Log in to the Cisco Meraki Dashboard
Configure Hotspot 2.0
Set up site identifier and secure RADIUS connection
Create an SSID
Set SSID and RADIUS service options
Enable SSID
Configure Hotspot 2.0
Troubleshoot the Cisco Meraki configuration
RCOI and EAP settings
EAP-AKA + Credential SIM Authentication Methods
RADIUS service
Configure Cisco Meraki wireless LAN controller
This guide describes how to set up and test your Cisco Meraki environment so you can use it with radsecproxy and Orion WiFi:
Log in to the Cisco Meraki Dashboard
Begin the configuration process by logging in to the Cisco Meraki Dashboard as admin. For existing environments with additional users, log in as a user with administrative privileges.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhBZDh52FT8aUJVf4ZaAOD0X64t5HOu3PNzEfcAOwB9MVFAJehwZnpjnqHu51FPXAp24e3NfI_XEslcco_TClSCFTQPsNFcTJlCNsvYKDWPEgYD40JXRziPjzl1tKXzzdYlA2TmaRsoKrfAwg_jpdbLMtsEffph6Zg)
The Cisco Meraki Dashboard appears.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkh6MngEbjeW6T1TP1vYz4u83bj3VElRBQ1luW0PWHLdHce6NlwDhGRCBSo7hu_JbW_fpiTcTIj1t8j0tz3q28p7W4mhANhVUVT-HYSEJ_XHhBrsK1VPbH1GUtg9MwPvCsYGAai-pOmw_BKriidcz64kTxCYLo5uFFUkQA)
Configure Hotspot 2.0
After contacting support to enable ‘Orion WiFi and Hotspot 2.0’ You will now see ‘Hotspot 2.0 in your Wireless > Configure Menu on the Cisco Meraki Dashboard.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkg22J7aebk7SdsPSv6PQGdMCgzB_ClyUP1dEjPd3p0WFKpaWlJubblmPDHv0e4L2T0kzvv3P_jVG2dEfNQPtlv2D2sXcBNukAAOZh-yNgaGKTuBGeuC6nG0RPfLArG-LH17NzDC0xbaOoDKW9udF6D0lyXAqhQlU7Us0Q)
You might need to log out and log back into the Cisco Meraki Dashboard to see that Hotspot 2.0 is enabled.
Set up site identifier and secure RADIUS connection
Secure RADIUS connection
It’s important to set up a secure RADIUS connection between the wireless LAN controller and Orion WiFi.
Orion WiFi uses RadSec (RADIUS over TLS) to ensure end-to-end encryption of AAA traffic. Because Cisco Meraki doesn’t natively support RadSec, AAA traffic is directed to a RadSec proxy (radsecproxy) before the traffic is sent over the internet.
Note: There are a number of options to set. Only the options that require your input are shown. Default values are used for options that don’t need adjustment.
Create an SSID
- Select Wireless > Configure > SSIDs from the Cisco Meraki Dashboard.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhT9mD9rf1vuJtyMoweDVBVGAMHioC1KgNk0ECOs-QPeZ0SrOsJxCXwr3VPzE0X2Hd0ExGeU8UDHpyKwbajVJK6InT-KsIfiVRtmoakNOfot9g4q87vGVUlJlqFOMDRpatv4jyfzAOqZjLjHuvn55w-H1hDI4WJR0A)
The Configuration overview page appears with a list of active SSIDs in the environment. (For readability, only 2 of the 4 are shown.)
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkikEJxY4mFShtOkF1slri0TNLu7XTggnopvr3zoCLEzfVTOqE5XYhrZ9J0w4umzPlWgAa2ilRmERiQk1lKq4HK_dtTP_uPGqQ9YdHpwKOIz9b3Fr60ACIR8KbtFGaAvE6mFPJR2-A9s1udQ-Y46n3Qv6wHHAsfHUq4)
- Click Show all my SSIDs at the top of the page to display all SSIDs.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkiqR1pWZtCnYyaCJnGdykpHfOpj9EyMW0GngndnQAHogQtggEecgcbUdAfWneeKy9g9Wa_jKFa-SCn6P2ST0_xa_p6sP5L3GObHRcsPXmLb0tgP83wKf1BxApEBKrfGd6xE7rGeX-_FrDS4WSMwHvv0vcHGcenrI0Juig)
A list of SSIDs appears, including existing as well as unconfigured SSIDs. (For readability, only 8 of the 15 are shown.)
