Meraki WiFi in a Box Design Guide (CVD)

Traffic Flow

1. User Connects to a broadcasted SSID that is configured with WPA2-Enterprise
2. The MR Access Point encapsulates the traffic in an AutoVPN Tunnel towards the vMX in AWS
3. The vMX terminates the tunnel and initiates the Radius request to the designated Radius Server (Cisco ISE 3.1 that resides in AWS as well) 
4. The Cisco ISE server performs a HTTPS REST ID OAuth request with ROPC
5. User admitted on network

The following diagram explains the traffic flow:

vMX Sizing Principles

Dashboard Configuration

1. Navigate to Organization > Configure > License info to add the vMX license to your network (If you haven't done so already) or ensure that you have a valid vMX license in our dashboard
2. Create a dashboard network with Name: AWS, type: Security appliance and Network configuration: Default Meraki Configuration (Or clone from an existing network where applicable).                                                                                                                                                                                                             
3. Assign a vMX to your network
4. Verify that the firmware configured for your network is MX 15.37+
5. Navigate to Security & SD-WAN > Configure > Addressing & VLANs, and choose Routed mode (Please contact Meraki Support to enable this if you don't see that option on dashboard)                                        
6. Enable VLANs under LAN Settings
7. Create multiple VLANs to concentrate your SSIDs' traffic (e.g. VLAN 10, VLAN 20 & VLAN 90 per the sample topology above)
8. Navigate to Security & SD-WAN > Configure > Site-to-site VPN and turn on VPN with this vMX being a Hub (Mesh)
9. Keep VPN Turned off for all configured VLANs                                                                                                                                                                                     
10. Navigate to Network-wide > Configure > General and choose the time-zone for your vMX network                                                                                                                    
11. Navigate to Security & SD-WAN > Monitor > Appliance status and click on the edit button next to the Appliance name and change the name as desired (e.g. vMX-AWS)
12. Click on Generate an authentication token and save it

AWS vMX EC2 Setup

1. Go to the AWS Market Place to access the AMI by clicking here
2. Select the EC2 instance type (The recommended instance type for vMX-S and vMX-M is c5.large. For vMX-L c5.xlarge should be used)
3. Select the region to launch the EC2 instance in (This should match the availability zone your VPC resides in)
4. Select 64-bit (x86) Amazon Machine Image (AMI) as the fulfillment option
5. Click on Continue to Subscribe button (Please allow a few minutes for the subscription to be activated)
6. Once your subscription is available, Click on Continue to Configuration
7. You might be prompted to confirm the fulfillment and region options
8. Click on Continue to Launch
9. For "Choose action" option select the "Launch through EC2" and click Launch.
10. Choose the EC2 instance type (The recommended instance type for vMX-S and vMX-M is c5.large. For vMX-L c5.xlarge should be used)
11. Click Next: Configure Instance Details
12. Select the VPC and the subnet the instance will be a part of and make sure the "auto-assign public IP" is Enabled.       
13. Under "Advanced Details" enter the vMX authentication token from the dashboard in the user data field. (Remember the token is only valid for an hour).
14. Click on the Configure Security Group tab, and choose the following:
    • Create a new Security Group
    • Security Group name: Choose a name
    • Description: Choose a description
    • Change existing rule to type: All traffic and description: Allow all
15. Click Review and Launch to finish creating the instance (It may take several minutes before the software subscription completes and the instance launches)
16. Select or create a new key pair and click continue
17. Select the instance that you have just created
18. Click on the Networking Tab
19. Expand Network interfaces
20. Click on the network interface                   
21. From the Actions tab, click on Change Source/Dest. Check                                                                                                                                                                    
22. Disable the Source/destination check for the network interface and click Save

At this stage, you should be able to verify that the vMX is online on Meraki dashboard by navigating to the AWS network then Security & SD-WAN > Monitor > Appliance status. 

