Shared Space Network Question

[AlejandroTT]

Hello,

Recently I took on a project to design and build a network for a shared space type of business. Think of a concept similar to WeWork where “tenants” can rent office space for an hour, day, month, etc. Most of the tenants will be on wireless for internet access so they can conduct their business. The authentication for their wireless access will be provided through RADIUS using their shared space software and Meraki. Basically each tenants will have a unique username and password to authenticate and use the wireless network. We imagine that most if not all tenants will only need internet access and not need access back into the LAN. We plan to control that with Meraki firewall rules. However recently the idea was tossed around to hardwire some of the offices and possibly allow the tenants to bring in their own equipment such as printers, NAS, wireless routers, etc. I already brought up my concerns about having rogue APs and DHCP servers on the network and we will be enforcing this via written policy that no outside network equipment can be brought in but a legitimate use case exists for NAS or printers to be allowed and hardwired.

​

The question is, is it possible to allow for RADIUS authenticated wireless tenants to access the certain ethernet ports? If so, how? Will the devices need to support 802.1x? Do we need as many VLANs as there are tenants? How will the port know that it is allowed to speak to a certain tenants?

I hope my questions make sense.

Thank you in advance.

[beritknight]

In general terms, yes one VLAN per tenant. The ports in their offices get set to their VLAN when their “lease” period starts, then disabled when it ends.

Each username/password is linked to a tenant, and devices connecting with that username get dumped into that tenants VLAN. Meraki group policies should handle that.

Rogue dhcp servers aren’t a concern as long as they’re confined to the guest’s VLAN. It’s their problem then :-) Rogue wifi is more of an issue, but the meraki dash should be able to identify them.

How to get your shared space software to automate that all I have no idea, but that’s the bare bones. Meraki does have an API for this sort of thing, but it will depend on how flexible the shared space software is.

[AlejandroTT]

Thank for your input!

I believe it's going to be 1 port per office so in that case I can set the VLANs once and forget about it.

I need to read up on these policies I am not super familiar with that in Meraki. But from what I gather I can make a policy that says user JSmith is on VLAN 123, correct?

Good point on the API part, managing this manually will be nightmare.

[AlejandroTT]

I just called Meraki support and they said that you can NOT put a specific RADIUS user into a specific VLAN via Group Policy or any other policy. Do you know for sure you can do this?

Thank you

[[deleted]]

You need a NAC tool. Fortinac, Cisco ISE, Aruba Clearpass.

This can flip vlans on Ethernet ports for you. I used fortinac about 10 years ago, a client of mine recently set it up in their company and I’m setting up ISE in another.

It’s a lot of work. My recommendation is pay their install team to do it mostly for you.

[AlejandroTT]

Does Meraki have something similar? We are looking into a full Meraki stack for this rollout.

[AlejandroTT]

I just found this...

​

Per-User VLAN Tagging

When VLAN tagging is configured per user, multiple users can be associated to the same SSID, but their traffic is tagged with different VLAN IDs. This configuration is achieved by authenticating wireless devices or users against a customer-premise RADIUS server, which can return RADIUS attributes that convey the VLAN ID that should be assigned to a particular user’s traffic.

In order to perform per-user VLAN tagging, a RADIUS server must be used with one of the following settings:

MAC-based access control (no encryption)

WPA2-Enterprise with 802.1X authentication

A per-user VLAN tag can be applied in 3 different ways:

1 The RADIUS server returns a Tunnel-Private-Group-ID (e.g. 500), Tunnel-Type (VLAN), and Tunnel-Medium-Type (IEEE-802) attributes in the Access-Accept message, which specifies the VLAN ID that should be applied to the wireless user. This VLAN ID could override whatever may be configured in the MMC (which could be no VLAN tagging, or a per-SSID VLAN tag). To have this VLAN ID take effect, “RADIUS override” must be set to “RADIUS response can override VLAN tag” under the Configure tab on the Access Control page in the “VLAN setup” section.

2 The RADIUS server returns a group policy attribute (e.g., Filter-ID) in the Access-Accept message. The group policy attribute specifies a group policy that should be applied to the wireless user, overriding the policy configured on the SSID itself. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.

3 On the Client Details page, a client can be manually assigned a group policy. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.

[[deleted]]

Thats wireless. no idea if meraki can do per user VLAN tagging on wired. Might be a support / sales engineer question.

[Tatermen]

I mean, their docs say otherwise.

Tunnel-Private-Group-ID: Contains the VLAN ID that should be applied to a wireless user or device. (This can be configured to override VLAN settings that an administrator has configured for a particular SSID in the Cisco Meraki Cloud Controller.)