What has changed in EasyPSK for Cisco Networks, newest first.
Bug fixes and routine maintenance are not listed here. The platform release notes cover every service in one feed.
New
An EasyPSK service groups its groups into sites, each with a policy for new groups: Self-Service Experience, security flavour, device cap and Valid for (days). Groups without a site land in the Default Site. A Site manager role names its sites, its members by email address or team, and what they see and may do in the Self-Service Portal, from creating groups and regenerating keys to printing Wi-Fi Key Cards.
New
Under Self-service onboarding an EasyPSK service holds named rules that give a person a group of their own at their first sign-in to the Self-Service Portal. A rule matches an email domain, an address or a Self-Service Team, and sets the new group’s flavour, Self-Service Experience, site, device cap, validity, the user’s roles and how the group is named. Check an address shows which rule applies.
New
Print Wi-Fi Key Cards prints a card per Instant group with the network name, the key, a QR code, the group label and the end date, from named designs with a logo and texts. Print every Instant group, chosen sites and groups, or a Self-Service portal poster with a QR code. Site managers print from the Self-Service Portal. Prints and design changes are audited.
New
An EasyPSK service chooses one of six Self-Service Experiences: Home-like Wi-Fi, Co-working, Campus, Expo halls, Hospitality or IoT, and a site or a group can choose another. The experience sets the wording of the new Self-Service Portal, the welcome mail and the label on Wi-Fi Key Cards. Approved and Dedicated groups without a choice are IoT. The experience does not affect access.
New
An EasyPSK group’s Rules card holds its site, Self-Service Experience, device cap, Valid until and a switch for wired devices. At the cap new devices are refused. After Valid until the group is archived and its devices denied, and an administrator can reactivate it until the archive retention ends, 30 days by default. Members block devices and register wired devices by MAC address in the Self-Service Portal.
New
Create in bulk on an EasyPSK service’s Groups page creates groups as a numbered series or from a CSV file, with flavour, site, Self-Service Experience, device cap, end date and optional invitations. The run is shown as a plan, approved and carried out, with Earlier runs as history. A CSV can also reset or delete the groups not in the file. Site managers create series in the Self-Service Portal.
New
Under Service settings, Terms & Privacy holds an EasyPSK service’s terms of use and privacy notice, in English with the other portal languages beside it. With Users accept the terms switched on, a self-service user accepts them before the portal opens. After an edit the service can ask everyone to accept again, and each user sees the versions they have accepted.
New
A replaced key can be restored for seven days: the shared key of an EasyPSK group, the key of a Dedicated device and the key of a Meraki WPN group. Restore previous PSK is in the Administration Portal and Restore previous key in the new Self-Service Portal. Devices that still use the earlier key connect again without changes.
Changed
An EntryPoint or EasyPSK service opens on a Groups page with the tabs Groups, Devices, Self-Service Users and Authentication Log, filter chips with counts, a Site column and search across groups and sites. Add Group opens a wizard, also for 802.1X groups, that can add the group’s first user or team. Devices show their IP address. Chromecast, Apple TV and Soundbar are device kinds.
New
Under Self-Service Portal, Teams an organization keeps teams of email addresses, added by hand or provisioned over SCIM. A team is bound to a Sign In access policy, to an EasyPSK, EntryPoint or Endpoint Manager group with the roles its members get, to an EasyPSK onboarding rule or to a Site manager role. A binding can send a welcome mail to people who join later.
New
A new Self-Service Portal runs beside the classic one. The organization chooses the Default portal, Classic unless changed, and each user can switch. An EasyPSK group opens on a home page with the network, the password, the QR code, the devices with online state, the device cap and Register a device for Wi-Fi or cable. Sign In, EntryPoint, EasyPSK and Endpoint Manager groups all have pages there.
Improved
On an EntryPoint service’s Network settings, which also serve EasyPSK via RADIUS and RADIUS Proxy, the client secret is masked with Show, Copy and Generate. Generate creates a 24-character secret that takes effect with Update the secret. The Authentication Log of EntryPoint and EasyPSK services has a Live switch that refreshes it every five seconds.
Changed
Netgraph can pause a RADIUS service that receives no authentication or accounting requests. Its settings are kept, and its network settings show RADIUS service paused with the date requests stopped. Start service makes it accept requests again within a few minutes. This applies to EntryPoint, EasyPSK and RADIUS Proxy services and to MAC authentication for Sign In on Cisco Meraki.
Improved
EntryPoint and EasyPSK set a device’s type from the strongest source available, from host name and browser up to DHCP fingerprint, LLDP or CDP, the Cisco controller’s classification and the device model. A known type is never replaced by a weaker one, and a type a person chose is kept. Endpoint Manager offers the same device families, with 26 more types.
