cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

2159
Views
5
Helpful
5
Replies
CB90021204
Beginner

Cisco Meraki MAB - Radius "Call-Check" Field not being sent

Hello, not sure if this is the right place to ask this question. I'm trying to implement MAB authentication using Meraki Wireless and Cisco ISE. The Meraki AP isn't sending the "Call-check" field in the radius attributes therefore can't match MAB auth in my policy set.

 

I've logged a Meraki TAC case about this also. Has anyone come across this before. Did you need to implement a workaround, if so how did you go about it?

 

Thanks,

 

Below are the radius attributes being sent by the Meraki AP to ISE:

 

RADIUS Protocol
    Code: Access-Request (1)
    Packet identifier: 0x0 (0)
    Length: 250
    Authenticator: xxxxxxxxxxxxxxxxxxxxxxx
    Attribute Value Pairs
        AVP: l=14 t=User-Name(1): xxxxxxxxxxxxxx
        AVP: l=18 t=User-Password(2): Encrypted
        AVP: l=6 t=NAS-IP-Address(4): xx.xx.xx.xx
        AVP: l=27 t=Called-Station-Id(30): MAC Address:SSID
        AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19)
        AVP: l=34 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=40 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=24 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=19 t=Calling-Station-Id(31): MAC Address
        AVP: l=24 t=Connect-Info(77): CONNECT 11Mbps 802.11b
        AVP: l=18 t=Message-Authenticator(80): xxxxxxxxxxxxxxxxxxxxxxx

3 ACCEPTED SOLUTIONS

Accepted Solutions
pan
Cisco Employee
Cisco Employee

ISE and meraki integration is documented here
http://cs.co/ise-guest

View solution in original post

Thanks for your help everyone. @Jason Kunst that link was perfect. 

 

Just to close this off, Meraki does send the “Service Type” radius field. It started sending after I enabled “Cisco Identity Services Engine (ISE) Authentication for Splash Page” in the SSID settings.

View solution in original post

5 REPLIES 5
CB90021204
Beginner

Just got confirmation that RADIUS "Service-Type (6)" Attribute in Access-Request packets isn’t supported by Meraki. Will need to come up with a work around. 

pan
Cisco Employee
Cisco Employee

One other bit of useless information, we have multiple PSNs in pairs in each global region. Our Meraki devices use the regional pair nearest to them as defined in a template per region for AAA. But any of the PSNs can issue a CoA to the Meraki devices. On our Cisco switches we have a dynamic auth block that lists all the global PSNs but the Meraki portal does not have an option for this. It will only accept CoAs from the PSNs defined for AAA in the template so there's a small chance you will get an alert in ISE that the CoA failed - unless you list all the PSNs in the portal for AAA - of which any could be used although they are geographically/latency far away. I have "wished for" a change to the Meraki portal to enable a CoA block where you can define multiple AAA servers just like we can for the Cisco switches.

JB.

ISE and meraki integration is documented here
http://cs.co/ise-guest

View solution in original post

Thanks for your help everyone. @Jason Kunst that link was perfect. 

 

Just to close this off, Meraki does send the “Service Type” radius field. It started sending after I enabled “Cisco Identity Services Engine (ISE) Authentication for Splash Page” in the SSID settings.

View solution in original post

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel