Access Point traffic encryption

[aravikumar]

Hello,

In Cisco WLC after version 8.3 the traffic can be encrypted at L2 by using a Pre-Shared key and this feature can be used for ISE guest portal. Could this be done using Meraki Access Points?

Thanks,

Aravind.

[chkemsle]

Not that I'm aware of but as the portal itself is recommended as using SSL and any credentials sent to said portal encapsulated within that encryption, what is the requirement driving the need for L2 encryption to ISE for guest portal services?

In most deployments both the AP IP's and Radius server are on the internal networks and therefore encryption isn't a requirement.

[aravikumar]

This is one of my customers concern. They dont want someone to sniff the traffic.

thanks,

Aravind,

[chkemsle]

A good way to prevent someone from sniffing the traffic would be to segment the network the AP's sit in from the one users attach to on the wire. Simple ACL or firewall rules would prevent users from being able to sniff anything on the management vlan. If it's a concern over sniffing the air - the portal is no different security wise than what people put credit card transactions on with SSL.

If they must have AP to ISE traffic double encrypted (Radius MD5 Hash plus another) they could use a Cisco-Meraki MX and tunnel all AP traffic to it, then from it to ISE would be the only single encryption. The MX could sit in the same data center as the ISE server.

[Philip D'Ath]

If they are worried about the RADIUS traffic being sniffed then they should use PEAP, EAP-TLS or EAP-TTLS to protect the authentication. I would not be sending authentication details over clear text.

I don't see much point in adding another layer encryption over the top again.

[Philip D'Ath]

Specifically - what traffic are you referring to?

All traffic to and from the Meraki cloud is encrypted.

Are you referring to client traffic being bridged to the local LAN? In which case, why can't the local LAN be trusted?

If you are wanting to securely tunnel traffic to a perimeter network then you could consider using an MX, and have the AP send the traffic over a VPN.

https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide#SSID_Tunneling_to_an_MX_VPN_Concentrator

[PQR]

Hi @Philip D'Ath

Is there any way that the data traffic from the AP to the client is encrypted?

[Philip D'Ath]

Anything using WPA2 will result in the traffic being encrypted between the AP and client.