Cisco Catalyst 9800
Point a Cisco Catalyst 9800 WLAN at your EasyPSK Context: the platform acts as the WLC's external RADIUS server and places each device in the right group based on the key it presented.
On Cisco Catalyst 9800 wireless LAN controllers, EasyPSK via RADIUS works the same way as on Meraki: the WLC authenticates connecting devices against the platform over RADIUS, and the key the user typed identifies the group. This is what brings EasyPSK to estates that run Catalyst wireless instead of Meraki.
The wireless LAN controller authenticates connecting devices against the Context's RADIUS endpoints. The Meraki and Catalyst 9800 flows are equivalent: same groups, same flavours, different wireless platform.
What it requires on the Catalyst 9800
Section titled “What it requires on the Catalyst 9800”- An AAA RADIUS server group pointing at the Context’s RADIUS endpoint(s) — hostname, authentication and accounting ports, and the RADIUS client secret from Configuration → Network Integration.
- The WLAN / policy profile configured to use that RADIUS group for iPSK authentication.
- The WLAN’s SSID matching the Context’s SSID Name exactly.
Refer to Cisco’s EasyPSK Deployment Guide for Catalyst 9800 for the supported IOS XE releases and the exact CLI/AAA configuration steps.
Configuring the SSID
Section titled “Configuring the SSID”The controller side is the same AAA setup and WLAN security used for any EntryPoint RADIUS SSID, plus the Easy-PSK AKM. The full walkthrough (RADIUS server, server group, method lists, policy profile, and tags) is on the EntryPoint page, Cisco Catalyst 9800. The EasyPSK essentials:
-
Point the controller at the Context over RADIUS
On Configuration → Security → AAA, add the Context’s RADIUS endpoint as a server (host, ports, and shared secret from Network Integration), put it in a server group, and add a network authorization method list that targets the group.
The EasyPSK Context added as a RADIUS server on the Catalyst 9800. -
Set the WLAN security to Easy-PSK
On the WLAN’s Security → Layer2 tab, choose WPA + WPA2, tick MAC Filtering and select the Authorization List, then under AKM tick PSK and Easy-PSK. Give the SSID a name that matches the Context’s SSID Name exactly.
The EasyPSK WLAN: MAC Filtering with an authorization list, and the PSK and Easy-PSK AKMs. -
Enable Allow AAA Override
On the Policy Profile → Advanced tab, enable Allow AAA Override. Without it the controller ignores the per-client key the platform returns. Map the WLAN to the policy profile with a Policy Tag and assign it to the access points.
The platform returns the per-client key as the Cisco AV-pairs
psk-mode=ascii and psk=<key>. On Catalyst the key rides in psk=,
not the Tunnel-Password that Cisco Meraki expects.
Note
Cisco’s “Easy PSK” feature runs in Local mode with central switching only (not FlexConnect) and needs IOS-XE 17.6.1 or later.
Transport
Section titled “Transport”RadSec (RADIUS over TLS, on the Context’s RadSec port) secures the session over the public internet; alternatively, bind the Context to a Service Connector so the RADIUS path runs through your Organization’s private IPsec tunnel. Either way, the Context’s RADIUS access allow-list governs which source ranges may reach the service.
Per-group network attributes and segmentation
Section titled “Per-group network attributes and segmentation”VLANs, Cisco AV-pairs, and other attributes returned to the WLC at authentication are controlled with Attribute Profiles on the Context, assignable per group.
One difference from Meraki: the Catalyst 9800 keeps Identity-PSK groups segmented through the WLC’s own iPSK tag, so you do not return a UDN tag here. Set only the VLAN or policy attributes each group should receive, and the WLC handles the per-group isolation. On Cisco Meraki the same isolation needs an explicit UDN tag in the RADIUS response.