Access control for VLAN

[jay_b]

Hi all,

I am trying to setup access policy for switch port. I hope I am on right place. I've configured to use 3rd party credentials google credentials. 

I have configured from Security & SD-Wan > Configure > Access control. There I am using access control with splash page. However, I am not able to see any splash page on device.  Is there any settings need to be done on google side ? I can't seem to find document that shows settings for google.

[GreenMan]

You mention policies for switch ports - but then say you're configuring the MX..?   (Security & SD-WAN always relates to the MX).   If you're wanting to run 802.1x on your MS switch ports, you want Switch > Configure > Access policies, as per:  https://documentation.meraki.com/MS/Access_Control/MS_Switch_Access_Policies_(802.1X)

[jay_b]

Thank you @GreenMan 

Yes for switch ports.

Interesting.

Under Switch access policy I see only 2 options. Radius and Meraki auth. We don't have Radius. Meraki auth is not secure way. What other options do we have ?

[GreenMan]

I assume, when you talk about Meraki auth not being secure, you mean MAC Authentication Bypass (MAB)?   I can see why you would say that it's not greatly secure,  (this is not the same as Meraki auth BTW)

What other options were you expecting?    As we are authenticating at Layer-2 on a switch - in order to effectively open the port - options are bound to be limited.

You mentioned you also have MX - it may be possible to police access at that level - maybe something like this:   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Direc...

But your switch ports would be open access, if that was all you were using.   If you're trying to block client devices 'at source' then switch acces policies are the way, but the options in the document I linked before are the only ones available.

[PhilipDAth]

Switch access policies are another way of saying you want to use 802.1x port authentication.  The entire 802.1x protocol is built on the concept of using RADIUS.  It's fundamental.

Meraki makes it easier by effectively providing a RADIUS server for you to use with Meraki Authentication, otherwise, you'll need to stick to the standard - and put in a RADIUS server.

You can get free RADIUS servers, like Free Radius.

https://freeradius.org/ 

There are also cloud-based RADIUS servers, like Jump Cloud.

https://jumpcloud.com/lp/cloud-radius-beansprout