topic Re: Authentication Method in Wireless

Authentication Method

Ahmed900 — Sat, 22 Feb 2025 15:36:34 GMT

Hi all
I'm new to cisco Meraki and I'm using MR55 device
The thing is I have my network called Corporate and I want my staff to use the network normally with their laptop,
but if they managed to know the password and try to use it with their phone, I want them to authenticate in a splash page for example with different password.

Can someone guide me on this

Thanks

Re: Authentication Method

Karsten Iwen — Sat, 22 Feb 2025 16:33:34 GMT

I assume you won't achive this reliably with the build in tools.

One option worth a test is to have two group policies in the WLAN, one default without splash page and one with a splash page. The later gets assigned based on the end device:

For the "if they managed to know the password":

Normally the users can always find out the passphrase. This is only forbidden when the WLAN profile is pushed with an MDM like Meraki Systems Manager.

Re: Authentication Method

MerakiGnome — Sat, 22 Feb 2025 21:18:53 GMT

Something tells me here no matter which way they authenticate they’re going to end up on your corporate network.

How is your internal network segmented?

Re: Authentication Method

Philip D'Ath — Sun, 23 Feb 2025 18:55:00 GMT

Can we take a step back - what are you trying to achieve?

The end result (from above) is that both corporate and personal devices will have access to the same network.

What do you gain by making people enter two passwords from a personal device?

Re: Authentication Method

sinelnyyk1 — Mon, 24 Feb 2025 11:11:34 GMT

Hi @Ahmed900,

I agree with @Philip D'Ath, at first its important to understand what you're trying to achieve.

With this said, I think you can use the setup with PSK and Sign-on splash page, and in the dashboard settings you can put the laptops into a white list manually, and in this case these clients won't need to go through splash authentication. And if users try to enter connect to the SSID from their phone knowing the PSK, they will be met with the splash page. This method, however, don't prevent them from connecting if they know the password for the splash page. Something similar is outlined in this KB.

I believe the best way to go here if you want to restrict access from phones would be some sort of MAC address-based, or cert-based authentication.

Re: Authentication Method

BlakeRichardson — Mon, 24 Feb 2025 19:47:50 GMT

You would probably be better using 802.1x and applying group policies to the different device types i.e. BYOD and company owned.

Re: Authentication Method

Ahmed900 — Tue, 25 Feb 2025 11:37:39 GMT

Hi @Philip D'Ath
What I'm trying to achieve is for the network to be accessible for laptops only,

my point is when a user connects via Organization Laptops it should connect normally,
but if he trying to connect with his phone, it should not connect that's why I'm searching for other solution to forbid Connecting with phone in the splash page configuration

Re: Authentication Method

Karsten Iwen — Tue, 25 Feb 2025 11:41:49 GMT

Then the solution is 802.1X with EAP-TLS as already mentioned. Every company device is enrolled with a certificate that is not exportable on the end device and only these devices are allowed to authenticate. Or, all other devices that don't authenticate through a certificate get the "only-Internet" VLAN assigned.

Re: Authentication Method

Ahmed900 — Tue, 25 Feb 2025 11:42:33 GMT

Hi @sinelnyyk1
both solutions sound good for me I will read more about it

Thanks

Re: Authentication Method

Philip D'Ath — Tue, 25 Feb 2025 22:25:02 GMT

I second this. Configure something like Microsoft Certificate Server (part of Windows Server) and a group policy to deploy a certificate to every AD member, and then use that for authentication.

Once you have the certificate deployment done, here is a walk through for the NPS configuration required.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Creating_a_Policy_in_NPS_to_support_EAP-TLS_authentication

Except skip the entire first section on "Connection Request Policies.". This section does absolutely nothing. Whoever wrote that didn't know what connection request policies do.