Hi James,    In my case i'm trying to use LDAP with OKTA cert, how did you added this to the cert itself? You just edit the cert with a text editor and add that line("X509v3 Subject Alternative Name")?        By the doc says:   The LDAP server’s certificate must have a subjectAltName field that matches the Host address configured on the dashboard (either IP address or FQDN) which in my case would be something in the terms of domain.ldap.okta.com   is that it? ... View more

Answering my own thread but here we go:   Short answer is YES, you can use local auth without on prem, as far you have some sort of LDAP somewhere(okta in our case). For Local Auth to work and be able to pass authentication when the radius built on each AP is requested, in each client, EAP-TTLS + PAP has to be configured. We can potentially push an MDM Profile with these settings, I believe, both on Macs and Windows 10 clients; here some details:       https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_EAP-TTLS___PAP_Authentication_on_Windows_8_and_10   and MacOs   https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_EAP-TTLS___PAP_Authentication_on_Mac_OS_X_and_iOS   in a few words, because of the security implications, best route would be to require a cert as well(buying from digicert or someone of the sort) to enforce EAP-TLS over EAP-TTLS/PAP       ... View more

Has anyone EVER implemented this? ... View more

I'm attempting to use this feature without On Prem to validate Local Auth with Okta acting as LDAP. No support has been able to help, and the documentation is not very specific. I can communicate with Okta ldap over port 389 but when i attempt to connect a client on site i get a similar issue, AP just timeout. ... View more

Something to add to whoever read this and they want to help me, if i choose no encryption and i leave the authentication to be handed to the splash page, authentication to that ldap sever(okta) to port 389 it works.!    So I'm sure this is something happening on the encryption side with the AP... not sure what exactly. ... View more

I'm using LDAP with Okta as, and I can't even pass through the authentication either.    We used Okta certs.   The tests fail every time, but I can connect using LDAP directly on port 636 with a Client(and I have a similar setup on my Printing service and it works with no issues). But if I attempt to do it with Meraki is no communication whatsoever. If I try to connect to the test ssid i get fail authentication every time...       I really want this feature to works but I'm having a hard time with it.     ... View more

@Raido, what LDAP server are you using? I'm attempting to use Okta as ldap, and i can't even pass trough the authentication.     ... View more

This was a GUI Dashboard bug all the way!    WPA encryption mode is incompatible with association type: it's a dashboard bug; set the network to WPA2 with preshared key, set a password, save, then configure the Local auth   After doing that all set!   (thank you Isaac if you are reading this). ... View more

Last night I performed the latest Firmware update on the switch, and now both my APs and Switch are updated, still not able to save settings without hitting the same error:     There were errors in saving this configuration: WPA encryption mode is incompatible with association type.     On the security tab, Meraki doesn't like or seem incompatible with WPA2 Enterprise with Local Auth, but I can't set up security without WPA1/WPA2(in the case of not being compatible). Now, if I set up security as open but then I select the splash page with my LDAP server, that does work... (but with no Encryption).    I read all of these articles:   https://documentation.meraki.com/MR/Encryption_and_Authentication/External_Identity_Sources https://documentation.meraki.com/MR/Encryption_and_Authentication/Meraki_Local_Authentication_-_MR_802.1X   https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/Wireless_Fundamentals%3A_Encryption_and_Authentication     WPA2 – Enterprise WPA2 Enterprise utilizes authentication on a user level, using the 802.1x standard, along with the features of WPA2 such as AES. Cisco Meraki fully supports WPA2 Enterprise association with RADIUS and PEAP/MSCHAPv2, or Meraki Authentication, to provide a secure wireless network for enterprise use. users log in with a valid username and password to authenticate instead of a pre-shared key susceptible to social engineering.  Splash Page Cisco Meraki provides a variety of splash pages that can be utilized for additional security. Sign on with Authentication - Forces users to authentication through a sign on page using various types of Authentication including RADIUS, LDAP, and Meraki Authentication. Sign on with SMS Authentication - Forces users to authenticate with an SMS code that they would receive on their phone. Systems Manager Sentry - Utilizes Cisco Meraki Systems Manager, users will need to install the manager client on their computer, their device can then be viewed on a Systems Manager network. Splash Pages can be used with or without a WPA/WEP solution as well.   So Local Auth LDAP Authentication is not compatible without a splash page?  ... View more

On the Hard, all APs are MR42s. On the firmware, I didn't but I can upgrade and see if that makes any difference. ... View more

I'm running:    MS 14.33.1 on the MS120-48LP Switch ==> I have scheduled one update for Next Week MR 29.5.1 on the MR42 Access Points ==> Current Version MX 17.10.2 on the MX250 Security Appliance ==> Upgrade scheduled for May.   Would you recommend doing the switch earlier? It does look like a glitch, but again, I can't say for sure.   About WPA encryption, we only have those two options, and that's it. Get the same error no matter what i select.     ... View more

Hi @alemabrahao !   I tried different Values on the LDAP configuration, I suspect the error is technically something there but I can't pass this. Could be the port? I set up other LDAP integrations in the past(Printing/SCIM), but since are only doing directory searches don't usually require a Port. I got the info from the OKTA documentation here:    https://help.okta.com/oie/en-us/Content/Topics/Directory/LDAP-interface-connection-settings.htm    And the format Meraki points out in the fields are:    I believe they align with what I completed, as shown in my previous post.   The error is not super specific either, which I have seen before on the Meraki dashboard when configuring other stuff.   I am just trying to find out what I'm doing wrong.   Any help is appreciated. ... View more