> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wiacom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Portal

> Captive portal configuration on Cisco Meraki Dashboard

Portal on Meraki uses an open SSID with a Wiacom splash URL and RADIUS-based per-session authentication. When a guest connects and opens a browser, Meraki redirects them to the Wiacom portal.

<Tip>
  **API mode users:** If you integrated Wiacom via the Meraki API, all SSID settings — splash URL, RADIUS servers, and walled garden — are pushed automatically. No manual configuration is required. You can skip to [Walled Garden](#walled-garden) if you need to add social login providers or whitelist other destinations.
</Tip>

## Authentication Model

Wiacom uses **per-session generated credentials** for RADIUS authentication — not the guest's MAC address. A unique username and password are generated for each portal session and sent to the Wiacom RADIUS server.

## Manual Configuration (Legacy / Non-API Mode)

If you are not using API mode, configure the SSID manually in the Meraki Dashboard as follows.

<Warning>
  Portal URL, RADIUS server details, and shared secrets are region-specific. Obtain all values from the Wiacom admin panel or the Wiacom team before proceeding.
</Warning>

### Access Control

Log in to [dashboard.meraki.com](https://dashboard.meraki.com), navigate to **Wireless → Access Control**, and select your SSID from the dropdown.

| Setting                                                       | Value                                               |
| ------------------------------------------------------------- | --------------------------------------------------- |
| SSID status                                                   | Enabled                                             |
| Security                                                      | Open (no encryption)                                |
| Splash page                                                   | Sign-on with "my RADIUS server"                     |
| Advanced splash settings > Captive portal strength            | Block all access until sign-on is complete          |
| Advanced splash settings > Walled garden                      | Enabled — see [Walled Garden](#walled-garden) below |
| Advanced splash settings > Simultaneous logins                | Allow                                               |
| Advanced splash settings > Controller disconnection behaviour | Default                                             |
| Client IP and VLAN                                            | As preffered, per your network config               |

### RADIUS Authentication Servers

Under **RADIUS**, click **Add server** and add two entries:

| # | Host                | Auth Port | Secret                   |
| - | ------------------- | --------- | ------------------------ |
| 1 | `<RADIUS_SERVER_1>` | 1812      | `<RADIUS_SHARED_SECRET>` |
| 2 | `<RADIUS_SERVER_2>` | 1812      | `<RADIUS_SHARED_SECRET>` |

### RADIUS Accounting Servers

Under **RADIUS accounting**, click **Add server** and add two entries:

| # | Host                | Accounting Port | Secret                   |
| - | ------------------- | --------------- | ------------------------ |
| 1 | `<RADIUS_SERVER_1>` | 1813            | `<RADIUS_SHARED_SECRET>` |
| 2 | `<RADIUS_SERVER_2>` | 1813            | `<RADIUS_SHARED_SECRET>` |

Set **Accounting interim interval** to **4 minutes**.

### Advanced RADIUS Settings

If the **Advanced RADIUS settings** section is present, configure:

| Setting           | Value                              |
| ----------------- | ---------------------------------- |
| Called-Station-ID | AP MAC address (remove any others) |
| NAS ID            | remove any others                  |
| Server timeout    | 5 seconds                          |
| Retry count       | 3                                  |

Click **Save Changes**.

### Splash Page

Navigate to **Wireless → Splash Page** and configure:

| Setting                                      | Value                                                                            |
| -------------------------------------------- | -------------------------------------------------------------------------------- |
| Custom splash URL                            | `<PORTAL_URL>`                                                                   |
| Where should users go after the splash page? | The URL they were trying to fetch, or a specific redirect URL provided by Wiacom |

Click **Save Changes**.

## Walled Garden

The walled garden allows unauthenticated devices to reach the portal and social login providers before completing sign-on. In API mode this is configured automatically. In legacy mode, add the following domains under **Wireless → Splash Page → Walled garden**:

| Category             | Domains                                                                                              |
| -------------------- | ---------------------------------------------------------------------------------------------------- |
| **Required**         | `*.wiacom.ai` , `*.wiacom.io`                                                                        |
| CDN                  | `*.akamaitechnologies.com`, `*.akamaiedge.net`, `*.akamaized.net`, `*.amazonaws.com`, `*.fastly.net` |
| Facebook / Instagram | `*.facebook.com`, `*.fbcdn.net`, `*.akamaihd.net`, `connect.facebook.net`, `*.instagram.com`         |
| Google               | `accounts.google.com`, `*.googleapis.com`, `*.gstatic.com`                                           |
| Twitter / X          | `*.twitter.com`, `*.twimg.com`                                                                       |
| LinkedIn             | `*.linkedin.com`, `*.licdn.net`, `*.licdn.com`                                                       |

<Info>Please note, other Walled Garden entries may be requiered - Ask Wiacom for details</Info>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Guest not redirected to portal">
    Confirm the SSID is set to Open and a custom splash option is selected. Try `http://neverssl.com` — HTTPS traffic is not intercepted by the captive portal mechanism.
  </Accordion>

  <Accordion title="Guest completes form but no internet access">
    Check RADIUS Accounting is enabled at the Meraki organisation level. In legacy mode, verify the RADIUS server addresses and shared secret match what was provided by Wiacom. In API mode, check the RADIUS settings pushed by Wiacom under **Inventory → Controllers → \[SSID row]**.
  </Accordion>

  <Accordion title="Social login fails">
    Ensure the relevant social provider domains are present in the Meraki splash walled garden. In API mode, Wiacom pushes the core walled garden — social login domains may need to be added manually if not already present.
  </Accordion>
</AccordionGroup>