Cisco Meraki (MR series)

Prerequisites

Dear Meraki support,
I'd like you to get the access to the features described below:
Splash Page: https://documentation.meraki.com/MX-Z/Access_Control_and_Splash_Page/Splash_Page
Access Control: https://documentation.meraki.com/MX-Z/Access_Control_and_Splash_Page/Access_Control
Walled Garden: https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Walled_Garden
Radius Accounting: https://documentation.meraki.com/MR/Splash_Page/Configuring_RADIUS_Authentication_with_a_Sign-on_Splash_Page

I'm setting up my Meraki Dashboard to be used with Cloud4Wi service (https://marketplace.cisco.com/catalog/solution/154406?pid=157939) and these features are required.
Please update the device's firmware at your earliest convenience.

Thank you in advance.

Setting your SSID and access controls

The first step is configuring the SSID of the access point.
Select Wireless in the drop-down menu and then click SSIDs under the Configure subsection.

You can rename the SSID at your convenience by clicking rename.

Then, click edit settings, to access the Access Control page for this SSID . 
You can also reach this page directly from Wireless > Configure > Access Control and selecting the desired SSID form the dropdown at the top of the page.

1. Find the Security section and select Open (no encryption)
   
   
    
2. Find the Splash Page section and select Sign-on with my RADIUS server
   
   
    
3. Find the RAIDUS servers section. Click Add server and add two entries, for the primary and secondary RADIUS Servers using the parameters provided in your Cloud4Wi Dashboard in Manage > Preferences > WiFi Service (read more)
   
   
4. Scroll down to the RADIUS accounting servers section. Click Add server and add the two entries for the primary and secondary RADIUS accounting server, using the value provided in the Cloud4Wi dashboard (read more)
    
5. Set the other options as following:
   1. Accounting interim interval: 4 minutes
   2. Accounting start delay: 0 minutes
   3. RADISU CoA Support:  enabled
   4. Dashboard RADIUS proxy: disabled
   5. RADIUS attribute specifying group policy name: Filter-Id
       

6. Under Advanced RADIUS settings (if present) configure:

   Called-Station-ID	1 - AP MAC address (remove any others)
   NAS ID	1 - AP MAC address (remove any others)
   Server timeout:	5 seconds
   Retry count:	3

7. You also must set the complete access to the Internet only for authenticated end-users. To do this, you must set Captive portal strength to Block all access until sign-on is complete.
   
   
8. Next, you have to configure the walled garden, that is the list of hosts or IP addresses ranges that can be visited by end-users even without being authenticated.
   
   To use this feature most effectively, we recommend making a request to Cisco Meraki asking for the activation of the "walled garden" feature. Doing this, you will be able to enter not only hostnames but even IP address ranges (by using CIDR notation) and subdomains (by using domain wildcards).After the activation of this feature, a tip below the Walled garden input will indicate the right syntax to enter new domains.
   
   Add the following values:
   1. c4wstatic.cloud4wi.com
   2. c4wstaticjs.cloud4wi.com
   3. *.cloud4wi.com
      
      If you have a white label version, you need to add the wildcard for the domain used on your Splash Page URL
      
      
       
9. To configure the walled garden to support Social Login, payment or SSO capabilities, please check the following articles:
   1. Walled garden for the Social Login (websites/domains to open)
   2. Walled garden for PayPal feature (websites/domains to open)
       
10. For Simultaneous logins, you have to set "Allow simultaneous devices per user".
    
    
     
11. Go to IP and VLAN section. You can choose the NAT mode or Bridge mode according to your favorite network configuration.
    
    If required, it is possible to set VLAN tagging, to direct traffic to specific VLANs.
     
12. Click Save Changes.

Configuring the Splash page

Finally, we need to set the Splash Page. To retrieve the Splash Page URL for your account, go to the Cloud4Wi dashboard, Manage > References > Wi-Fi service, and copy the Global Splash Page URL parameter.

Go to the Splash page page on your Meraki dashboard form Wireless > Configure > Splash Page. In the next page, please select the SSID you configured for the CLoud4Wi guest wifi service..

Find the Custom splash URL section and in the input next to the label "Or provide a URL where users will be redirected:" enter the Global Splash Page URL that you obtained in your Cloud4Wi dashboard.

And under Splash behavior, in the input field called Where should users go after the splash page?  select A different URL and enter the same value as your Global Splash Page URL

Then click Save changes.

 

 

802.1X/Passpoint SSID configuration

 

Prerequisites

Don't you see the options to set RADIUS Accounting under Configure tab? Just ask Meraki via technical support for firmware upgrade:

Dear Meraki support,
I'd like you to get the access to the features described below:
Radius Accounting: https://documentation.meraki.com/MR/Splash_Page/Configuring_RADIUS_Authentication_with_a_Sign-on_Splash_Page

I'm setting up my Meraki Dashboard to be used with Cloud4Wi service (https://marketplace.cisco.com/catalog/solution/154406?pid=157939) and these features are required.
Please update the device's firmware at your earliest convenience.

