What has changed in EntryPoint, newest first.
Bug fixes and routine maintenance are not listed here. The platform release notes cover every service in one feed.
Changed
An EntryPoint or EasyPSK service opens on a Groups page with the tabs Groups, Devices, Self-Service Users and Authentication Log, filter chips with counts, a Site column and search across groups and sites. Add Group opens a wizard, also for 802.1X groups, that can add the group’s first user or team. Devices show their IP address. Chromecast, Apple TV and Soundbar are device kinds.
New
Under Self-Service Portal, Teams an organization keeps teams of email addresses, added by hand or provisioned over SCIM. A team is bound to a Sign In access policy, to an EasyPSK, EntryPoint or Endpoint Manager group with the roles its members get, to an EasyPSK onboarding rule or to a Site manager role. A binding can send a welcome mail to people who join later.
New
A new Self-Service Portal runs beside the classic one. The organization chooses the Default portal, Classic unless changed, and each user can switch. An EasyPSK group opens on a home page with the network, the password, the QR code, the devices with online state, the device cap and Register a device for Wi-Fi or cable. Sign In, EntryPoint, EasyPSK and Endpoint Manager groups all have pages there.
Improved
The new Self-Service Portal has PEAP setup guides for Apple, Windows, Android, ChromeOS and Linux. The group page and the guides name the RADIUS server certificate the device should trust, taken from the certificate the EntryPoint service uses.
Improved
On an EntryPoint service’s Network settings, which also serve EasyPSK via RADIUS and RADIUS Proxy, the client secret is masked with Show, Copy and Generate. Generate creates a 24-character secret that takes effect with Update the secret. The Authentication Log of EntryPoint and EasyPSK services has a Live switch that refreshes it every five seconds.
Changed
Netgraph can pause a RADIUS service that receives no authentication or accounting requests. Its settings are kept, and its network settings show RADIUS service paused with the date requests stopped. Start service makes it accept requests again within a few minutes. This applies to EntryPoint, EasyPSK and RADIUS Proxy services and to MAC authentication for Sign In on Cisco Meraki.
Improved
EntryPoint and EasyPSK set a device’s type from the strongest source available, from host name and browser up to DHCP fingerprint, LLDP or CDP, the Cisco controller’s classification and the device model. A known type is never replaced by a weaker one, and a type a person chose is kept. Endpoint Manager offers the same device families, with 26 more types.
Improved
The audit log of the organization and of each Sign In, EntryPoint, EasyPSK and Endpoint Manager service is a timeline with search, a period, chips per kind of change with counts, and a panel showing each change before and after. Export CSV downloads the newest 5,000 entries.
New
A context selects its RADIUS server certificate under Configuration, Network Integration: a platform certificate kept current by the service, or a custom certificate you upload. The card shows subject, issuer and validity period.
When a replacement platform certificate is published it can be downloaded ahead of time, switched to early, and switched back from while the previous one is valid. Certificate warnings appear on the context Overview and Configuration pages, at 60, 30 and 14 days before a custom certificate expires.
New
A new Alerts entry under Services in the left menu, with a count badge coloured by the most serious item. The page lists the certificate warnings from the RADIUS services and from single sign-on, filtered to what the administrator has rights to see, and each alert links to the page where it is resolved.
Improved
The pages reached from email links (sign-in confirmation, meeting host requests, sponsored device requests) are rebuilt as full pages in the portal look, with explicit approved, denied, revoked and not enabled states. A guest at the device limit picks the device to log out on the page, and each page renders in the language of the email it was opened from, offering only the languages enabled for the portal.
New
An EasyPSK group can be given Attribute Profiles from its Group Settings, so the network policy returned at authentication, a VLAN through tunnel attributes or a Cisco security group tag, is set per group. The other EntryPoint variants already worked this way and EasyPSK now matches them.
Profiles are defined once on the service context and reused across its groups.
Improved
Device type is derived from more of the profiling data the wireless network reports, so devices that previously showed as unknown are now classified. Apple TV, Apple Watch and HomePod are recognised as their own types rather than being lumped together.
New
EasyPSK can now be delivered over RADIUS, created and managed as a context variant of EntryPoint, alongside the existing Cisco Meraki WPN path. The key a device presents identifies its group, and the group's network attributes are returned at authentication, so keys resolve at connect time instead of being pushed into the wireless platform in advance.
This is the primary delivery for Cisco Meraki and Cisco Catalyst 9800. It carries far more keys than the Dashboard API path, which remains available and is capped per Meraki network.
A group is created with one of three flavours. Instant shares one group key and registers a device on first connect. Approved shares one group key but admits only MAC addresses registered in advance, with optional four-eyes approval. Dedicated gives every device its own key, and both the MAC and the key have to match.
Improved
An account password is masked in the admin console list, with a show and hide control on each row, so the list can be read over someone's shoulder without exposing credentials.
New
An organization can reach the platform over a private IPSec tunnel instead of the public internet. A firewall, or any device on your side that supports IPSec, establishes a single tunnel to a dedicated endpoint on the platform, and the services you bind to it carry their traffic through it.
EntryPoint's RADIUS path, EasyPSK via RADIUS, the platform's access to an on-premises Cisco ISE, and webhook deliveries can each be bound to the same tunnel. Sign In is not carried this way: it uses the Service Gateway.
A connector's page shows the settings to apply on your own device, including a worked Cisco IOS-XE example, the routes the connector publishes, and which services and ports are using it. Tunnel status is shown per connector, and the destination of a bound service can be changed without unbinding it first.
Available to organization administrators and, for partners, in the MSP Portal.
Improved
The admin console shows the incoming request as it arrived, so an authentication that did not behave as expected can be inspected without taking a packet capture.
The device list searches across several fields at once, including the called station identifier, and shows a fuller description for 802.1X flows.
Improved
A registered device can be moved from one group to another from the admin console, so a device that ends up in the wrong group does not have to be removed and registered again.
New
Every RADIUS authentication attempt is recorded with its outcome, and for a denial the specific reason: an unknown RADIUS client, a shared secret that does not match, an unregistered device, a user outside the expected group, or a configuration problem.
An attempt expands into a timeline of the decision points that led to the outcome, and the request and the response can be inspected as readable tables rather than raw text.
The log is filtered by time range, by decision and by free text, and it is embedded on the context and group pages as well as available on its own, so it can be reached from the device or group being investigated.
New
A Dot1x context can admit a device by its MAC address when 802.1X does not complete, so headless equipment on the same SSID does not need a context of its own.
New
EntryPoint can forward an authentication request upstream to a remote RADIUS federation instead of answering it itself. This is what an organization taking part in eduroam needs, and it is configured as a variant of an EntryPoint context like the others.
New
A context can authenticate equipment on a certificate that names the device rather than the user, which is what company-owned laptops and headless gear issued from a customer PKI need.
Changed
The RADIUS client secret is held separately for each service instead of being shared, so a secret can be rotated for one service without disturbing the other.
New
Devices can be uploaded to an iPSK group from a file instead of being added one at a time.
Changed
Personal accounts are administered on the group rather than centrally, which is what makes it possible to delegate a group without handing over every account in the context.
Self-service enrollment moved onto the group's Self-Service tab at the same time, next to the other delegation settings.
New
An Attribute Profile defines the network policy returned on a successful authentication, such as a VLAN through tunnel attributes or a Cisco security group tag. Profiles are defined once and reused across groups, so the same policy does not have to be typed out per group.
New
A context can authenticate users on a certificate issued through Microsoft Entra ID, with the certificate settings configured in the console and group membership checked against Entra at each authentication.
No entries for that service yet.
