+32 (491)

Transcription

1 Whitepaper: Cisco Meraki Title: Setup wireless guest access Author: Jurgen Vermeulen +32 (491) JUVE Consulting BVBA Roosgrachtlaan 27, B-3400 Landen Tel.: +32 (491)

2 Table of Contents Table of Contents 1 INTRODUCTION THE MERAKI DASHBOARD OVERVIEW OF THE INTERFACE ACCESS POINT MANAGEMENT CLAIM THE AP CONNECT THE AP CONFIGURE THE SSIDS CONNECT TO THE NETWORK MORE INFORMATION /05/2014, V 0.1 <public> Page i

3 Introduction 1 Introduction Everyone is using mobile Internet connected devices nowadays. In order to save costs, these are connected to Wi-Fi hotspots where possible. As more and more businesses start implementing wireless networks, the demand from guests increases to get access to Internet from their own device. It is becoming easier to setup wireless networks and to provide access to both personnel and guests, but it remains a challenge to setup everything in a secure and manageable way. The Meraki product line offers an easy, scalable solution by means of a cloud managed wireless network. This whitepaper will demonstrate how to setup an open guest network where users need to sign in on the company s Facebook page in order to use the wireless network. Although this is not the most secure setup, the main goal is to show the capabilities of the Meraki products and to give a first impression of the web interface. 08/05/2014, V 0.1 <public> Page 1

4 The Meraki dashboard 2 The Meraki dashboard All configurations happen on the central Meraki dashboard. This is a cloud hosted web interface, which is used to configure all products, ranging from access points over switches to firewalls. Although this may be a disadvantage for larger enterprises, it is extremely flexible and you don t need to take any future growth into account, as your network scales with the number of devices and clients. You also don t need any rack space, redundant power or pre-staging of every single device. 2.1 Overview of the interface When logging on, you automatically arrive on the monitoring section. This section provides details on the number of connected clients, bandwidth usage and a map displaying the location of your equipment and status. Figure 1 Monitoring overview You can also get an overview of all your access points, clients and dig deeper into the logging and reporting. 08/05/2014, V 0.1 <public> Page 2

5 The Meraki dashboard The second section is the Organization tab. This is where all global settings are configured related to the company; management of administrators is performed as well as registration (claiming) of equipment and licenses. Figure 2 Organization settings Under the Configure tab, you ll find most of the settings that will need to be configured for daily operations. This is where the SSIDs, access policies, splash pages and wireless users are defined. Figure 3 SSID configuration The last tab is the Help, where you ll find documentation and guides to help you understand the interface and configure all of the settings. 08/05/2014, V 0.1 <public> Page 3

6 The Meraki dashboard 2.2 Access point management In order to start using an access point (AP), some basic steps need to be performed. It needs to be claimed and connected to the network in order to get the correct policy and start serving clients Claim the AP Log on to the dashboard and navigate to Organization -> Inventory. You ll receive a list of all hardware that has already been claimed by the organization... Figure 4 Inventory In order to claim an AP, click the Claim button on the top right. Here, you ll need to fill in the order number or serial number, which are provided at the time of the order. Figure 5 AP claiming When the claim succeeds, the AP is added to the inventory list and can be used within the global network. 08/05/2014, V 0.1 <public> Page 4

7 The Meraki dashboard Connect the AP After the claim has been successfully performed, it s time to connect the AP to the network. By default, an AP will use DHCP to receive an IP and all related information. Once connected to the network, it will contact the Meraki cloud servers to receive the correct configuration and policy. When no DHCP is available, the AP can be statically configured by connecting to the default SSID Meraki and browsing to my.meraki.com. This will guide you to the AP s GUI where you can configure the network settings. 2.3 Configure the SSIDs With the access point connected, we ll setup the SSID(s). Within a network, you can enable up to 15 separate SSIDs. This can be done on the SSID menu within the Configuration tab. This is also the place to rename the default or custom SSIDs. Figure 6 SSID overview More detailed configuration is done under the Access control menu. This is where you setup the: Encryption/authentication: Open, WPA, 802.1x... The easiest guest configurations are open networks or WPA2 using a pre-shared key, which can be displayed at the reception or given when asked. There s also the option to setup WPA2-enterprise combined with an authentication method. In this case, someone needs to register or approve users, which makes it a bit more complicated. We ll use the easiest open setup for this example. Splash page: users can be directed to a splash page when connecting to the network. This can be a custom page, in this example we ll use the organization s Facebook page. IP addressing: the main choice here is NAT or bridge mode. Bridge connects the client directly to the LAN, or on a specific VLAN, while NAT will hide all users behind the AP s IP address. In this case, we ll use NAT, to get a better separation for guest users without having to configure too many firewall rules. Adult content will also be blocked in order to provide a basic policy. Wireless options: choose on which band the SSID will be reachable (2,4 GHz, 5 GHz). 08/05/2014, V 0.1 <public> Page 5

8 The Meraki dashboard Figure 7 Access control Figure 8 Access control (2) 08/05/2014, V 0.1 <public> Page 6

9 The Meraki dashboard We now have a basic SSID and policy. Additional rules can be configured under the Firewall & traffic shaping menu. In this case, we chose to block LAN access for visitors and allow only Internet traffic. Peer2peer traffic will also be blocked, on top of the global blockage of adult content. It s also possible to limit users or the total amount of bandwidth used by guests, so you don t fill up the Internet line with non-critical traffic. 08/05/2014, V 0.1 <public> Page 7

10 Connect to the network 3 Connect to the network We re all set now to connect to the network. In this case, we ll be using an Android tablet to connect to the guest SSID: Figure 9 Connecting to the network Once connected, launching a browser will redirect us to the organization s Facebook page. If we check in, we are allowed to continue and Internet access is allowed. Figure 10 Start browsing 08/05/2014, V 0.1 <public> Page 8

11 Connect to the network After the check-in, it will be possible to use the Internet and apps on your mobile device, as long as you don t violate the configured policies: Figure 11 Browsing session 08/05/2014, V 0.1 <public> Page 9

12 More information 4 More information This is just a small example of what Meraki is capable of. It s not the most secure setup but it gives a view on how the product works and what it is capable of. For more information, a live demo or quote, don t hesitate to contact us: JUVE Consulting Jurgen Vermeulen Jurgen@juve-consulting.be +32 (491) /05/2014, V 0.1 <public> Page 10