Security

Currently when Android phones try to connect to our Meraki SSID, it asks to select a certificate, but there is no certificate to select.  How do I export my service certificate to install on our android phones?  I can only extract the full cert with private key.  I just need the public crt file.

Using legacy EAP methods and credential types on unmanaged devices puts all user credentials at risk. This is not recommended.

How would we allow people to BYOD when we do not have an MDM solution for wireless?  Are there guides on how to set that up?  We do not have onboard licensing.

You need some form of device provisioning solution (ClearPass Onboard, Secure W2, Cloudpath, etc).

If you don't, every user credential should be treated as compromised.

If those are not free, then we can't do it. 

As Tim mentioned: don't do it. Also Android has made it really hard to configure, but there is an option under the Advanced WiFi configuration where you can import root CAs for WiFi (which you can first export from the Trust list in ClearPass), and then it should be possible to sea in the dropdown for the CA Selection when you manually configure the authentication. It was for me already challenging to get the root downloaded to my phone as during download it will open the certificate store for web authentication which is not linked to the one for WiFi. I had to create a quick web-site with a link that I could 'download link' from to get it even in my Downloads folder.

It's all clear that is is made as hard as possible to do this manually, which is another indication that you probably should not be doing this.

I even just tested, but keep seeing the client reporting: unknown_ca, so I can't make it work quickly. Using Onboard or equivalents is probably better while moving to EAP-TLS at the same time.

Is there a walk through on how to setup OnBoard with Meraki?  I don't get how it works with Cisco gear vs Aruba gear, because the settings for aruba doesn't work  for Cisco.

Deleted

Attachment(s)

Setting up access using Meraki AP and ClearPass.pdf   1.25 MB 1 version

I forgot to put in Cisco - Terminate Session and Cisco - Reauthenticate-Session in the Webauth Captive portal enforcement.  Without those, you won't automatically get re-directed and reconnect and have to manually reconnect to the SSID.

Attachment(s)

Setting up access using Meraki AP and ClearPass.pdf   1.28 MB 1 version