Splash page configuration either AD or RADIUS on MR46 AP's

[JBlack]

We are working to implement BYOD on an SSID across campus and are hitting roadblocks configuring the splash page.  When testing with AD config it fails on all AP's.  Same for RADIUS.  We can test RADIUS for other SSID's that use it for security and it works fine in that configuration.  Is there perhaps some different configuration for splash page vs. security when using RADIUS?  Fairly new to Meraki and first time working with RADIUS.  Not sure what's preventing communication for the AD config, was hoping to use RADIUS alternatively.  Any suggestions or course of action appreciated!  Have been working with Meraki documentation that's helped us get this far.

[Mloraditch]

See this note:

Note: RADIUS access request messages for a splash page will be sourced from the dashboard, not from the local Meraki devices. As such, the RADIUS server's private LAN IP address cannot be specified here.

Located here: https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/C...

LDAP will not have that oddity: https://documentation.meraki.com/Wireless/Operate_and_Maintain/How_Tos/Splash_Page/Configuring_Splas...

But it does use Secure LDAP over TLS, so if you don't have that configured properly, you may have issues. Packet captures and logs on your DC can help determine that or Meraki Support can help clarify as well if you aren't sure how to read the captures.

[PhilipDAth]

To add to Mloraditch excellent answer, this is because the splash page is hosted and served from a server on the Internet, not from inside your network.  Consequently, the RADIUS request comes from the Internet.

It is a real pain.

Could you use Entra ID authentication instead?

https://documentation.meraki.com/Wireless/Design_and_Configure/Configuration_Guides/Encryption_and_A...

[alemabrahao]

What @Mloraditch  means is that your Radius server must respond to the internet, meaning you need to create an inbound NAT for your server.

[JBlack]

Ah.  So in that case if using the AD authentication config the request would also come from the internet?  That might explain why nothing is getting through to port 3268 when testing in CP.

Is there perhaps a guide or best practices for configuring firewall to allow the necessary traffic for an AD splash page?  Any thoughts which would be the better approach RADIUS vs AD?

[Mloraditch]

For AD the requests come locally from the APs: https://documentation.meraki.com/Wireless/Operate_and_Maintain/How_Tos/Splash_Page/Integrating_Activ...

I would use AD over RADIUS (presuming you are using NPS or another non ISE solution) because I don't want my RADIUS server exposed to the internet, but I would also use the Entra integration @PhilipDAth  linked over either of these.

[JBlack]

Thank you all for the input!  We do have Entra integration that I have just confirmed so will be exploring that avenue for our BYOD splash page.  Hopefully I won't need to post anymore, fingers crossed!

May you all have wonderful holidays!