topic Re: WiFi access in Endpoint Security

WiFi access

Adrian41 — Wed, 28 Feb 2024 15:01:04 GMT

Hello,

I am looking at improving the way end user devices connect to our internal wifi (laptops, phones, pcs etc).

I want to use a Certificate based system like EAP-TLS, however I am not sure how a brand new device would be able to get its certificate from the CA since it needs a cert to get onto wifi to contact the CA lol.

I am in the process of trying to get management to buy systems manager for us and wondered if this is something else it could do for us.

At first I wondered if it could somehow deploy the certificate before the machine joins the domain/network but then I wondered if all that would even be necessary - does systems manager have its own set of tools for managing network access?

Thanks!

Re: WiFi access

aleabrahao — Wed, 28 Feb 2024 15:29:17 GMT

Yes, you will need to install an agent on each device.

https://documentation.meraki.com/SM/Systems_Manager_Quick-Start

Re: WiFi access

Adrian41 — Wed, 28 Feb 2024 16:28:36 GMT

thanks for the link, thats very helpful!

does System Manager require a fully Meraki hardware environment? We have some sites that are all meraki but some still use older non Meraki switches (tho I'm sure we are fully Meraki when it comes to Access Points).

Re: WiFi access

aleabrahao — Wed, 28 Feb 2024 16:37:45 GMT

The limitation will actually be the supported client devices.

https://meraki.cisco.com/product-collateral/systems-manager-datasheet/?file

Re: WiFi access

Adrian41 — Wed, 28 Feb 2024 16:43:07 GMT

it just seems to talk about how well it integrates with other Meraki Networking products.

What if you dont have any meraki Hardware? Can it still be used as a standalone solution?

Re: WiFi access

GreenMan — Wed, 28 Feb 2024 16:43:30 GMT

As much as most customers find the big advantages with Meraki coming from using multiple products (in your use case, mainly MR and SM - because you can then use SM Sentry: https://documentation.meraki.com/SM/Deployment_Guides/Systems_Manager_Sentry_Overview)

There are plenty of customers out there who only use SM, from the Meraki portfolio; you can still provision wifi profiles and certicates to your managed devices, it's just not nearly as easy to set up and integrated as with Sentry WiFi.

Re: WiFi access

Adrian41 — Wed, 28 Feb 2024 16:45:14 GMT

thanks very much!

Re: WiFi access

Philip D'Ath — Wed, 28 Feb 2024 19:56:14 GMT

Initial provisioning can be done with a wired connection or a provisioning SSID.

Note you can only use a single MDM on a device.

Microsoft Intune has recently released an interesting option, Cloud PKI. This should work with "Local Auth" certificate authentication on the MRs (disable passwords for this configuration).

https://www.microsoft.com/en-us/security/business/endpoint-management/microsoft-cloud-pki

https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Local_Authentication_-_MR_802.1X#Certificate_Caching_(Certificate_Auth)

Re: WiFi access

gary5555 — Wed, 20 Aug 2025 23:37:06 GMT

Check out this solution

Meraki access manager + cloud pki

https://www.hypershift.com/blog/meraki-intune-cloud-pki

Re: WiFi access

Adrian41 — Thu, 21 Aug 2025 07:31:14 GMT

very exciting!

although that guide, and what i can see in dashboard seems to be that its only for use with a cloud CA? rather than that just being an option.

atm I'd like to just get it to handle radius for us and use our on-prem certificate server to handle Windows clients requests.

I would like to bring Intune and SCEP later for mobile devices but they would still be using our on-prem server...but thats a later thing.