Connectivity to Meraki Network

[drusher101]

Having a strange issue.  Our PCs are able to see our wireless network but are unable to connect.  I am able to go online and see all of the AP points and I am also able to ping msn & google from the APs but can not connect to them.  We have a Guest network setup and when trying to connect to it we get the message: Access Denied.  Any ideas?  We are using MR33.  

Says there is a firmware update.  We are new to the Meraki MR33 should you always upgrade your firmware when there is an update or should you wait for a while?

[kYutobi]

drusher101 I would try first to create an open network with no password and see how it behaves use Meraki DHCP. Also I know there will be problems if you try to setup WPA/WPA2 encryption just try WPA2. I guess what I'm trying to say is check your settings because you're getting an access denied. Let me know if I can further assist you.

[PhilipDAth]

What kind of authentication have you got configured on your WiFi.  Splash page, WPA-PSK, WPA2-Enterprise mode?

[drusher101]

On the EMP Network we are using Security Type - WPA2-Enterprise Encryption type - AES and using User authentication.

On Guest Network Since it is not connected to our network at all Security Type - No authentication Encryption - None

I have also updated to the latest firmware for the MR33  MR 24.11

[PhilipDAth]

And what are you doing WPA2-Enterprise authentication agains?  Your own RADIUS server?

[drusher101]

Yes are own Radius Servers.

[Adam]

Are you serving DHCP for the guest network or do you have it setup for Meraki DHCP?

[drusher101]

We are using Meraki DHCP on our Guest Network

[Adam]

Can you post a screenshot of the settings you have configured for your guest network. Wireless>SSIDs> then click Edit Settings on the public network. I'm starting with this one since it is likely less complex than your secure network.

[drusher101]

Here you go. 

[kYutobi]

Okay so it looks like you have it Open which is good but looks like you have there sign on with Meraki authentication which you have to make users. Also you have captive portal strength on to "block all access until sign on is complete". If this is just a Guest Network with no password you would have to change it to None (direct access) unless you want to add a splash page.

[Adam]

For our guest network we use the click-through splash page. Works well for guest networks. They can just click to agree to your terms/liability. Let me know if you would like a copy of our wording to start with. You'd change the setting from Sign-On with "Meraki" to Click Through. With the current settings you'd have they'd have to have a Meraki account to login with in the browser before they'd be let online.

[drusher101]

Having to create a user is what management wants.  So I have created a test user for myself and I get the access denied.

[PhilipDAth]

Do the RADUS servers say they are sending an ACCESS-ACCEPT and allowing access?

If they are sending an ACCESS-REJECT they you have to look at your policy on your RADIUS server to determine why.