Thank you in advance.

 

Setting your SSID and access controls

The first step is configuring the SSID of the access point.
Go to Wireless > Configure > SSIDs.

Identify the SSID you want to use for this cofniguration. If you want to use an inactive SSID, please click on Show all my SSIDs.

 

Make sure to enable your  SSID if it is inactive (or you can postpone this to a later stage before going live with the service)

You can rename the SSID at your convenience by clicking rename.

Then, click edit settings, to reach the Access Control page for this SSID to configure access settings.

 

You can also reach directly this page by going to Wireless > Configure > Access Control and selecting your SSID.

1. Find the Security section and select Enterprise with my RADIUS server
   
   
2. In the Splash page section, select "None"
   
   
    
3. Find the RAIDUS servers section. Click Add server and add two entries, for the primary and secondary RADIUS Servers using the parameters provided in your CLoud4Wi Dashboard in Manage > Preferences > WiFi Service (read more)
   
   
4. scroll down to the RADIUS accounting servers section. Click Add server and add the two entries for the primary and secondary RADIUS accounting server, using the value provided in the Cloud4wi dashboard (read more)
    
5. Set the other options as following:
   1. Accounting interim interval: 4 minutes
   2. Accounting start delay: 0 minutes
   3. RADISU CoA Support:  enabled
   4. Dashboard RADIUS proxy: disabled
   5. RADIUS attribute specifying group policy name: Filter-Id

6. Under Advanced RADIUS settings (if present) configure:

   Called-Station-ID	1 - AP MAC address (remove any others)
   NAS ID	1 - AP MAC address (remove any others)
   Server timeout:	5 seconds
   Retry count:	3

7. Go to IP and VLAN section. You can choose the NAT mode or Bridge mode according to your favorite network configuration.
   
   
   
   If required, it is possible to set VLAN tagging, to direct traffic to specific VLANs. Cloud4Wi can dynamically assign VLAN via RAIDUS (see Cloud4Wi Group Policies)
   
   
    
8. Click Save Changes.

 

 

Hotspot 2.0 settings

From the Cisco Meraki Dashboard, select Wireless > Configure > Hotspot 2.0. 
The Hotspot 2.0 page appears. Select the SSID that you previously created with the WPA3-Enterprise settings.

Configure the following parameters:

• Hotspot 2.0: Enabled. This activates the rest of the fields on the page.
• Operator name: CLOUD4WI:US
   
• Venue name: any value, including “unspecified”, don’t leave it empty
• Network type: free public network
• Domain list: enter your domain as configured in the Passpoint settings (such as brand.securewifi.io)

 

Next to NAI Realms, click Create Realm.  The Create NAI Realm dialog box appears.

Enter the following parameters:

• Format: 0
• Name: enter your domain as configured in the Passpoint settings (such as brand.securewifi.io)
• Then click Add an EAP method and enter the following information:
  • Method ID: 21
  • Authentication Methods: MSCHAPv2, PAP, MSCHAP
    
    
     
  • Click Create Real to confirm.
    The realm will appear in NAI Realms table:
    
    

 

Click Save Changes at the bottom of the screen.

OpenRoaming (if desired)

To also enable OpenRoaming

• in the Roaming Consortium OI 1 write “5A03BA0000”.
• in the Roaming Consortium OI 2 write "004096".
• Click Save

 

Known issues with Meraki hotspot 2.0

Sometimes, Meraki stops broadcasting Hotspot 2.0 parameters, therefore devices with provisioned WiFi profiles won't recognize the network.

The problem has been detected occasionally when changing certain settings of a network, such as adding an SSID or changing the access control configuration of any SSID. When Meraki propagates those changes to the network, the APs seem to stop broadcasting Hotspot 2.0 information.

A workaround to fix this problem is to go to the Hotspot 2.0 page, change some parameters such as the Venu Type, and Save. Meraki will propagate the new configuration to the network and Hotspot 2.0 will start working again. If this operation does not solve the problem, try also to restart the Access Points.

 

 

Provisioning Meraki Access Points into the Cloud4Wi Dashboard

For Cisco Meraki devices, the Cloud4Wi Dashboard requires only the MAC address. If you need help in finding the MAC address of your device, please check the following article from Cisco Meraki documentation: Locating the MAC address of Cisco Meraki devices.

 

To add a new access point to the system, please see How to add an access point.

To simplify the inventory synchronization process, you can set up the Cloud4Wi automated inventory synch for Meraki utility. This tool utilizes Cisco MEraki APIs to detect network and access points, thereby streamlining the synchronization of the CLoud4Wi inventory.

 

Related Articles:

• Configuring  Cisco Meraki access point to enable Cloud4Wi Location Analytics