Create a Key Pair

1. Login to your AWS Console as a root user (not IAM user) of your account
2. Verify or choose your region from the drop-down menu next to your name
3. Open the services menu and choose Compute > EC2
4. From the left menu choose Network & Security > Key Pairs
5. Click on Create Key Pair
6. Fill using the following attributes: 
   • Name: ISE-AWS (or any other name of your choice)
   • Key Pair Type: RSA
   • Private Key File Format: .pem
7. Click again on Create Key Pair
8. When prompted, save the ISE-AWS.pem private key file in a folder
9. If you are using MacOS or Linux change the file permissions so it cannot be viewed by others or accidentally overwritten or deleted by you: 

chmod 400 <folder/file-name>.pem

When you create instances in AWS, you may choose to put the matching public key into your VMs to authorize your SSH login. To use your key with AWS EC2 instances, you will connect using SSH and authenticate with the -i identity file option which is your CloudISE.pem private key:

ssh -i ~/.ssh/CloudISE.pem admin@{hostname | IP}
 

AWS EC2 ISE instance Setup

Please note that this design guide will follow the Marketplace approach to launch Cisco ISE CFT. For more information about CFT, please refer to the following document CloudFormation template.

1. Login to your AWS console and access the Marketplace from here
2. Choose your region and fulfilment mode 64-bit (x86) Amazon Machine Image
3. Select Continue to Subscribe. Please wait for a few moments whilst the subscription becomes available.
4. Click on Continue to Configuration
5. In the Configure this Software section, Choose the following:
   • Fulfilment option: CloudFormation Template and choose a suitable template from the next drop down menu
   • Software version: 3.1 (Aug 12, 2021)
   • Region: Choose the region where your vMX resides 
6. Click on Continue to Launch
7. In the Launch this Software section, and under Choose Action, choose Launch CloudFormation
8. Click Launch 
9. In the Create Stack section, for Prepare Template select Template is ready, and for Template source select Amazon S3 URL
10. Click Next
11. In the next section, please fill the following parameters:
    • Stack name: A name of your choice
    • Hostname: A hostname of your choice (This field only supports alphanumeric characters and hyphen (-). The length of the hostname should not exceed 19 characters)
    • Instance Key Pair: Choose the key that you have created in the previous section
    • Management Security Group: Choose the Security Group created when you launched the vMX in AWS
    • Management Network: Choose the subnet that your vMX resides in (e.g. 172.31.16.31)
    • Management Private IP: Choose an IP of your choice within the selected Management Network Subnet
    • Time Zone: Choose your time-zone 
    • Instance Type:  c5.4xlarge (Or a suitable type based on your sizing requirements)
    • EBS Encryption: True
    • Volume size: 600 (Recommended for production) 
    • DNS Domain: Enter a domain name 
    • Name Server: Enter a DNS server that you wish to use (e.g. 208.67.220.220 / 208.67.222.222)
    • NTP Server: Enter a NTP server that you wish to use
    • ERS: yes
    • OpenAPI: yes
    • pxGrid: no (Unless it's required for your deployment) 
    • pxGrid Cloud: no (Unless it's required for your deployment) 
    • User details: Choose a compatible password and confirm it
12. Click Next
13. Click Next
14. Click Launch Stack

At this stage, your ISE instance should be up and running. You can verify that by going to your EC2 Dashboard, then instances, and click on your ISE instance.That will expand the instance details and show you the Public IP address of the ISE instance. Click on it to open the web interface of your ISE instance:

The web interface should look like this:

ISE ROPC Configuration

This section explains the steps needed to integrate Cisco ISE with Azure AD using ROPC (EAP-TTLS) method. 

Before proceeding with this section, please verify that the REST Auth Service is running on Cisco ISE by using SSH login and running the following command:

