Only just saw this comment, looking for something else...   You know null encryption is now supported for third party VPN tunnels?  under Security & SD-WAN > Site-to-site VPN > Organization-wide settings > Non-Meraki VPN peers. Then select IPsec policies > Phase 2 > NULL. ... View more

Have you considered switching to the Meraki hosted guest auth/splash setup? We use this quite successfully across a number of networks and deploy the guest SSID with a PSK and then present a sign in page.  ... View more