What has changed in EntryPoint, newest first.
Bug fixes and routine maintenance are not listed here. The platform release notes cover every service in one feed.
New
An EasyPSK group can be given Attribute Profiles from its Group Settings, so the network policy returned at authentication, a VLAN through tunnel attributes or a Cisco security group tag, is set per group. The other EntryPoint variants already worked this way and EasyPSK now matches them.
Profiles are defined once on the service context and reused across its groups.
Improved
Device type is derived from more of the profiling data the wireless network reports, so devices that previously showed as unknown are now classified. Apple TV, Apple Watch and HomePod are recognised as their own types rather than being lumped together.
New
EasyPSK can now be delivered over RADIUS, created and managed as a context variant of EntryPoint, alongside the existing Cisco Meraki WPN path. The key a device presents identifies its group, and the group's network attributes are returned at authentication, so keys resolve at connect time instead of being pushed into the wireless platform in advance.
This is the primary delivery for Cisco Meraki and Cisco Catalyst 9800. It carries far more keys than the Dashboard API path, which remains available and is capped per Meraki network.
A group is created with one of three flavours. Instant shares one group key and registers a device on first connect. Approved shares one group key but admits only MAC addresses registered in advance, with optional four-eyes approval. Dedicated gives every device its own key, and both the MAC and the key have to match.
Improved
An account password is masked in the admin console list, with a show and hide control on each row, so the list can be read over someone's shoulder without exposing credentials.
New
An organization can reach the platform over a private IPSec tunnel instead of the public internet. A firewall, or any device on your side that supports IPSec, establishes a single tunnel to a dedicated endpoint on the platform, and the services you bind to it carry their traffic through it.
EntryPoint's RADIUS path, EasyPSK via RADIUS, the platform's access to an on-premises Cisco ISE, and webhook deliveries can each be bound to the same tunnel. Sign In is not carried this way: it uses the Service Gateway.
A connector's page shows the settings to apply on your own device, including a worked Cisco IOS-XE example, the routes the connector publishes, and which services and ports are using it. Tunnel status is shown per connector, and the destination of a bound service can be changed without unbinding it first.
Available to organization administrators and, for partners, in the MSP Portal.
Improved
The admin console shows the incoming request as it arrived, so an authentication that did not behave as expected can be inspected without taking a packet capture.
The device list searches across several fields at once, including the called station identifier, and shows a fuller description for 802.1X flows.
Improved
A registered device can be moved from one group to another from the admin console, so a device that ends up in the wrong group does not have to be removed and registered again.
New
Every RADIUS authentication attempt is recorded with its outcome, and for a denial the specific reason: an unknown RADIUS client, a shared secret that does not match, an unregistered device, a user outside the expected group, or a configuration problem.
An attempt expands into a timeline of the decision points that led to the outcome, and the request and the response can be inspected as readable tables rather than raw text.
The log is filtered by time range, by decision and by free text, and it is embedded on the context and group pages as well as available on its own, so it can be reached from the device or group being investigated.
New
A Dot1x context can admit a device by its MAC address when 802.1X does not complete, so headless equipment on the same SSID does not need a context of its own.
New
EntryPoint can forward an authentication request upstream to a remote RADIUS federation instead of answering it itself. This is what an organization taking part in eduroam needs, and it is configured as a variant of an EntryPoint context like the others.
New
A context can authenticate equipment on a certificate that names the device rather than the user, which is what company-owned laptops and headless gear issued from a customer PKI need.
Changed
The RADIUS client secret is held separately for each service instead of being shared, so a secret can be rotated for one service without disturbing the other.
New
Devices can be uploaded to an iPSK group from a file instead of being added one at a time.
Changed
Personal accounts are administered on the group rather than centrally, which is what makes it possible to delegate a group without handing over every account in the context.
Self-service enrollment moved onto the group's Self-Service tab at the same time, next to the other delegation settings.
New
An Attribute Profile defines the network policy returned on a successful authentication, such as a VLAN through tunnel attributes or a Cisco security group tag. Profiles are defined once and reused across groups, so the same policy does not have to be typed out per group.
New
A context can authenticate users on a certificate issued through Microsoft Entra ID, with the certificate settings configured in the console and group membership checked against Entra at each authentication.
No entries for that service yet.