show application status ise

ISE-AWS/admin# show application status ise


ISE PROCESS NAME                       STATE            PROCESS ID  
--------------------------------------------------------------------
Database Listener                      running          32486       
Database Server                        running          129 PROCESSES
Application Server                     running          45061       
Profiler Database                      running          37569       
ISE Indexing Engine                    running          46031       
AD Connector                           running          46996       
M&T Session Database                   running          37345       
M&T Log Processor                      running          45297       
Certificate Authority Service          running          23275       
EST Service                            running          73725       
SXP Engine Service                     disabled                     
TC-NAC Service                         disabled        
PassiveID WMI Service                  disabled                     
PassiveID Syslog Service               disabled                     
PassiveID API Service                  disabled                     
PassiveID Agent Service                disabled                     
PassiveID Endpoint Service             disabled                     
PassiveID SPAN Service                 disabled                     
DHCP Server (dhcpd)                    disabled                     
DNS Server (named)                     disabled                     
ISE Messaging Service                  running          24504       
ISE API Gateway Database Service       running          36128       
ISE API Gateway Service                running          42163       
Segmentation Policy Service            disabled                     
REST Auth Service                      running          175770      
SSE Connector                          disabled                     
Hermes (pxGrid Cloud Agent)            disabled                     


ISE-AWS/admin# 

If the service is not running, please go back to your Cisco ISE web interface and Click on top left corner to access the full menu, then Click on Administration then under Identity Management Click on Settings. From there and on the left pane menu, Click on Rest ID Store Settings and make sure it is Enabled.

Once the REST Auth Service is running on ISE, you can proceed with the next steps.

ISE External Identity Sources Configuration

1. Login to your ISE instance in AWS (Public IP can be retrieved from your AWS instance) using the credentials previously created during the setup process (Step 11 in the previous section)
2. Click on the top left corner to access the full menu, then Click on Administration then under Identity Management Click on External Identity Sources
3. From the left pane menu, Click on REST (ROPC) and then Click Add
4. Here you will need to provide the Client ID, Tenant ID and Secret Value. (These were created in Step 16 of "Azure AD Setup" section above and you should have saved them before moving to Step 17 as you cannot go back and retrieve them)
5. Under Username Suffix, that should be the Identity Issuer found on your Azure AD with the @ before it 
6. Once you have filled the details above, Click on Test Connection. That should come back successful 
7. Click on Groups, then Load Groups, That should pull the groups that you have already configured on Azure AD and add the groups that require access
8. Click on Save

ISE Policy Sets Configuration

This section explains the steps needed to configure policy sets on Cisco ISE for the purpose of this design. 

1. Click on the top left corner to access the full menu, then Click on Policy then under Policy Elements Click on Conditions
2. Click on the Protocol icon and then on the right hand side Click on Protocol icon again and search for EapTunnel
3. Add a condition EQUALS EAP-TTLS
4. Click Save
5. Then, save this a new library condition and give this condition a name such as EAP-TTLS
6. Click on the top left corner to access the full menu, then Click on Policy then Click on Policy Sets
7. There you should find the "Default" Policy. Click on the settings wheel to "insert new row above"
8. Give your new policy a name (e.g. Corporate) then click on the + sign to start adding conditions
9. In this section you need to filter for devices that should match this policy (e.g. Corporate WiFi devices, etc). Please check the below example but follow your own requirements to create this policy set. 
10. Now Click on the arrow on the right-hand side of your policy to expand the policy authentication and authorization details
11. Click on Authentication Policy. You should find the default policy there. Click on the settings wheel to "insert new row above"
12. Give your policy a name (e.g. Azure) and then click on the + sign to add a condition
13. Click on the Protocol icon on the left hand side and you should find EAP-TTLS condition that you have created earlier
14. Drag and drop the EAP-TTLS condition to the right hand side 
15. Click on Use
16. On the right hand side of your authorization policy, Under Use search for the external identity source (AzureAD) that you have created previously. 
17. Adjust the policy options as needed
18. Click on Authorization Policy
19. Here you can add policies for your AD groups as appropriate. Please refer to the below example:
20. Click on Save

ISE Network Device  Configuration

This section explains the steps needed to add the vMX as a network device on Cisco ISE (Please note that since we are using Teleworker VPN mode on the MR access points, the MX in this case is acting as the authenticator on behalf of the Access Point) 

1. Click on the top left corner to access the full menu, then Click on Administration then Network devices
2. Click on Add
3. Add the vMX with the following details:
   • Name = <choose a name> (e.g. MR-via-vMX)
   • Description = <choose a description>
   • IP address = <vMX WAN uplink Private IP address> (172.31.16.239/32 per the topology above. This can be found either in your AWS EC2 dashboard or on the Meraki dashboard network with the vMX from Security & SD-WAN > Monitor > Appliance status > then click on Uplink                         
   • Device Profile = Cisco
   • Model name = MR
   • Radius secret = <choose a Radius secret>                                       
4. Click Save