Improved
The audit log of the organization and of each Sign In, EntryPoint, EasyPSK and Endpoint Manager service is a timeline with search, a period, chips per kind of change with counts, and a panel showing each change before and after. Export CSV downloads the newest 5,000 entries.
New
An EasyPSK group can be given Attribute Profiles from its Group Settings, so the network policy returned at authentication, a VLAN through tunnel attributes or a Cisco security group tag, is set per group. The other EntryPoint variants already worked this way and EasyPSK now matches them.
Profiles are defined once on the service context and reused across its groups.
New
Batch Group Sync takes a CSV of groups, units and members and reconciles an entire context against it in one run. Groups and users are created, updated, reset or removed so the context ends up matching the file.
Nothing is applied before you have seen it. The file is parsed and analysed first, then a review step reports the counts per action and asks you to confirm the scope of what the run will change. A file with errors blocks the analysis rather than producing a half-applied run.
The run is monitored live, survives a page refresh, and can be exported as a CSV when it finishes. Earlier runs are kept in a run history.
It is reached from the Groups page of a Meraki WPN context. An example file can be downloaded from the upload step, and a context can export its current groups as a CSV to start from.
Improved
A member of a Meraki WPN group can carry a phone number. Administrators set it from the admin console, and group administrators can set or update it in the Self-Service portal.
The number has to include a country code. It is contact information held with the member and nothing is sent to it.
New
A Self-Service User can see a device key, copy it, and read it as a Wi-Fi QR code together with the network name, without going through an administrator.
Rotating a key is tied to the user's role and can be switched off for the context, so an administrator decides whether delegated users may regenerate keys at all.
The device view also shows accounting data for the group, so a delegated administrator can see what is actually connected.
Improved
Device type is derived from more of the profiling data the wireless network reports, so devices that previously showed as unknown are now classified. Apple TV, Apple Watch and HomePod are recognised as their own types rather than being lumped together.
New
EasyPSK can now be delivered over RADIUS, created and managed as a context variant of EntryPoint, alongside the existing Cisco Meraki WPN path. The key a device presents identifies its group, and the group's network attributes are returned at authentication, so keys resolve at connect time instead of being pushed into the wireless platform in advance.
This is the primary delivery for Cisco Meraki and Cisco Catalyst 9800. It carries far more keys than the Dashboard API path, which remains available and is capped per Meraki network.
A group is created with one of three flavours. Instant shares one group key and registers a device on first connect. Approved shares one group key but admits only MAC addresses registered in advance, with optional four-eyes approval. Dedicated gives every device its own key, and both the MAC and the key have to match.
New
An organization can reach the platform over a private IPSec tunnel instead of the public internet. A firewall, or any device on your side that supports IPSec, establishes a single tunnel to a dedicated endpoint on the platform, and the services you bind to it carry their traffic through it.
EntryPoint's RADIUS path, EasyPSK via RADIUS, the platform's access to an on-premises Cisco ISE, and webhook deliveries can each be bound to the same tunnel. Sign In is not carried this way: it uses the Service Gateway.
A connector's page shows the settings to apply on your own device, including a worked Cisco IOS-XE example, the routes the connector publishes, and which services and ports are using it. Tunnel status is shown per connector, and the destination of a bound service can be changed without unbinding it first.
Available to organization administrators and, for partners, in the MSP Portal.
Improved
The admin console shows the incoming request as it arrived, so an authentication that did not behave as expected can be inspected without taking a packet capture.
The device list searches across several fields at once, including the called station identifier, and shows a fuller description for 802.1X flows.
New
Every RADIUS authentication attempt is recorded with its outcome, and for a denial the specific reason: an unknown RADIUS client, a shared secret that does not match, an unregistered device, a user outside the expected group, or a configuration problem.
An attempt expands into a timeline of the decision points that led to the outcome, and the request and the response can be inspected as readable tables rather than raw text.
The log is filtered by time range, by decision and by free text, and it is embedded on the context and group pages as well as available on its own, so it can be reached from the device or group being investigated.
Changed
The RADIUS client secret is held separately for each service instead of being shared, so a secret can be rotated for one service without disturbing the other.
New
A delegated administrator can manage the devices and members of a Meraki WPN group from the Self-Service portal, without an account in the admin console.
New
A Meraki integration carries a group policy and an access policy strategy, set when the integration is added and changeable afterwards. The group policy can be changed where the strategy is a shared one, and the Meraki API user can be updated without recreating the integration.
No entries for that service yet.
