topic Re: Meraki enterprise with local auth + SCEPman + AAD in Wireless

Meraki enterprise with local auth + SCEPman + AAD

Kyote — Tue, 26 Nov 2024 14:16:40 GMT

Hey guys,

I'm attempting to set up certificate-based authentication using the SCEPman CA, and Meraki local auth. I haven't been able to find a guide specifically using SCEPman. Has anyone accomplished this and would be willing to share how they did it?

Thanks!

Re: Meraki enterprise with local auth + SCEPman + AAD

joey.debra — Tue, 26 Nov 2024 19:00:44 GMT

We are using SCEPman in our org. However we don't use the local auth on the Meraki side but we are using Radius-as-a-service in combination with SCEPman. So the AP's can do radius to the service which in turn trusts the certs signed by SCEPman.

This has been working fine for over a year now.

Re: Meraki enterprise with local auth + SCEPman + AAD

jameshammy — Tue, 04 Mar 2025 11:16:41 GMT

I'm pretty sure it's as simple as setting up SCEPman following their decent documentation. After that, you can simply enable the 'RADIUS local auth' option, choose certificate based authentication, tick a couple more boxes and then upload SCEPman's Root CA certificate in PEM format.

Then configure your endpoints to connect to that wifi network using certificate-based authentication.

@joey.debra 's setup is more comprehensive as it also uses a cloud-based RADIUS service that you could use for a load of other stuff but what I've suggested is very simple and apparently works well for simple and secure wifi access. I will be looking to implement something similar before long, so I can retire our internal NPS server.

Re: Meraki enterprise with local auth + SCEPman + AAD

Kyote — Tue, 04 Mar 2025 13:27:17 GMT

i've had this implemented for a while now. Curious to hear what other things you are using SCEPman certs for 👀

Re: Meraki enterprise with local auth + SCEPman + AAD

jameshammy — Tue, 04 Mar 2025 13:48:00 GMT

All working ok for you?

We've not even onboarded SCEPman yet so we're still using on-premise Microsoft Root CA with NPS and GPO settings to deploy wifi securely. Just like everyone else though, we're looking to offload as much as possible to O365/InTune to remove dependency on on-premise.