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkg92nQoWY6LAX8p6UbqcohiFsCyFTIJ8CyXdq2zV89T0MOaD8vlmVLySGg6i34uiMdSrSJUnDPvBZR2Gpi5qMYCyDZQBaEtNqUUOTOA5rFuY_ZheZSCozkIFuH6FgzBG1RtTfLjJfj3K-9I0mQePyKV9aG4GAaKQgByNQ)
- Add a new Orion SSID in the first unconfigured SSID. In this example, the first unconfigured SSID is “Unconfigured SSID 7”.
- Click rename under Unconfigured SSID 7 and enter the name” Orion”.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkg_JUivJ0rsEOpkEIFMGmXJN9Mctkh-OnRw9ZGcXrLxT1KrWu4g5PdEBOp5Z42LRqwkkn90D9oloYL89sZzCGgoq9Y1J3sMZZ02VQSikzHi_SnhTUovNbJGLAq5JbGAz1gcH397trIAZxSW0FyraxfQfB_i5CTr4lE)
- Click Save Changes at the bottom of the page.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkgm-DDuqC7En3qcoJmYmYcc563qOH0Fr_qXUsNDPEgXmYIKAeqsVZhSL7w0WVQo4HCsOPeZdgLdfsak9XX53rG-VeryFw__GSphyTG36Zp7H5sEEvsEEJ53EmMQV6dXBbaHZgdrFCH6E-a0xwdV5c5F6hCKnJAX2c3Z7w)
If successful, a green box at the top of the page displays “Changes saved”.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkg3vPC_292CAY2Mvlv3q2oVcYNBFkFCi61EnWvM43zGsTjhDKLf_Ug4N5OtRWjSJgv9hn9yo2CfKhOx40KI3ujBOS-4cAJlE8ECxMFVNDPw4HqDz7T5cnCfICZpETG9iNHkY0o8DnQYddeMRVyZqeM-5rpC0hBAVoB_YA)
Set SSID and RADIUS service options
- Select Wireless > Configure > SSIDs from the Cisco Meraki Dashboard.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhT9mD9rf1vuJtyMoweDVBVGAMHioC1KgNk0ECOs-QPeZ0SrOsJxCXwr3VPzE0X2Hd0ExGeU8UDHpyKwbajVJK6InT-KsIfiVRtmoakNOfot9g4q87vGVUlJlqFOMDRpatv4jyfzAOqZjLjHuvn55w-H1hDI4WJR0A)
The Configuration overview page appears with a list of active SSIDs in the environment. (For readability, only 2 of the 4 are shown.)
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkiofRgZ_RpU-A139TSjMAkBKiX46_Orfri82LWd_qodgX7xsJ2DYClxBr719pbBFNGLh_3tX7l2jNRBYrm9SaM-YqoWEMQXjx1VzjKt6R8S4M6PrSa1kPOh7HzyUFVjoAcI6xst46zagEl--ZE3xfmyrUcU_Rmf52g)
- Under the Orion SSID, click edit settings.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjRubgWqj4exan1YoTcR3ji9VPhtUS8m6uOsD9FA_c71TbXEpwHbzB-TV6nlwmRC2QIATmho1dZI7_XkkBhejKmMU5DUGXbPSq4OI6OMp1Vc1mBwCAN6-tYHnlvHDcflnUF1WXnZrTEzjZm1MxS2qKrCwYTEIHEF-2uRg)
The Access control page appears that lists all the available configuration options.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjb9uOIxhDBN5MrWRlvHnYd2AOv5Y0Q4L4ABegTKpNfgT_QOsopFrcPEeHMTf8j4UwZu5GqaNrcgZXhCUevcftrMdFJW-8TgpYrksExUNUl3nnPwRs0-ADp8Nl4GnMuuPpH9vMl7hVch1DskQPlQH-30N3C5rokj3ujvA)
- Under Network Access > Association requirements, select Enterprise with Meraki Cloud Authentication. Change the pull-down option from Meraki Cloud Authentication to my RADIUS server.
Note: Each Cisco Meraki environment uses different settings based on the network setup. You need to change some of them to configure RADIUS.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkiN9Igi6ohVPcgVCeRYjPrBA8mPBbS_3lEghTlzceTmmOh1LgCHpPRI7Zf7K9jUv02BI3LleCsNJyAVhqIF09RS-J-yvTE5X28oeJ5jUH8ZbiPISiZlIt310Fa9r5jiXcVfrAWs_aF0CQritVYBEL8P5IJUnSND4wD8kA)
A message appears at the bottom right that indicates you have unsaved changes. You’ll save all changes later.
