EAP-TTLS/PAP Username+Password Authentication with Entra ID Lookup

Authentication Flow

First, let’s try to understand the authentication flow for this specific use case. As shown in the diagram below, our goal is to enable end-users or endpoints connect to the network (SSID or a switch port) using their domain username and password. 

The authentication flow is:

1. The endpoint initiates the connection with the SSID or switch port. 
2. The network device will request the identity of the endpoint.
3. The user will enter their username and password or the endpoint uses the saved credentials that will be sent to network device. 
4. The network device will forward the identity information within a RADIUS packet to Cisco Meraki Cloud over a Cisco proprietary AES-256-bit encrypted TLS tunnel.
5. Cisco Meraki Cloud will authenticate the user directly against Entra ID. 
6. Cisco Meraki Cloud would have already synchronized users, user groups and user attributes from Entra ID Graph API integration and stored them in its local database.
7. Access Manager evaluates the session against the configured rules – a rule is matched if all the defined conditions (like user identity from Entra ID, endpoint identity, network information and others) are matched and the corresponding configured authorization will be applied as a result. 
8. The resulting authorization (for example SGT, VLAN and others) will be sent back to the network device for enforcement. 
9. The endpoint will be connected successfully. 

Configuration Overview

This section covers the configuration steps at a high-level to explain various components of the workflow. The configuration needed for this use case can be broken down into following steps:

1. Configure Entra ID integration to synchronize users, user groups and user attributes
2. Configure SSIDs and Switches to use Access Manager
3. Configure authorizations to be used – SGTs, VLANs, Group Policies and others 
4. Configure Access Manager rules for policy evaluation
5. Configure endpoints for username and password authentication

Configure Entra ID Integration

Configure Entra ID integration to synchronize all the users, user groups and attributes and store them in Cisco Meraki Cloud database. A proactive synchronization occurs every six hours, and you can initiate a manual synchronization at any time.

Entra ID integration synchronizes users, user groups, and user attributes. However, since password synchronization is not allowed, the integration is also used to perform real-time username and password authentication against Entra ID for Username/Password authentication flows. After successful authentication, Access Manager performs a user lookup against the synchronized Entra ID database. The session is then evaluated against the configured access rules to determine authorization (e.g., SGT, VLAN) based on user groups like HR and Finance or other attributes from Entra ID.

Microsoft Entra ID Permissions  

For detailed instructions, Refer to Access Manager - EAP-TTLS Client Configuration (Windows, macOS and iOS)

Add the following Microsoft Graph API permissions, under Manage > API Permissions, to the Entra ID application. Without these permissions, the syncs may not be able to complete successfully:    Grant Admin Consent for your Entra Directory Microsoft Graph > Application > Domain.Read.All : required for 2 or more Entra ID tenants to match the user's UPN suffix (e.g., @pseudoco.com) against the list of available domains Microsoft Graph > Application > Group.Read.All Microsoft Graph > Application > User.Read.All Microsoft Graph > Delegated > User.Read (Required for Access Manager integration)

EAP-TTLS/PAP does not support MFA authentication. You must exclude the Access Manager App Registration in Entra ID from MFA authentication using Conditional Access Policies. Conditional Access Policies requires a paid subscription for Entra ID.

Microsoft Entra ID Conditional Access Policies

Warning: Proceed with caution as these changes may severely impact your security settings. Following steps are for information purposes only. Many organizations may have different settings that may require changes accordingly.

Refer to following resources for more details on security defaults and conditional access: 
Security defaults in Microsoft Entra ID
Conditional Access in Microsoft Entra ID 

Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. Browse to Protection > Conditional access. Select Create a new policy. Enter the Name and select All users under Users Select Target resources > Exclude > Select resources > Select > Select "app registration" created in Entra ID integration step Select Grant > Grant access > Require multifactor authentication. Select On under Enable Policy. Select Create. Verify you are not applying MFA to all users

 

Disabling security defaults

Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator. Browse to Identity > Overview > Properties. Select Manage security defaults. Set Security defaults to Disabled Select Save

 

Configure Wireless And Wired Networks To Use Access Manager

Configure Wireless SSID Access Control Settings

Assuming, you already have an MR added to your Meraki dashboard and licensed appropriately, navigate to Wireless > Configure > Access control. Choose the SSID you want to use for this use case.
Navigate to Security section and choose Enterprise with Access Manager as shown

Extended Local Auth is only applicable for certificate (EAP-TLS) based authentication. Selecting this will ensure that this certificate chain is downloaded on all the MRs that are configured with an SSID that uses Access Manager. In the event of Cisco Meraki Cloud not being reachable, any new endpoints trying to authenticate will be authenticated by the local RADIUS server on each MR using the certificate it downloaded previously. Note that the rules evaluation will not work but instead, the VLAN configured on the SSID will be applied to the session after successful authentication. Make sure to enable this on both the certificate and the SSID Access Control Page. 

