Just to be clear, the actual  PSK "Password/Key" is contained in the Cisco-AVPair vendor attribute "psk," not in the Tunnel-Password attribute. "On the Settings tab, add a Standard RADIUS attribute of Tunnel-Password. It does not matter what the actual value is here, because the clients will not be using it. However, it MUST be included. Otherwise, the MR will reject the response from the NPS server." -- from the link below This really threw me. IPSK with RADIUS Authentication - Cisco Meraki Documentation   Does the tunnel-password attrib "contain" or "wrap" the Cisco AV Pair items? ... View more