- Scroll down to Radius servers and click Add a server.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkgBQQo9GRzqdVH3cBePXcpIBckBHNkIQ8Tn2pGfe9VQg-Csfck0b-3b7JqMI3gwoKqekZW31_0KC26VOWHOEx2HdbJgiCpJbTafBkC1MLGvH2CUl6RKH0Kojb_XTO2fuWIwm4d0fEN-WB7p7yTE9zs9ClJuMJ7m5K_W8Q)
A new row of fields appears.
- Enter the RADIUS service values shown for the primary server.
Primary server RADIUS service values: authentication
Name | Description | Value |
Host | radsecproxy IP address
See Deploy and configure radsecproxy | IP address of your Radsec Proxy |
Port | Port for RADIUS authentication | 1812 (default) |
Secret | Secret key to use for radsecproxy | radsec |
- If you’re using a high availability (HA) configuration, click Add a server again to add your secondary RADIUS server. Enter the RADIUS service values shown for the secondary server.
Secondary server RADIUS service values: authentication
Name | Description | Value |
Host | radsecproxy IP address
See Deploy and configure radsecproxy | IP address of your Radsec Proxy |
Port | Port for RADIUS authentication | 1812 (default) |
Secret | Secret key to use to radsecproxy | radsec |
After entering RADIUS server values for authentication, RADIUS server information should look like this example.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkildsL6VfgANEwebX57Z6w_m2yb-0x8b_9uto4e9ZP5vtoQ4iqe9BGFzLyKhDP15uPxRpJ4ahDjH_iKJGZDE0ZkuJM4xca3Ke4Z6yug64J4vUO6DOc0UVr_c9z5o2baCAP0BgC2C6L-pQoe3GYq_IzKS2td0NQuzPAs5g)
- To the right of RADIUS accounting, change the pull-down value to RADIUS accounting is enabled. New headings appear for RADIUS accounting server information.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhuUrG6dm02jBVb1TNnboatnmSBJIF4U_1BjTweP-VvaJ6UCdH9t5hIhWNnFGQgJMjnfbxi1T-Uy6sbwVcrYg2ASuWj3CWzpNhmAgFUokoj3H3x3VGVLjSJ-XWqC4J06h-EYMmgM_9H0W-tmlsnqVhpRd_H6_ymscgKmw)
- Click Add a server. A new row of fields appear. Enter the RADIUS service values shown for the primary server.
Primary server RADIUS service values: accounting
Name | Description | Value |
Host | Private IP address of the radsecproxy VM instance | IP address of your Radsec Proxy |
Port | Port for RADIUS authentication | 1813 |
Secret | Secret key to use for radsecproxy | radsec |
- If you’re using a high availability (HA) configuration, click Add a server again to add your secondary RADIUS server. Enter the RADIUS service values shown for the secondary server.
Secondary server RADIUS service values: accounting
Name | Description | Value |
Host | Private IP address of the radsecproxy VM instance | IP address of your Radsec Proxy |
Port | Port for RADIUS authentication | 1813 |
Secret | Secret key to use for radsecproxy | radsec |
After entering RADIUS server values for accounting, RADIUS accounting server information should look like this example.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkgyOqaLgVweuKVwZsUyTfnT2flH32PQID8AMLgO8ham22ojOBO5oyK0T8MoVKWizZDfXs-KzOkfY5jUYDmqaPTjre6Xz7L-hq4gfuW1EZaz7Q7p-ns5umQJ6zgFJ8Xq5iFl-L0JcTnqFzduYv_uzKVQlGlw1Y--B6yx-w)
- If there are additional settings for your specific networking environment, such as client IP assignment or band selection, configure these options based on your local requirements.
