Introduction to Netgraph EasyPSK
Looking for scope, requirements, roles, and licensing in one place? See the formal EasyPSK service description. New to the service? Start with the EasyPSK product page.
EasyPSK is a cloud-based automation and management module within the Netgraph Connectivity Platform™, purpose-built for creating and maintaining per-user Wi-Fi networks on Cisco wireless infrastructure.
It delivers secure, private, and user-specific network segments within shared wireless infrastructures — ideal for co-living, co-working, hospitality, student housing, and enterprise environments.
All variants are forms of Identity PSK (iPSK): a client is identified by its own per-unit pre-shared key, not by a pre-registered MAC address. Devices do not need to be enrolled in advance for access to work; a user simply enters their unique key and is placed straight into their own private network.
EasyPSK integrates with Cisco Meraki and Cisco Catalyst 9800 using the integration method that best fits the platform and scale:
| Variant | Platform | Integration | Status | Notes |
|---|---|---|---|---|
| EasyPSK via RADIUS | Cisco Meraki and Cisco Catalyst 9800 | RADIUS | Available | The primary delivery: “Identity PSK with RADIUS”; the platform is the SSID’s RADIUS server; keys resolve at connect time, 100,000+ keys and horizontally scalable; three security flavours per group (Instant, Approved, Dedicated) |
| Meraki WPN | Cisco Meraki only | Dashboard API | Available | ”Identity PSK without RADIUS”; up to 5,000 keys per Meraki network |
The two integration styles look like this:
EasyPSK via RADIUS
The wireless network authenticates each connecting device against EasyPSK over RADIUS; the key the user typed identifies their group, and per-group network attributes (VLANs, Cisco AV-pairs) are returned via Attribute Profiles. Transport is secured with RadSec (TLS) or carried privately through Service Connector (IPSec). The Meraki and Catalyst 9800 flows are equivalent.
Meraki WPN — Dashboard API
EasyPSK provisions per-unit Identity PSKs directly on Cisco Meraki through the Dashboard API — "Identity PSK without RADIUS", up to 5,000 keys per Meraki network.
-
Cloud-Based & Fully Managed
EasyPSK operates as a fully managed SaaS solution, eliminating the need for manual SSID configuration or complex VLAN assignments.
The platform automates the creation, modification, and removal of per-user networks, ensuring reliability, scalability, and reduced administrative effort. -
Native Integration with Cisco
On Meraki, EasyPSK can drive the Dashboard API for direct iPSK provisioning or act as an external RADIUS server for runtime key resolution (“Identity PSK with RADIUS”).
On Catalyst 9800, EasyPSK acts as a RADIUS server that responds to iPSK requests from the WLC — secured by RADsec (TLS) or IPSec for transport. -
Secure, Private Network Segmentation
Each EasyPSK network functions as a personal micro-segment within the shared Wi-Fi infrastructure, providing a unique private network for the user or group.
This prevents cross-visibility between tenants or users, enhancing both security and privacy without additional VLAN complexity. -
Flexible Deployment Options
EasyPSK is optimized for Cisco Meraki and Cisco Catalyst 9800 environments, and can also operate in hybrid setups — for example, when wireless networks connect through upstream gateways or other vendor infrastructures supporting RADIUS or DHCP integration. -
Self-Service Portal for Users
The Self-Service Portal lets members see their group’s Wi-Fi network and key, scan a QR code, register Wi-Fi and wired devices, block a device, invite others, print the group’s key card and add the key to Apple Wallet. A new portal ships beside the classic one, and the organization chooses which one its users land in.
The functions below, from onboarding rules to Self-Service Teams, belong to EasyPSK via RADIUS. -
Self-service onboarding
Onboarding rules give a person a group of their own the first time they sign in to the Self-Service Portal, matched by email domain, full address or Self-Service Team. A printable portal poster with a QR code points people to the sign-in page. -
Sites and Site managers
Groups that belong together (the apartments of one building, a wing, a hall) form a Site with a policy for new groups. A Site manager role delegates the creation and upkeep of a site’s groups to the Self-Service Portal, with each permission switched on or off by the administrator. -
Wi-Fi Key Cards
Printed cards per group with the network name, the key, a QR code, the group name and its end date, laid out from named designs with your logo and texts, 1 to 12 cards per A4 page as a PDF. -
Self-Service Experiences
Six experiences (Home-like Wi-Fi, Co-working, Campus, Expo halls, Hospitality, IoT) set the words the portal, the invitations and the key cards use, chosen per service, per site or per group. They never affect access. -
Group rules
Each group carries a device cap, an end date after which its devices are denied and the group is archived, device blocking, and whether the group takes wired devices through MAB. Groups can be created in bulk as a numbered series or from a CSV file. -
Terms of use and privacy notice
Set per service, in the portal’s languages. Once enabled, a self-service user accepts them before using the portal, and again when a new version is published. -
Self-Service Teams
A named list of email addresses that, bound to a group, an onboarding rule or a Site manager role, gives its members self-service access. Created by hand or provisioned over SCIM. -
Centralized Administration and Monitoring
The Administration Portal provides full visibility into all active EasyPSK networks, user associations, and connected devices.
Administrators can track device events, audit user activity, and adjust configuration templates with minimal effort. -
Audit Logging and Compliance
Every change and user event is logged in real time to provide a transparent audit trail, ensuring accountability and compliance with organizational policies.