IPERA Starling - Cisco Meraki Integration

Purpose

This guide shows how to configure Cisco Systems Meraki Controllers in the "Controller-AP" architecture, to use each Access Point as a Hotspot. 

Please use the latest IP Address and other parameters under the “Parameters for Configuration” section. The information in screenshots displayed in the document may not be updated.

To use a Cisco Meraki Networks device as a Hotspot, the Access Points must be connected to the Internet. You must access the Meraki Cloud controller through the Meraki Admin Control panel through the web interface.

Cisco Meraki Controllers Configuration Steps:

This article applies to all Cisco Meraki controllers. Following are the Meraki Models that this configuration will be applicable.

• MR 16
• MR 18
• MR 32
• MR 33
• MR 34
• MR 36
• MR 42
• MR 44
• MR 66
• MR 72
• MR 74
  
   

To correctly integrate a Cisco Meraki controller with the Solution, it is necessary that the AP:

• is connected to the Internet
• is reachable in the network

Access Control Configuration

Login to Dashboard and navigate to Wireless > SSIDs

Click Show all my SSIDs to see both enabled and disabled SSIDs

Rename the SSID you want to configure

Enable the SSID you want to configure

Click Save

Navigate to Wireless > Access control

Select the SSID you want to configure from the SSID drop-down.

Under “Network access > Association requirements”, select Open (no encryption)

Under “Splash page”, select Sign-on with > my RADIUS server

Click Add a server and then select RADIUS accounting is enabled

**Note: If you cannot see the “Radius Accounting” section, open a case to Meraki Support to enable it.

Enter RADIUS details as shown below

Under “Enable data-carrier detect?”, select DCD is disabled

Under “Captive portal strength”, select Block all my access until sign-on is complete

Under “Walled garden”, select Walled garden is enabled and add following items to the walled garden ranges. 

In addition to those, you will need to define your company website domain also for the Splash Portal External link to work during pre-authorization stage. 

It is mandatory to add the following domains to ACL

• engage.iperawifi.com
• static.iperawifi.com

If you wish to support social network logins, you need to add rules for domains below for each network you plan to support

Microsoft 365 (*)	login.microsoftonline.com	Google	accounts.google.com
	aadcdn.msauth.net		www.google.com
	login.live.com		fonts.gstatic.com
	akamaihd.net		play.google.com
	aadcdn.msftauth.net		ssl.gstatic.com
Facebook	www.facebook.com		accounts.youtube.com
	www.facebook.net		accounts.google.com
	static.xx.fbcdn.net	TikTok (**)	*.tiktok.com
Twitter	api.twitter.com		firebaseinstallations.googleapis.com
	abs-0.twimg.com		storage.googleapis.com
	pbs.twimg.com		*.ibytedtos.com
LinkedIn	www.linkedin.com		*.tiktokv.com
	static.licdn.com		open-api.tiktok.com
	media.licdn.com		www.tiktok.com
	ponf.linkedin.com		*.ttwstatic.com
	platform.linkedin.com		*.tiktokcdn.com
Apple	www.apple.com
	appleid.apple.com
	appleid.cdn-apple.com
	is4-ssl.mzstatic.com

(*) Please refer to the below URL if you wish to use Microsoft login method 
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/review-admin-consent-requests 

(**) Google, Facebook, Twitter, and Apple should be also added for TikTok 

Click Save Changes

Enabling Custom Splash

Navigate to Wireless > Splash page

Select the SSID you want to configure from the SSID drop-down

Under “Custom splash URL”, select Or provide a URL where users will be redirected and then enter the server URL

For where users should go after the splash page, select A different URL option and enter the server URL

Click Save Changes

Parameters for the Configuration

For AWS:

    IPERA Radius IP Address (Primary): 35.156.39.198
    IPERA Radius IP Address (Secondary): 35.156.23.166
    Shared Secret: (it will be communicated by IPERA)
    Authentication Port Number: 1812
    Accounting Port Number: 1813

    Redirect URL after login: https://engage.iperawifi.com/onboarding
    External Webauth URL: https://engage.iperawifi.com/onboarding

For Azure:

    IPERA Radius IP Address (Primary): 20.174.25.122
    IPERA Radius IP Address (Secondary): 20.174.42.3
    Shared Secret: (it will be communicated by IPERA)
    Authentication Port Number: 1812
    Accounting Port Number: 1813

    Redirect URL after login: https://me.iperawifi.com/onboarding
    External Webauth URL: https://me.iperawifi.com/onboarding

Any changes on the above parameters and values will be communicated with IPERA customers in advance.