- Click Save Changes at the bottom.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkimN9O9T_kRclycK4vIy9KgLy4PNsAUUkcWRlmCTW9WhlYzVMzbb67WuW9IEPDIM_8wQTr9vQeNKPKxTH0Fr-c9eYKNriO5q8bub83k3IvzaeTuKeAUvTg8HdXIQS5GfWy9xnQJ-F7wh3CDfD1In3C2Nm4v5IjrSkE)
A message appears at the top of the page indicating that your changes are saved.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhhVrpvY-a_rzMfdj5aSvk8hqZ53HfvzhlZJihnc4fuerlE1KG_riEvE02S9FORcDJ0RI9ZFfjGwrnhSU4p7M-XnOCuFg6uFWB1cj3mR0a5ghAP_8LMoh84yDeNIw_sCNWZqs3M2ecJYmeYRljsbiY_oWlDv2nkrwobwQ)
Enable SSID
- Select Wireless > Configure > SSIDs from the Cisco Meraki Dashboard.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhT9mD9rf1vuJtyMoweDVBVGAMHioC1KgNk0ECOs-QPeZ0SrOsJxCXwr3VPzE0X2Hd0ExGeU8UDHpyKwbajVJK6InT-KsIfiVRtmoakNOfot9g4q87vGVUlJlqFOMDRpatv4jyfzAOqZjLjHuvn55w-H1hDI4WJR0A)
The Configuration overview page appears with a list of active SSIDs in the environment. (For readability, only 2 of the 4 are shown.)
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkiofRgZ_RpU-A139TSjMAkBKiX46_Orfri82LWd_qodgX7xsJ2DYClxBr719pbBFNGLh_3tX7l2jNRBYrm9SaM-YqoWEMQXjx1VzjKt6R8S4M6PrSa1kPOh7HzyUFVjoAcI6xst46zagEl--ZE3xfmyrUcU_Rmf52g)
- Click Show all my SSIDs at the top of the page to display all SSIDs.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkiqR1pWZtCnYyaCJnGdykpHfOpj9EyMW0GngndnQAHogQtggEecgcbUdAfWneeKy9g9Wa_jKFa-SCn6P2ST0_xa_p6sP5L3GObHRcsPXmLb0tgP83wKf1BxApEBKrfGd6xE7rGeX-_FrDS4WSMwHvv0vcHGcenrI0Juig)
A list of SSIDs appears, including existing as well as unconfigured SSIDs. (For readability, only 8 of the 15 are shown.)
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjF48TA7kA73b2FPbMbwCPZDN0AFX7HixmiquHJrkvaCmO7HCFKye4zcwOL9U7up4DXRqgo6UICi71uiFv9dcRmF3qFoOEwYdtXoAmTbxqry5mbq-77F3N5Fq_vaEZbfFUVM_UOtquwxip4dSJW5D2gmuqxCtCyhRPG9Q)
- Under the Orion SSID, change the Enabled state from disabled to enabled. The column underneath the Orion SSID changes from grey to white indicating it’s enabled.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkik600ZvhEOD_wrPnuEH1WW_B1YQP5U_Zgc-yBmDNAx7DtIscXxMojOZVOyKRvjYXncYRcMEKOojd9JbEfT16vPE64fUzRsf9jwH78-WYYRODO7PSenV1l4C81KSxBvkj8xutyd4i5f6rJgjYzo_HpJpWvHgyk8j-AbtQ)
- Click Save Changes at the bottom of the page.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkhze6xmm50MywloRz8s5CzYGk_JivmVq4Zr36tkwhaqt8rhFdcrqacuD7cUX8V3GOcFHKrw72W4PGsZsJPdj9vnNcZ_vzQ46dNt9K77O7JnJokVbTf2wdGJRlP0qCWulf3T2ym5FOL9E6LofEx2f272NPid7UBREpUGvw)
Configure Hotspot 2.0
After the SSID and RADIUS options are set and the SSID is enabled, you configure Hotspot 2.0. Hotspot 2.0 allows mobile devices to join a WiFi network automatically, including during roaming, when the devices enter the Hotspot 2.0 area.
- From the Cisco Meraki Dashboard, select Wireless > Configure > Hotspot 2.0. The Hotspot 2.0 page appears.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjjc2eD5ZvhKy-VUMzCcdQMGj16RSWGpAIFcKNMtzOPSgSHGMYw-_Wd6OVU8Q1Vq27TtfjMoITYDeQYfWoPG01IvHXRAq3chwaKFAncEsVsMDSALNh8pb3wP2u46ZfoXT7a6viOLrNaENNjMqiOzTjri9KK5hm68y0)
- Verify that the SSID is set to “Orion” before continuing.
- Set Hotspot 2.0 to Enabled. This activates the rest of the fields on the page.
- Set the remaining options using these Hotspot 2.0 values.
Hotspot 2.0 values
Name | Description | Value |
Operator name | Name of the Hotspot 2.0 operator. | Orion |
Venue name | Name of the venue for the specific SSID, describing the site location. | A meaningful description of the venue.
Example: Shopping-Center_123-Main-Street_AnyCity_State_Zip-Code |
Venue type | Specific type of venue. | Select a pull-down value that best represents the venue type.
