Meraki Sponsored Guest Access - Auth not working (it lets everyone in with no sponsor approval)

[VT-Freddy]

We configured Sponsored Guest access on a guess ssid and it works - great - but it just lets everyone on in spite of the fact that the sponsor has not yet approved the access.  The emails between requestor and sponsor seem to be working, but when the sponsor clicks "Click here to approve access" the portal says "UserXYZ has already been approved" which is not true.  

Huh ?

[AutomationDude · Accepted solution]

Hey Freddy, did you check out this article?

https://documentation.meraki.com/MR/Encryption_and_Authentication/Sponsored_Guest

Goes into detail about the sponsored access.

Also check out this post as it might be helpful: 

https://community.meraki.com/t5/Wireless-LAN/Sponsored-Guest-returning-users-auth-problem/td-p/56013

If it isn't a returning user problem then it would make sense to open a support ticket

[Inderdeep]

@AutomationDude : Good links buddy, appreciate ! It seems if everything is rightly configured and still have issues, open a Cisco TAC case.

[VT-Freddy]

Thanks to both for your replies.  Indeed good links and that other case was resolved by TAC in the end. 

@AutomationDude 

@Inderdeep 

[Inderdeep]

Great, happy to see the issue resolved 🙂 

Regards
Inderdeep 

[PhilipDAth]

If it says the user is already approved, then more than likely someone has approved them on a prior visit.

[Inderdeep]

@VT-Freddy so what was the resolution ? Is that someone approving it already from some hidden place 😜

[VT-Freddy]

A Update to the accepted solution:

This was, in fact, fixed by a call to TAC.  In the end, it turns out that since we use Barracuda Mail Filtering with Cloud Protection Layer (CPL), the emails to the sponsor with the link to approve the requestor were being 'detonated' in the URL sandbox at the protection layer.  All inbound emails with these services actually explode any URL to inspect it to see if it is safe before passing the email to the recipient.  In effect, CPL was "clicking the approval link," seeing that it was an ok website, and then passing the email to the sponsor.  This, in effect, approved the access via the click.

Hope that save someone else some trouble. 

Mark

[Inderdeep]

@VT-Freddy Thanks buddy sharing the same with us. Hope it will help in future for some other users if they encountered with this kind of issue. Appreciate !

Regards
Inderdeep Singh

www.thenetworkdna.com