I assume that the reader knows the Guest-Workflow (which is for example learned in the Cisco SISE-training). The other workflows could also be used in a similar way. Here I show the policy for the “hotspot”-Guest workflow. To combine these two features, we just need to make sure that we always return the same PSK for the same session. On the Meraki-APs we need the “Walled Garden” feature instead of using Redirect-ACLs like on traditional Cisco APs: The Guest-session is then controlled with the Meraki Splash-page, same as we would do it without a PSK
With this feature we assign a PSK to the session that is not configured on the Meraki-side, the PSK gets “pushed” from the RADIUS-server.
Instead of using the option “MAC-based access control (no encryption)” we choose the option “Identity PSK with RADIUS”: The solution to this “problem” is to combine two Meraki features which result in the desired functionality. At the same time we want to protect the SSID, that not every one in range can connect to this Guest-SSID.
Why do we need both? One reason is to control Guest-access with the Cisco ISE and there we need a RADIUS-Request from the NAD to start the Guest-Workflow. We can configure either PSK or MAC-based access control, but the later without encryption.
#SETUP MERAKI VPN ON MAC SOFTWARE#
When looking at the configuration of a Meraki SSID (this is software version 27.5.1), there is no obvious way to configure MAC-based access-control and PSK simultaneously as it is possible with the traditional Cisco WLAN:
0 kommentar(er)