Example: Shopping Mall |
Network type | Type of network serving Hotspot 2.0. | Chargeable public network |
Domain list | Hotspot 2.0 operator's domain name. | orionwifi.com
|
Roaming Consortium OIs | Service provider’s identity in beacons and probe responses to clients. | F4F5E8F5F4 |
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkgcoRDYhK-BzpWX-ofnvCG2T_wPhtpBm-EjV34cPTkwke6HmS5xhOxzIbwvJH3ulsHDpTEeFkDBrVYpYMe3AfVm7sQ7CSm0o3AV_P-0q3fYhaqK0zC-Dxv9fMmDY24Z7ci19No2UrKUnYExH9QhLZFfhHP-AjjTce1VhA)
- Click Save Changes at the bottom.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjioiEEmQfj7YTpuRpnL-Uxqsm2o-FfUVpt5SRtXELL-yOUYGfv5-pbC1WmO9sSJuUdsA1bpQXiiPKNEqDj4vqm6DwZBy3t0j0hQVWTTwpBRgpHS-Ig5-pjWD_YkeW6LlbV2w_W_IfRy3TsEOwqmV10FqRub0DZjrNyHw)
A message appears at the top of the page indicating that your changes are saved.
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkjXHxVJFVcDMbmHEVlBZ49icLETO58Wl811LsY1sumQMgtW1C4BNTJd7kCTGbzAgFbQ8vEbqzSernDG0vyMtAwPQBaPDsIO4GFekVuPsX_2b0jNUG9SqQq_FLqbk2pbScWMP_-E43uwsGn9Baxl10MwE4m-P6CF-hRCqQ)
Troubleshoot the Cisco Meraki configuration
If you see errors or problems while installing and testing Cisco Meraki and VM instance configuration, here are some ways to validate the configuration and look for errors.
Most problems occur during setup. One way to test whether the setup is correct is to go through the steps again. Another is to look at the primary components of the SSID, RADIUS, and Hotspot 2.0 setup that directly impacts connectivity to radsecproxy and Orion WiFi.
RCOI and EAP settings
If the Roaming Consortium OI (RCOI) and EAP method aren’t set correctly, mobile devices can’t automatically connect (which is intended). If radsecproxy logs are showing an attempt to connect but failing, it means radsecproxy IP addresses are probably correct in the RADIUS Authentication and Accounting settings, but the EAP settings could be wrong.
- From the Cisco Meraki Dashboard, select Wireless > Configure > Hotspot 2.0 and select the Orion SSID.
- Verify that the Hotspot 2.0 values match those described in Configure Hotspot 2.0.
EAP-AKA + Credential SIM Authentication Methods
Another potential issue is the EAP method on the NAI Realm as part of the Hotspot 2.0 setup. It’s easy to miss setting the right Method ID or Authentication Method.
Some devices may either not attempt to auto-connect or fail to authenticate. This is due to the incorrect authentication type configuration.
- From the Cisco Meraki Dashboard, navigate to Wireless > Configure > Hotspot 2.0 and select the Orion SSID.
- From the NAI Realms list, click Orion-Realm. to review the Realm settings.
- Verify that the EAP method ID and authentication method:
Method ID—23 EAP-AKA Authentication
Authentication Method—SIM
![](https://lh7-rt.googleusercontent.com/docsd/ABcwRkgPBoTT_6LLnCQ96n_e2qnVo-bD8keqBrx6fEA0UKZW7fQRSRpHRrXmm8naOnXayHWSyi3LLupCrXw6syc3YfolDs7R_Ks3ff4v5-BhfKPMoooKCeMcZT2OFunWARxc20VDCxJ7kpdYm3ENXD77Fo9LGScuuTr4aAk)
- Click Update realm to save NAI Realm changes, and click Save Changes.
RADIUS service
If the IP addresses, ports, or secrets used for the primary and secondary servers are wrong, the RADIUS server can’t be contacted. In this situation, radsecproxy logs on the radsecproxy VM instance can’t be generated, because traffic isn’t passing to the wireless LAN controller from radsecproxy.
If no new logs are coming in, it means the Cisco Meraki SSID isn’t passing traffic to the VM instances running radsecproxy. If this is the case, you should check the RADIUS configuration.
- From the Cisco Meraki Dashboard, navigate to Wireless > Configure > Access control and select the Orion SSID.
- In the RADIUS servers list, verify the Host, Port and Secret values match the RADIUS service values for authentication and accounting in Set SSID and RADIUS service options.