EasyPSK via RADIUS overview

EasyPSK via RADIUS is the primary delivery method under the EasyPSK for Cisco Networks umbrella, and it is created and managed as an EntryPoint Context: the wizard variant is EntryPoint 2.0 (EasyPSK). Instead of provisioning every key onto the wireless platform up front through the Cisco Meraki Dashboard API (the Meraki WPN way), the platform acts as your wireless network’s RADIUS server: when a device joins the SSID, Cisco exposes the key the user typed, and EasyPSK places the device in the matching group.

Cisco Meraki

Catalyst 9800 WLC

RADIUS / RadSec → or Service Connector (IPSec)

Netgraph EasyPSK cloud RADIUS

Your wireless network authenticates each connecting device against the platform over RADIUS. The key the user typed identifies the group; keys are resolved at connection time instead of being pre-provisioned on the wireless platform, so there is no provisioning cap on key count.

What you get

• One key, the right group. Each group in the Context owns one Pre-Shared Key (or, with the Dedicated flavour, one key per device). The platform generates the keys; they are unique within the EntryPoint and regenerate-only.
• Three security flavours per group — Instant (frictionless, devices auto-register), Approved (devices must be pre-registered), and Dedicated (a unique key per device). See Groups and security flavours.
• Scale without provisioning. Keys are resolved over RADIUS at connect time: the service handles 100,000+ keys and scales horizontally, so the practical ceiling is far higher. Meraki WPN’s Dashboard-API provisioning, by contrast, is bounded at 5,000 keys per Meraki network.
• Group rules. A site, a Self-Service Experience, a device cap, an end date (Valid until) and wired devices through MAB, all on the group’s Rules card, plus blocking of single devices. See Group rules.
• Sites and Site managers. Groups that belong together form a site with a policy for new groups, and a Site manager role lets a caretaker, a reception or a fair organiser create and maintain the site’s groups from the Self-Service portal. See Sites and Site managers.
• Onboarding rules. A person gets a group of their own the first time they sign in to the Self-Service portal, matched by email domain, address or team. See Self-service onboarding.
• Wi-Fi Key Cards and the poster. Printed cards with the network name, the key and a QR code, from your own designs, and a poster that leads people to the portal. See Wi-Fi Key Cards.
• Six Self-Service Experiences. Home-like Wi-Fi, Co-working, Campus, Expo halls, Hospitality and IoT set the words the portal, the invitations and the key cards use, per service, site or group. See Group rules.
• Works across Cisco wireless. Anything that can point an Identity-PSK SSID at an external RADIUS server: Cisco Meraki (Identity PSK with RADIUS) and Cisco Catalyst 9800.
• Self-Service. Group members can see their key and, if you allow it, rotate it themselves; Dedicated device keys are managed per device. Whole Self-Service Teams can be bound to a group, kept by hand or by your identity provider.

Setting it up

1. Create the Context

   From the Organization’s Services overview, click Add Service Context and pick the EntryPoint - RADIUSaaS card. Choose EntryPoint 2.0 (EasyPSK) as the RADIUSaaS Context Type, name the Context, and enter the SSID Name — the Wi-Fi network name devices connect to. It must match the SSID broadcast by your access points.

   

   Add Service Context: the EntryPoint - RADIUSaaS card is the start of EasyPSK via RADIUS.

   

   Create RADIUSaaS Context with the EntryPoint 2.0 (EasyPSK) variant: name, description, and the SSID Name the keys belong to.

2. Point your wireless at the Context

   Open Configuration → Network Integration to find the Context’s RADIUS hostname and the authentication, accounting, and RadSec ports, and to set the RADIUS client secret your network equipment authenticates with. The same page holds the RadSec toggle, the server certificate, the RADIUS access allow-list (CIDR), and the optional Service Connector binding for a private IPsec path. Then configure the SSID on the wireless side: Cisco Meraki or Cisco Catalyst 9800.

   

   Network Integration: the RADIUS endpoints your wireless points at, via the internet or privately through a Service Connector.

3. Create the groups

   One group per unit, team, or audience. Pick each group’s security flavour at creation; the platform generates the group’s key. See Groups and security flavours.

4. Distribute keys and invite members

   Reveal a group’s key from Group Settings and share it with the unit, print it as a Wi-Fi Key Card, or invite members as Self-Service Users so they can see it (and rotate it, if you allow self-service regeneration) from the Self-Service portal.

Transport

Option	What it is
RADIUS / RadSec	The Context exposes per-Context authentication, accounting, and RadSec ports; enable RadSec for RADIUS over TLS
Service Connector	The RADIUS traffic runs through your Organization’s private IPsec tunnel instead of over the public internet

Restrict who can reach the RADIUS service with the RADIUS access allow-list (CIDR ranges) on the Network Integration tab.

RadSec and the allow-list: RADIUS over TLS across the internet, from the addresses you list.

The Service Connector binding: the RADIUS path runs through the private IPsec tunnel.