Dashboard Configuration

1. Login to your dashboard account 
2. From Organization the menu, click on Create network
3. Choose a name for your network and choose type "Wireless" and Default Meraki Configuration (Or Clone/Bind as required) 
4. Add an access point to your network by clicking Add devices
5. From Wireless > Configure > SSIDs, Rename the first One to Corporate and rename another one as required (See below example) 
6. Click Save Changes
7. Click on edit settings under the first SSID (Corporate in this case) 
8. From the Access Control Page, configure the Corporate SSID with the following settings:
   • Association Requirements = Enterprise with myRadius server
   • WPA Encryption mode: WPA1 and WPA2 
   • Splash page = None
   • Add a Radius server with Host = <ISE Private IP Address in AWS> (172.31.16.31 per the topology above), Port = 1812, Secret = <ISE secret that you have created in the previous section when you added a Network Device> 
   • Under Client IP Assignment, choose VPN: tunnel data to a concentrator⁽¹⁾
   • Choose your vMX as the concentrator
   • VLAN tagging = Choose the VLAN for Corporate traffic (VLAN 10 in this case per topology above) 
   • VPN tunnel type = Split tunnel ⁽²⁾
   • Add a VPN Split tunnel rule with your AWS subnet (172.31.16.0/20 in this case per topology above) and make sure to send traffic over VPN tunnel
9. Click Save Changes

That concludes the steps required to configure MR with SSID tunnelling to your vMX in AWS. 

Adding a Secondary Concentrator to your SSID(s) - Optional

The following section explains the additional configuration needed in case of using a Secondary Concentrator in AWS. 

First, you will need to designate an IP address on the concentrators to be used for tunnel checks. The designated IP address will be used by the MR access points to mark the tunnel as UP or Down. The access points sends a DHCP request for this IP address and a response from the vMX should mark the tunnel as UP. 

Please note that DHCP requests sent from the access point are tagged with the configured VLAN on that SSID.

When you are configuring your SSIDs in the Access control menu, please follow these steps:

The following configuration is needed on dashboard in addition to the steps mentioned in the Dashboard Configuration section above.

1. Navigate to your wireless network
2. From wireless menu, click on Access Control 
3. Click on View new version from the top right corner
4. Choose the SSID from the top drop down menu
5. Under Client IP and VLAN menu, Click on Tunnelled
6. Choose "VPN tunnel data to concentrator"
7. Concentrator = your primary vMX referenced by it's network name
8. Secondary concentrator = your secondary vMX referenced by it's network name
9. Tunnel Health Check IP = your fixed IP address (e.g. 10.10.10.2, 10.10.20.2, 10.10.90.2). Please note that this IP needs to be in the range of which this SSID is being terminated in on the vMX side (e.g. VLAN 10, 20 or 90). As explained above, you can use the IP address assigned to the vMX within the specified VLAN that the SSID is tagged with (For instance, VLAN 10 for Corporate SSID) 
10. Tunnel heartbeat interval = 10 (Frequency of sending DHCP requests)
11. Tunnel idle timeout = 30 (Time to failover to secondary concentrator, by first checking it's tunnel status)
12. De-associate clients on tunnel failover = Don't reassociate
13. Repeat steps 4-11 for your other SSIDs that are tunnelled to a concentrator

At this stage, your MR access points will form one tunnel to each concentrator configured in dashboard. 

The above configuration is shown for the Corporate SSID. Other SSIDs tunnelled to a concentrator should show the same config except for the "Tunnel Health Check IP" which needs to be within the VLAN used to tag traffic from this SSID. Remember that DHCP traffic will be tagged with the same VLAN that is used to tag the SSID traffic. 

The last step was to choose between the following two options:

Reassociate = Force clients to re-associate and trigger a new DHCP request

Don't Reassociate = Do not force clients to re-associate which can offer a more seamless failover