cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3655
Views
5
Helpful
5
Replies

Cisco Meraki MAB - Radius "Call-Check" Field not being sent

CB90021204
Level 1
Level 1

Hello, not sure if this is the right place to ask this question. I'm trying to implement MAB authentication using Meraki Wireless and Cisco ISE. The Meraki AP isn't sending the "Call-check" field in the radius attributes therefore can't match MAB auth in my policy set.

 

I've logged a Meraki TAC case about this also. Has anyone come across this before. Did you need to implement a workaround, if so how did you go about it?

 

Thanks,

 

Below are the radius attributes being sent by the Meraki AP to ISE:

 

RADIUS Protocol
    Code: Access-Request (1)
    Packet identifier: 0x0 (0)
    Length: 250
    Authenticator: xxxxxxxxxxxxxxxxxxxxxxx
    Attribute Value Pairs
        AVP: l=14 t=User-Name(1): xxxxxxxxxxxxxx
        AVP: l=18 t=User-Password(2): Encrypted
        AVP: l=6 t=NAS-IP-Address(4): xx.xx.xx.xx
        AVP: l=27 t=Called-Station-Id(30): MAC Address:SSID
        AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19)
        AVP: l=34 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=40 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=24 t=Vendor-Specific(26) v=Meraki Networks, Inc.(29671)
        AVP: l=19 t=Calling-Station-Id(31): MAC Address
        AVP: l=24 t=Connect-Info(77): CONNECT 11Mbps 802.11b
        AVP: l=18 t=Message-Authenticator(80): xxxxxxxxxxxxxxxxxxxxxxx

3 Accepted Solutions

Accepted Solutions

pan
Cisco Employee
Cisco Employee

ISE and meraki integration is documented here
http://cs.co/ise-guest

View solution in original post

Thanks for your help everyone. @Jason Kunst that link was perfect. 

 

Just to close this off, Meraki does send the “Service Type” radius field. It started sending after I enabled “Cisco Identity Services Engine (ISE) Authentication for Splash Page” in the SSID settings.

View solution in original post

5 Replies 5

CB90021204
Level 1
Level 1

Just got confirmation that RADIUS "Service-Type (6)" Attribute in Access-Request packets isn’t supported by Meraki. Will need to come up with a work around. 

pan
Cisco Employee
Cisco Employee

May be following can help.

 

Enabling ISE splash setting on meraki

 

 https://community.cisco.com/t5/security-documents/how-to-integrate-meraki-networks-with-ise/ta-p/3618650

 

splash meraki2.png

One other bit of useless information, we have multiple PSNs in pairs in each global region. Our Meraki devices use the regional pair nearest to them as defined in a template per region for AAA. But any of the PSNs can issue a CoA to the Meraki devices. On our Cisco switches we have a dynamic auth block that lists all the global PSNs but the Meraki portal does not have an option for this. It will only accept CoAs from the PSNs defined for AAA in the template so there's a small chance you will get an alert in ISE that the CoA failed - unless you list all the PSNs in the portal for AAA - of which any could be used although they are geographically/latency far away. I have "wished for" a change to the Meraki portal to enable a CoA block where you can define multiple AAA servers just like we can for the Cisco switches.

JB.

ISE and meraki integration is documented here
http://cs.co/ise-guest

Thanks for your help everyone. @Jason Kunst that link was perfect. 

 

Just to close this off, Meraki does send the “Service Type” radius field. It started sending after I enabled “Cisco Identity Services Engine (ISE) Authentication for Splash Page” in the SSID settings.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: