Meraki - WPA2 Enterprise configuration

Purpose

This article shows how to create and configure a WPA2 Enterprise SSID on Meraki.

Supported devices

This article applies to all devices belonging to the MR series 

 

Prerequisites

Don't you see the options to set RADIUS Accounting under Configure tab? Just ask Meraki via technical support for firmware upgrade:

Dear Meraki support,
I'd like you to get the access to the features described below:
Radius Accounting: https://documentation.meraki.com/MR/Splash_Page/Configuring_RADIUS_Authentication_with_a_Sign-on_Splash_Page

I'm setting up my Meraki Dashboard to be used with Cloud4Wi service (https://marketplace.cisco.com/catalog/solution/154406?pid=157939) and these features are required.
Please update the device's firmware at your earliest convenience.

Thank you in advance.

Please check that the router is connected to the Internet.

It is recommended to update your device firmware to the last available version.
You may choose to configure the device to receive and install last firmware updates automatically.

 

Setting your SSID and access controls

The first step is configuring the SSID of the access point.
Please choose your organization and group, then select Wireless in the drop-down menu and then click SSIDs under the Configure subsection.

 

Then select your SSID. If you want to use an inactive SSID, please click on Show all my SSIDs.

 

Then enable your inactive SSID.

 

If your network is disabled, please enable it.

 

You can rename the SSID at your convenience by clicking rename.

 

 

Then, by clicking edit settings, you can configure access settings for the network.

You should set no encryption in the Association requirements section since end-users will perform the authentication against a RADIUS server.

In the Splash page section, select "None"

Then you must set the IP address and the port for the RADIUS server, for both authorization and accounting phases. You can configure the device to support a primary and a secondary RADIUS server.
Please ensure that end-user will not be able to access the network in case RADIUS servers are not available.

For better user experience, we recommend disabling data-carrier-detect (this will limit the disconnection of users in case the access point does not detect the device for a while).

 

You can choose the NAT mode or Bridge mode according to your favorite network configuration.

 

 

If required, it is possible to set VLAN tagging, to direct traffic to specific VLANs.

 

 

You can set the version of the IEEE 802.11 protocol to use.

 

 

Then save your changes.

 

Parameters for the Solution

The parameters indicated above for the Mode Settings section are mandatory for the proper functioning:

RADIUS for splash page (primary)
Host:52.48.102.108
Port: 1812
Secret: (Cloud4Wi will communicate it)

 

RADIUS for splash page (secondary)
Host:34.252.97.217
Port: 1812
Secret: (Cloud4Wi will communicate it)

RADIUS accounting servers (primary)
Host:52.48.102.108
Port: 1813
Secret: (Cloud4Wi will communicate it)

RADIUS accounting servers (secondary)
Host:34.252.97.217
Port: 1813
Secret: (Cloud4Wi will communicate it)

If these parameters change in the future, we will promptly inform you about new values.