Network Requirements

This section describes, at a conceptual level, the connectivity the platform requires to integrate with a customer network. It is a planning aid for procurement and network design. Exact host names, addresses, and the precise configuration for a given deployment are provided during onboarding and in the product documentation.

At a glance

Portals

HTTPS

RADIUS

RADIUS, with RadSec where transport must be secured

Cisco ISE

HTTPS between the platform and the ISE APIs

Meraki

HTTPS to the Meraki Dashboard; the EasyPSK SSID needs external DHCP

General principles

• All administrative and self-service access is over HTTPS.
• The platform reaches into the customer network using standard, well-understood protocols (secure web, RADIUS, and where applicable DHCP, DNS, and secure tunneling), rather than proprietary on-premises components.
• Connectivity is scoped: each service requires only the connectivity its integration needs.

Connectivity by integration

Integration	Connectivity (conceptual)	Direction
Administration and Self-Service portals	HTTPS	Client to platform
Sign In with Cisco Meraki	HTTPS to the Meraki Dashboard	Platform to Meraki cloud
Sign In with a service gateway	DHCP, DNS, secure tunnel, and routing on a Cisco router	Customer network and platform
EntryPoint (RADIUS-as-a-Service)	RADIUS authentication and accounting; encrypted RADIUS over TLS where used	Network equipment to platform
EasyPSK (Cisco Meraki)	HTTPS to the Meraki Dashboard; the wireless SSID uses an external DHCP service	Platform to Meraki cloud
EasyPSK via RADIUS	RADIUS or RadSec from the wireless network to the platform’s per-context ports, or privately via Service Connector	Wireless network to platform
Endpoint Manager (Cisco ISE)	HTTPS between the platform and the Cisco ISE APIs	Both directions

Notable conditions

• EasyPSK on Cisco Meraki requires the wireless network to use an external DHCP service (bridged mode). Meraki access-point-assigned addressing (NAT mode) is not supported on a personal-network SSID.
• Endpoint Manager depends on reachability to the customer’s Cisco ISE; while ISE is unreachable, endpoint operations cannot complete and the condition is recorded in the audit trail.
• Encrypted RADIUS (RADIUS over TLS) is available where a deployment requires RADIUS traffic to be carried securely, for example across the public internet.
• Private connectivity is available through Service Connector (IPSec) for EntryPoint and Endpoint Manager, so that traffic for those services need not traverse the public internet. Sign In uses the separate Service Gateway.

Related sections

• Service Connector: private IPSec connectivity for EntryPoint and Endpoint Manager.
• Integrations: the systems these connections serve.
• Security and Data Protection: how data in transit is protected.