Configure Cisco Meraki supported clients

Cisco Meraki supports multiple wireless clients, including MS Windows and Apple OSX clients. This guide describes configuring wireless client by supported device.

Before you begin

  • Ensure that you have the common UDP port and secret key values available.

Configure Apple macOS device

  1. Install and open Apple Configurator from the App Store on your Mac.
  2. Select File > New Profile.
  3. Select the General tab.
  4. Enter a Name for the profile (for example, Settings for Meraki wireless router).
  5. Select the Certificates tab.
  6. Click Configure and navigate to a directory that contains a valid root certificate.
  7. Add your root certificate.
  8. Select the Wi-Fi tab. Enter values appropriate for your environment.
  9. In the Trust tab within the Wi-Fi section, select the root certificate you previously added as a Trusted Certificate.
  10. Select File > Save and save the file with a .mobileconfig extension. If the Profile has an error message is displayed, ignore the message and select Save Anyway.
  11. Add the 802.1X Wifi user profile to your system.
    1. Select Profiles from System Preferences
    2. Choose the + sign to add the Wifi Profile you selected previously.

  12. Connect to your network using the Network panel in System Preferences. Successful logins appear in the Meraki events log.

When an AD or Okta password is updated, the user isn't prompted by macOS to update the password for the Wi-Fi connection. Instead, macOS continues to try to connect using the previous password, which can result in an account lockout.

Configure Apple iOS device

  1. Install and open Apple Configurator from the App Store on your Mac.
  2. Select File > New Profile.
  3. Select the General tab.
  4. Enter a Name for the profile (for example, Settings for Meraki wireless router).
  5. Select the Certificates tab.
  6. Click Configure and navigate to a directory that contains a valid root certificate.
  7. Add your root certificate.
  8. In the Wi-Fi tab, enter values appropriate for your environment.
  9. In the Trust tab within the Wi-Fi section, choose to trust the root certificate you previously added.
  10. Select File > Save and save the file with a .mobileconfig extension. If any error occurs, select Save Anyway.
  11. Connect your iOS device to the Mac using a USB cable. The device appears in the All Devices view in Apple Configurator.
  12. From the All Devices view, right-click your device and choose the option to add a profile. Select the profile you previously created and follow the prompts on your Mac and mobile device.

  13. Connect to the Wi-fi network.

Configure Android device

  1. Install EAP-TTLS root certificate
    1. Copy the certificate onto your Android device using a USB connected to your laptop or other means.
    2. On the device, navigate to Settings > Security & location > Advanced > Encryption & credentials.
    3. Under Credential Storage, tap the option to Install from device storage.
    4. Navigate to the location of the saved certificate.
    5. Tap the file.
    6. Enter a name for the certificate and choose Wi-Fi.
    7. Tap OK.
  2. Open your Wi-Fi settings and click on the SSID you want to connect to. If it's not visible, choose the option to Add network and enter your network SSID name and set the Security type to 802.1x EAP.
  3. Set the following options:
    FieldValue
    EAP MethodsTTLS
    CA certificationChoose the just installed certificate
    IdentityYour Okta username
    PasswordYour Okta password/MFA

    Advanced

    Under advanced set the following:

    • Phase 2 authentication: PAP
    • Anonymous identity: This value is the user's unencrypted identity outside the TLS tunnel. Since the RADIUS agent does not use this currently, you can enter any random value.

The device should now be able to connect to the Wi-Fi network.

Windows 10 device

  1. Navigate to the Network and Sharing Center and choose to Set up a new connection or network and then click Next.
  2. Choose Manually connect to a wireless network, then click Next.
  3. Enter the SSID of your wireless network as the Network name.
  4. Choose WPA2-Enterprise for the security type.
  5. Click Next.
  6. Click Change connection settings.
  7. Select the Security tab.
  8. Change the network authentication method to Microsoft: EAP-TTLS.
  9. Click Settings.
  10. In the TTLS Properties page, use the following settings:
    SettingValue
    Enable identity privacyanonymous
    Trusted Root Certification Authorities

    Select the root certificate used to sign the customer EAP-TTLS server certificate. For example:

    USERTrust RSA Certification Authority root certificate

    Within Client authenticationChoose Select a non-EAP method for authentication under Client authentication. Choose Unencrypted password (PAP) from the dropdown list of authentication methods.
  11. Return to the Network Properties dialog and click Advanced settings.
  12. Select Specify authentication mode. Choose User authentication from the dropdown list. Click OK.
  13. Connect to your RADIUS enabled SSID.