# Meraki

{% hint style="info" %}
To use the RadSec feature on your Meraki APs, firmware version **MR 30.X** or later is required.
{% endhint %}

{% hint style="warning" %}
Customers have reported **delays** between activating the RadSec feature on the Meraki Dashboard and becoming functional.
{% endhint %}

## Prepare certificates

{% hint style="warning" %}
The Meraki platform does not allow you to generate RadSec client certificates from a CA of your choice. Instead, you must use Meraki's built-in **Organization CA** that is unique to your Meraki Organization.
{% endhint %}

Download the root certificate of the CA that has issued your active **RADIUS Server Certificate** as described [here](https://docs.radiusaas.com/admin-portal/settings/settings-server#download). You will need to upload it to your Meraki console later on.

## Meraki configuration

{% hint style="info" %}
Below settings are the necessary settings to establish a functional RadSec connection with our service. Configure any other settings at your discretion.
{% endhint %}

{% hint style="danger" %}
Ensure to **disable the OCSP revocation check of the RadSec client certificate** as described in step 7 of this guide.
{% endhint %}

{% stepper %}
{% step %}

### Navigate to your Meraki Dashboard

In your Dashboard, select **Wireless > Access Control** and ensure that you have switched to the **new UI version** of the Access control site:

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FRLtKMdY5l834M4uMHJVj%2Fimage.png?alt=media&#x26;token=87edbda0-9b7b-4c58-a01e-bd453d64508a" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Configure the RADIUS server in your SSID

Select the **SSID** you wish to configure RADIUS authentication for (or navigate to **Wireless > Configure > SSIDs** to create a new SSID first).

In the **Security** section of your SSID, select **Enterprise with** and in the dropdown **my RADIUS server:**

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2Fb8hH0TiSFyw8OZZk8aVe%2Fimage.png?alt=media&#x26;token=c2fd9336-241e-4218-9e9d-8a5fff74c3e8" alt=""><figcaption></figcaption></figure>

Under **RADIUS**, click **Add server**. Configure the **Host IP or FQDN** to match the IP address or the DNS name of your [RadSec service endpoint](https://docs.radiusaas.com/admin-portal/settings/settings-server#properties), set the **Port** to 2083 and  set the **Secret** value to "radsec" and activate the **RadSec** checkbox.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FMkeCViLn8C95RiSmIsE0%2Fimage.png?alt=media&#x26;token=2fb4e901-181c-4473-a756-d81f4388ba49" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Configure EAP Timeouts

Configure **EAP parameters and timeouts** according to [this](https://docs.radiusaas.com/other/faqs/general#timers-and-timeouts) reference guide by going to **Wireless** > **Radius** > **Advanced RADIUS settings.** Once configured, it should look similar to the screenshot below. Click **Save** to apply the settings.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FIuwGhJid3FL2ZE2IMk3h%2Fimage.png?alt=media&#x26;token=0424909c-efac-47a5-9de4-19df7888093f" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Add RadSec Server Certificate

To upload and generate the required certificates that make the RadSec connection functional, navigate to **Organization > Certificates**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FEnApli3g02jjWf3A0Lvj%2Fimage.png?alt=media&#x26;token=dd4a25d2-624a-40ad-9fc5-2f41100f5048" alt=""><figcaption></figcaption></figure>

In the top table, click **Upload certificate** and provide the root certificate of the CA that has signed your [**RADIUS Server Certificate**](https://docs.radiusaas.com/admin-portal/settings/settings-server#server-certificates), which you should have already downloaded in this [step](#prepare-certificates). Your Meraki APs now trust your RADIUS server.

{% tabs %}
{% tab title="Using RADIUSaaS Customer CA" %}

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FFfga4e3H0BKEuIzbS4MG%2Fimage.png?alt=media&#x26;token=db6ac7f5-f512-4fa7-9b93-27430e4a4134" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Using SCEPman or other CA" %}

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FAIFj3wJN6WMVCI1ad7me%2Fimage.png?alt=media&#x26;token=fdd8cf45-fd1c-4cb3-9da5-b9c063a895d5" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

### Create Organization CA

Under **RadSec AP Certificates**, first create an **Organization CA** by clicking **Generate CA**. This CA is unique to your Meraki Organization.\
The Meraki platform will now automatically generate RadSec client certificates for all your APs signed by this CA. The lifetime of the certificate is very long (> 50 years), i.e. you do not have to worry about renewing them.

Download the root CA certificate of your **Organization CA** of your Meraki system by clicking **Download CA**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FgHVrdMMnAxTNMoF4xmr6%2Fimage.png?alt=media&#x26;token=567161a7-67ec-4b4c-9320-3b23152718c7" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
You will not be able to upload RadSec client certificates of another CA with Meraki. Instead the Organization CA, which is unique to your organization, will provide all your access points with suitable certificates.
{% endhint %}
{% endstep %}

{% step %}

### Trust Organization CA in RADIUSaaS

Now, upload the downloaded CA certificate to your [Trusted Certificates in your RADIUSaaS web console](https://docs.radiusaas.com/admin-portal/settings/trusted-roots#add) and select **RadSec** under **Use for**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F7nWmyyegri5KupEslWdo%2Fimage.png?alt=media&#x26;token=3f36a44b-6e97-406d-b5fe-e05886377392" alt=""><figcaption></figcaption></figure>

{% endstep %}

{% step %}

### Disable Revocation Check for RadSec Certificates

Finally, disable the [revocation check for the RadSec client certificates](https://docs.radiusaas.com/admin-portal/settings/settings-server#verification-check-for-radsec-certificates) on your RADIUSaaS instance (this does not adversely affect security as the Meraki Organization CA does not allow to revoke RadSec client certificates). Therefore, navigating to your RADIUSaaS instance and then **Settings > Server Settings** and disable the checkbox **Verification check for RadSec certificates**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2Fx2AwP1KBglH14xdrsSe5%2Fimage.png?alt=media&#x26;token=4b8b0f19-14f1-4f92-8a13-224669559ace" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Test Configuration

To test that the configuration works, you can add a user in your [Portal](https://docs.radiusaas.com/admin-portal/users#add-a-new-user) and use the Meraki test function.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FmMlZKcqr82x0TpYbZ9j0%2Fimage.png?alt=media&#x26;token=468075bf-21b9-4e37-9da2-9972739f4917" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

### References

Link to Meraki's documentation for the RadSec configuration: <https://documentation.meraki.com/MR/Encryption_and_Authentication/MR_RADSec>