Hi folks, I'm new to the Meraki platform and loving it so far. I work at a school and we have created a SSID that uses an on-premise Windows 2012 R2 NPS server for 802.11x authentication. It's working great but I would like to use Meraki Group Policy to help with a problem I have. The SSID (lets call it Student-BYOD) is primarily for Windows AD joined laptops used by students. We have a FortiGate firewall that uses the FortiGate Single Sign-on Agent to poll our domain controllers for logon and logoff events. We use this so we can apply FortiGate security policies based on the security group of the user who has logged onto the AD domain joined laptop. However, this year we are allowing some pupils to BYOD. These are non-domain joined devices that will typically be Windows laptops, iPads and MacBooks. I have a policy on the NPS server to allow members of the BYOD group to connect to the Student-BYOD SSID. They join fine but because the devices are not AD domain joined, the FortiGate SSO Agent does not know they are on the network and so their web traffic is not authenticated. My goal here is to not have a separate SSID for the BYOD students and use Meraki Group Policy to direct these BYOD devices to a seperate VLAN. I have created a new network policy for the BYOD group of users on the NPS server. I have added the Filter-Id attribute and gave it the name of a Meraki Group Policy that I have created (the Meraki GP is empty just now). So I have two NPS Network Policies I am looking to use with the Student-BYOD SSID: The policy that is used to allow access to the SSID by student AD domain joined laptops that has no Filter-Id attribute. The policy that is used to allow access to the SSID by a student BYOD device that does have the Filter-Id attribute My question is will access to the Student-BYOD SSID still work for devices using the first policy above? This is how Access Control for the SSID is currently configured in the console: As they will not have the Filter-Id attribute, I'm hoping they will join as normal and be placed onto the Student-BYOD VLAN. Any member of the BYOD student group will have the Filter-Id passed from the NPS server and will then have the Meraki Group Policy applied. I was planning to use a Meraki Group Policy to place clients with the Filter-Id onto a separate VLAN from the Student-BYOD VLAN. I would then allow that VLAN unauthenticated access on the FortiGate to solve the authentication issue - I would apply filtering and application policies on the VLAN though 🙂 I hope that makes sense to someone and I would be very grateful if some one could validate this or point me in the right direction. All the best, Steven.
... View more
