Meraki guides: flag Native RadSec as paid/not self-serve, document AP MAC NAS-ID formats - #2083
Open
odolan-rgb wants to merge 4 commits into
Open
Meraki guides: flag Native RadSec as paid/not self-serve, document AP MAC NAS-ID formats#2083odolan-rgb wants to merge 4 commits into
odolan-rgb wants to merge 4 commits into
Conversation
…fees The Native RadSec path routes Meraki APs through a Helium-hosted FreeRADIUS instance. Meraki builds a CA certificate per group of APs which the Helium team must load onto the AAA, so the path cannot be completed through self-serve tooling and carries additional charges. Partners have arrived at this guide expecting a self-serve, no-cost setup. Adds an admonition stating this up front and pointing at the self-hosted RadSecProxy guide as the alternative, and names the Meraki-specific CA (helium_bfmeraki_ca.pem) in the prerequisites so it is not confused with the general ca.pem used for every other deployment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying heliumdocs with
|
| Latest commit: |
d03f08d
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a30475df.heliumdocs.pages.dev |
| Branch Preview URL: | https://fix-meraki-plus-not-self-ser.heliumdocs.pages.dev |
Partners configuring the NAS ID from the AP MAC hit a format mismatch: Meraki sends the MAC dash-separated (AA-BB-CC-DD-EE-FF) when it is used as part of a template, but with no separators at all (AABBCCDDEEFF) when it is selected on its own. Either is fine, but the registered NAS-ID has to match character for character or authentication fails. Adds a warning after the Advanced RADIUS settings steps in both the Native RadSec and RadSecProxy guides, since this is dashboard behavior and applies regardless of transport. Also drops the certificate filename detail added in the previous commit; the filename is not guaranteed to be stable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
odolan-rgb
changed the title
…ormat The previous wording said the MAC arrives dash-separated when used "as part of a template", which reads as the NAS ID attribute builder. The actual trigger is the SSID: an SSID applied from a template across multiple sites sends the AP MAC dash-separated and upper case, while a normal single-site SSID sends the same MAC with no separators. Also swaps the placeholder MACs for a real observed value and notes that moving an SSID between the two changes the NAS-ID and requires re-registration, which is what Hudson House hit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes to the Cisco Meraki Helium Plus guides, both from partner onboarding confusion (Hudson House hit each of them).
1. Native RadSec is not self-serve and carries fees
Partners have been arriving at the Meraki Native RadSec guide expecting a self-serve, no-cost setup.
This path is different from every other Helium Plus vendor guide: Meraki builds a CA certificate for each group of APs, and that certificate has to be loaded onto the Helium AAA by the Helium team. That's why these APs authenticate through a FreeRADIUS instance Helium hosts and operates, which is a paid service and requires a Helium Plus agreement.
helium-plus-meraki-plus.mdxnow opens with an:::importantadmonition stating this, and points readers who'd rather host it themselves at the Cisco Meraki RadSecProxy Conversion Guide, which runs the RadSecProxy container on their own hardware at no charge.Wording follows Claudio's suggested disclaimer from the internal thread.
2. NAS-ID format when the AP MAC is used
The NAS ID field under Advanced RADIUS settings can be set to the AP MAC address, and Meraki formats that MAC differently depending on how the SSID was built:
E0-CB-BC-48-BC-76E0CBBC48BC76Either is fine, but the NAS-ID registered with Helium has to match the one the SSID actually sends — a difference in separators alone fails authentication, and moving an SSID between the two changes the NAS-ID and requires re-registration. This is what Hudson House hit, and it forced a NAS resubmission.
Both guides now carry a warning to this effect after the Advanced RADIUS settings steps. It's dashboard behavior rather than anything transport-specific, so it applies to the RadSecProxy guide equally.
🤖 Generated with Claude Code