200
Response body: { "crl": "-----BEGIN X509 CRL---..." }

Enable RADSec for SSID

Configure the SSID to use the RADIUS server for RADSec. Even though RADSec uses certificates, a “secret” needs to be provided.

PUT https://api.meraki.com/api/v1/networks/{network_id}/wireless/ssids/{number}
Request body:  '{ "radiusServers":[{"host":"{HOST IP or FQDN}", "port":2083, "secret":"<secret>", "radsecEnabled": "true" }

Configure TLS Idle Timeout

PUT https://api.meraki.com/api/v1/networks/{network_id}/wireless/ssids/{number}
Request body:  '{"radiusRadsecTlsIdleTimeout": 900 }

CAs not trusted or missing certificates

The event log will show that there is an error on the TLS session establishment with the external server: