When integrating EntryPoint iPSK with Cisco Meraki infrastructure, additional RADIUS attributes must be sent to achieve client isolation between device groups.
Unlike classic Cisco WLC, which uses dynamic iPSK tags, Meraki uses UDN (User-Defined Network) tags to isolate clients at the SSID level.
📚 How it Works #
-
When a device connects using iPSK, EntryPoint returns the group-specific PSK.
-
To enable group isolation, EntryPoint must also return a Cisco AV-Pair attribute containing the UDN tag.
-
The Meraki cloud controller reads this value and dynamically groups devices.
Devices with the same UDN tag can communicate with each other.
Devices with different UDN tags are isolated, even if they are connected to the same SSID.
⚠️ Note! If no UDN tag is used all devices can communicate with each other despite different PSK.
Required RADIUS Attribute Format #
The RADIUS attribute must be built using a Cisco AV-Pair format:
Where <ID> is a unique numeric tag for each device group.
Practical Example #
Suppose you have two critical infrastructure groups:
| Group Name | PSK | UDN Tag Value |
|---|---|---|
| Door Locks | doorlocks-psk | udn:private-group-id=10 |
| Fire Alarms | firealarms-psk | udn:private-group-id=11 |
EntryPoint should, upon successful device lookup, return:
-
Group-specific PSK (for Meraki to validate the PSK).
-
Cisco AV-Pair attribute:
-
Door Locks Group →
Cisco:Cisco-AVPair = "udn:private-group-id=10" -
Fire Alarms Group →
Cisco:Cisco-AVPair = "udn:private-group-id=11"
-
This ensures:
-
Door lock devices can communicate with each other securely.
-
Fire alarm devices can communicate internally.
-
Devices from Door Locks and Fire Alarms cannot communicate across groups, despite being on the same wireless SSID.
Important Notes #
-
If no UDN tag is returned by RADIUS, Meraki places the client into a default group without isolation.
-
The UDN feature requires Meraki firmware supporting Identity PSK with RADIUS (available in enterprise Meraki networks).
-
EntryPoint allows dynamic configuration of UDN tags based on device group membership.