• Changes to any other SSID settings like Client IP and VLAN assignment, etc. can be made as needed and
• Select Save at the bottom.

 

Wired - Configure Access Policy and Switch Port

For Wired connections, you will need to configure an Access Policy that uses Access Manager as the authentication method and attach that Access Policy to the switch port where the endpoint/s will be connecting. 

These are the steps at a high-level to configure access policy and switch ports to use Access Manager as the authentication server: 

For detailed instruction on how to configure Access Policies, refer to our documentation on Access Policy.

 

Navigate to Switching > Configure > Access Policies. Select Add policy Name: AM-Hybrid-MultiAuth (or whatever name you want) Authentication method: Access Manager  Connection: Policy Type: Hybrid authentication : First try 802.1X authentication then fallback to MAB if the endpoint fails to respond (timeout). Host mode: Multi-Auth: allow multiple MACs in the data VLAN and one MAC in the voice VLAN. 802.1X control direction: Both Re-authentication interval: 28800 - a number, in seconds, defining the session timeout and to re-authenticate the endpoint. Concurrent Authentication: Disabled. Send 802.1X and MAB requests to the RADIUS server (Access Manager) in parallel (concurrently).  ✅ Voice Auth: allow phones into the voice domain Save

Navigate to Switching > Monitor > Switch Ports  Edit one or more Switch Ports with the following values: Port status: Enabled Type: Access Access policy: AM-Hybrid-MutliAuth (or whatever name you gave it) Select Update.

 

Configure Access Manager Rules

Now that we have everything in place, it is time to configure the Access Manager rules which will determine what authorization (SGTs, VLANs, Group Policies) will be applied to the endpoints when they authenticate.

The rule framework is very straightforward – define the matching criteria and define the corresponding authorization result to be assigned. Following are the steps needed for this configuration:

Here is an example rule that we will use to illustrate on how to configure rules:

Navigate to Access Manager > Policies > Access Rules
Select + Add a rule: Name: TTLS_Entra_Employees (or any name you want) Status: Enabled Attribute source: Network Access EAP Protocol: EAP-TTLS Attribute source: Choose Your Entra ID Domain Account Enabled: True  Group: Match Any : Employees (or any group you want)
Under Authorization section, select Access permission dropdown to choose an option. VLAN ID/name: Assigns a VLAN ID or VLAN name. For successful connection, make sure that the VLAN entered here is present in the network where the endpoint is authenticating. Voice domain: Enabling this will ensure that voice traffic is permitted.  Adaptive policy: Assigns an Adaptive Policy Group (and corresponding SGT value). Refer to our Adaptive Policy documentation on how to implement zero-trust micro-segmentation policies through Adaptive Policy. Identity PSK: Applicable for MAC Authentication Bypass use case only. Assigns a key to the session and if the key entered by the endpoint matches the key assigned, the rule will be matched and corresponding authorization (VLAN, Adaptive policy and others) will be applied.  Group policy: Assigns a group policy. Refer to our Group policy documentation on how define and apply a list of rules, restrictions, and other settings to the endpoints that are connecting to your network. As an example, we selected Allow restricted access, assigned FTE Laptops Adaptive Policy Group (SGT) and VLAN 250 that we created earlier. Select save after the selections.
Now, any endpoint matching the criteria defined in the rule (Entra ID Group = Product Management) will be matched with the rule and corresponding authorization (VLAN = 250 and Adaptive Policy = FTE-Laptops) will be applied.

Configure Endpoints For Username/Password Authentication

Refer to the following resources for operating system-specific instructions to configure your endpoints for EAP-TTLS Username and Password authentication against Access Manager:

• Access Manager - EAP-TTLS Client Configuration (Windows, macOS and iOS)
• EAP-TTLS Client Configuration

Troubleshooting

Remember that access control is a solution with many components and you may need to check each one.

• Verify username and password: Verify that the correct username and password are entered while authenticating.
• Verify password used is not a temporary password: Temporary/initial Microsoft Entra ID passwords for the users are not supported. You must change the temporary password for a user, login to any Microsoft portal (eg: portal.azure.com) if you haven't already. 
• Verify wired/wireless supplicant configuration: Verify that the wired/wireless supplicant configured on the endpoint includes EAP-TTLS as the authentication method and PAP as the inner method (macOS) / non-EAP method (windows) at minimum.