How to Setup Meraki Network Entra ID Authentication Using Radsec

Prerequisites for Setting Up Entra ID Authentication With RadSec in Meraki Network

  1. Registering the application in your tenant
  2. Creating Cloud Radius Instance
  3. Being a Subscription Owner or Network Administrator or Log Reader
  4. User Meraki Firmware 31.1.1 or higher

Introduction - How Entra ID Authentication Works in Meraki Networks and EZRADIUS

For your Meraki Network network to authenticate users with Entra ID, you need to enable RADIUS authentication and connect it to a RADIUS service that supports Entra ID. This guide will show you how to enable RADIUS authentication in WPA-Enterprise with Meraki and EZRADIUS. (Note: This can be achieve with Entra ID username and password but we recommend using EAP-TLS with Entra ID for a more secure and easier authentication method, while EAP-TLS might sound intimidating, here is a 20 minute video on setting up everything from the RADIUS server to the Certificate Authority). How RADIUS Authentication Works with Meraki Network and EZRADIUS and Entra ID

How to Enable RADIUS Authentication In Your Meraki Network Using Radsec- Step by Step

  1. Go to your Meraki Network Controller.
  2. Click on “Wireless” on the left menu and Select “SSIDs”. How To Enable Cloud RADIUS Meraki Network Settings
  3. If you already have an existing network, click on “Edit settings” on the network you want to add RADIUS authentication to. If you don’t have a network, select “enabled” on the network you want to add RADIUS authentication to. (In this case, I am going to use the “Keytos Docs” network). How To Enable Cloud RADIUS Meraki Network Settings
  4. Next we are going to select “Enterprise with” in the “Security” menu and select “my RADIUS server” in the dropdown. How to Setup Cloud RADIUS Profile in Meraki Network
  5. Scroll down to the “RADIUS” section. You can keep the default settings for all the other sections or change them to your liking. How to Setup Cloud RADIUS Profile in Meraki Network
  6. Now click on the “Add Server” link. How to Setup Cloud RADIUS Profile in Meraki Network
  7. In another Tab, go to your EZRADIUS dashboard and copy the “Radsec URL” from the “Policies” page. How to Setup Cloud RADIUS Profile in Meraki Network
  8. Now we will go back to the Meraki Network Network Controller and paste the radsec url in the “Host IP or FQDN” field.
  9. In the “Port” field, enter “2083”.
  10. In the “Secret” field, we enter “radsec”.
  11. Click on “Done”. How to Setup Cloud RADIUS Profile in Meraki Network
  12. If you want to enable Accounting (It gives you more information about each session such as data used, connection time, etc.), you can do so by adding the same information. How to Setup Cloud RADIUS Profile in Meraki Network
  13. Scroll down to the “Advanced RADIUS section”
  14. If you have setup your EZRADIUS with Filter-ID or VLANs, you can setup the filter ID or VLAN in their respective fields.
  15. Enter the server timeout of 30 seconds
  16. Enter the “EAP Timeout” of 30 seconds.
  17. Enter the “EAP max retries” of 5 times.
  18. Enter the “EAP identity timeout” of 30 seconds.
  19. Enter the “EAP identity retries” of 5 times.
  20. Enter the “EAPOL key timeout” of 2000 milliseconds.
  21. Enter the “EAPOL key retries” of 5 times. How to Setup Cloud RADIUS Profile in Meraki Network
  22. Scroll to the bottom and click on “Save Changes”. How to Add RADIUS Server for Entra ID in Meraki Network

How to Create the RadSec Trust in Meraki

So right now we just setup the server, but we have not gotten the certificate from Meraki for our cloud RADIUS to trust your device (and we also have to add the server certificate so Meraki trusts the cloud RADIUS).

  1. We will go to the “Organization” menu and click on Certificates. How to Add RADIUS Server for Entra ID in Meraki Network
  2. On the top we need to add the RadSec CA Certificate, to do that we first must download the certificate from the cloud RADIUS dashboard.
  3. Go to your EZRADIUS dashboard and click on “Policies” and then Click the “Download RadSec CA Certificate” button. How to Add RADIUS Server for Entra ID in Meraki Network
  4. Now we will go back to the Meraki Tab and click on “Upload CA Certificate”. How to Add RADIUS Server for Entra ID in Meraki Network
  5. Now that we have uploaded the CA Certificate, we need to download the CA Certificate from Meraki (it gets automatically created and don’t worry it lasts 70 years so they are expecting we die before we have to renew it).
  6. Click on “Download CA” and save it to your computer. How to Add RADIUS Server for Entra ID in Meraki Network
  7. Now we will go back to the EZRADIUS tab and scroll down to your policy with Radsec enable and upload this certificate as a trusted RadSec Certificate.
  8. First change the certificate source to “Local CA”
  9. Click on “Upload Certificate” and select the CA Certificate you downloaded from Meraki. How to Add RADIUS Server for Entra ID in Meraki Network
  10. Scroll to the top of the policy and click on “Save Changes”. How to Add RADIUS Server for Entra ID in Meraki Network
  11. Now we have setup the RadSec trust between Meraki and EZRADIUS, you can now connect your devices to the network using certificate authentication.

How to test Wifi Certificate Authentication in Meraki Network

Now that we have setup the RADIUS authentication in your Meraki Network, we recommend manually testing the authentication to make sure everything is working as expected before dealing with Intune or any other MDM. If you are using EZCA, first you will want to enable self service certificates and manually create a certificate, once you have created the certificate and installed it in your user store, you can test the wifi authentication using the certificate.

How to Troubleshoot Certificate Authentication in EZRADIUS

The best way to troubleshoot certificate authentication in EZRADIUS is to check the logs. You can do this by going to the “Audit Logs” page in your EZRADIUS dashboard and filtering the logs by the user you are trying to authenticate. You can read more troubleshooting tips in our troubleshooting guide.

How to Connect Devices to Meraki Network with Entra ID Certificate Authentication

Now that you have setup your Meraki Network with RADIUS authentication, now you can distribute your certificates using Intune and automatically authenticate your users to the network. If you are not using certificates, you can follow this guide to setup your devices to authenticate with their Entra ID username and password.

How to Setup RADIUS Authentication for Wired Ethernet Authentication in Meraki Network

At the time of writing of this documentation, Meraki does not support RadSec for wired ethernet authentication. Please use the standard RADIUS protocol for wired ethernet authentication.