Cisco Meraki Captive Portal Setup with MyWiFi (2026 Guide)
Key Takeaways: Cisco Meraki is the most-deployed enterprise WiFi platform on MyWiFi Networks. Configuration takes under 20 minutes per SSID using the Meraki Dashboard and MyWiFi's external splash page integration. Meraki's CMX Scanning API feeds real-time presence analytics — footfall, dwell time, new vs. returning — directly into your reseller dashboard. RADIUS authentication is optional but recommended for venues requiring WPA2-Enterprise. Every feature in MyWiFi (social login, WhatsApp, marketing automation, white-label portals) works with Meraki hardware at full parity.
Cisco Meraki is cloud-managed by design. Every access point, switch, and security appliance reports back to the Meraki Dashboard, which means configuration changes propagate to hundreds of APs without touching physical hardware. For WiFi marketing resellers, this matters because your clients' Meraki infrastructure is already centralized — you connect MyWiFi once at the dashboard level, and every venue under that Meraki organization inherits the captive portal setup.
This guide walks through the complete configuration: SSID setup, splash page integration, RADIUS authentication, walled garden rules, CMX analytics, and the common mistakes that burn hours on support tickets.
Why Meraki is the top choice for reseller deployments
Meraki holds the "Most Popular" badge on the MyWiFi hardware compatibility page for a reason. The cloud-first architecture eliminates the on-site controller that other enterprise vendors require. Your client's IT team manages APs from a browser, and your captive portal integration lives alongside their network policies without conflict.
The Meraki Dashboard API and CMX Scanning API give resellers two data channels. The Dashboard API handles configuration — SSIDs, splash page URLs, client policies. The CMX Scanning API pushes real-time location and presence data to MyWiFi for analytics: how many people walked past versus connected, average dwell time, visit frequency, and device fingerprints.
For resellers managing 10 to 200 venues, Meraki's organizational hierarchy (Organization → Network → SSID) maps cleanly to MyWiFi's multi-location structure. One Meraki organization can contain dozens of networks, each with its own guest SSID pointed at a different branded captive portal.
Prerequisites
Before starting, confirm these are in place:
- •Meraki Dashboard access with Organization Admin or Network Admin privileges
- •Meraki license active on all APs that will serve the guest SSID (Meraki APs require an active license to function)
- •MyWiFi account with at least one location created. If you are white-labeling, the location should already be assigned to your client's sub-account
- •DNS access if you are using a custom captive portal domain (e.g.,
wifi.youragency.com)
Step 1: Create the guest SSID in Meraki Dashboard
Log into the Meraki Dashboard at dashboard.meraki.com. Navigate to Wireless → SSIDs. Meraki supports up to 15 SSIDs per AP. Select an unused SSID slot and enable it.
SSID configuration:
- •Name: Use your client's brand or a descriptive guest network name. MyWiFi supports emoji in SSID names, but Meraki does not — keep it alphanumeric with spaces and hyphens.
- •Association mode: Set to Open (no encryption). This is standard for guest captive portals. Guests connect without a password and are redirected to the splash page.
- •Splash page: Select Sign-on with → My RADIUS server if using RADIUS authentication, or Click-through splash page for basic redirect. For MyWiFi integration, the recommended setting is Sign-on with → my RADIUS server to use full authentication flow.
- •Walled garden: This is critical. Add the MyWiFi splash page domains and any social login provider domains to the walled garden so guests can reach the login page before full internet access is granted.
Walled garden entries for MyWiFi:
*.mywifi.io
*.mywifinetworks.com
*.facebook.com
*.google.com
*.googleapis.com
*.apple.com
*.whatsapp.com
Add your custom portal domain if applicable. Without the correct walled garden entries, guests will see connection timeouts instead of your splash page.
Step 2: Configure the splash page URL
Under Wireless → SSIDs → Splash page, set the Custom splash URL to your MyWiFi portal URL. This URL is found in your MyWiFi dashboard under Location → Portal Settings → Portal URL.
The URL format is typically:
https://portal.mywifi.io/location/{location-id}
Or, if you have configured a custom portal domain:
https://wifi.youragency.com/location/{location-id}
Meraki will redirect all unauthenticated clients on this SSID to this URL. After the guest completes the login process (social login, email form, WhatsApp OTP, or any other method), MyWiFi sends the authorization callback to Meraki, and the guest gains internet access.
Redirect behavior: Meraki passes several query parameters to your splash URL including base_grant_url, user_continue_url, node_mac, and client_mac. MyWiFi's Meraki integration parses these automatically. Do not strip query parameters from the redirect.
Step 3: RADIUS authentication (recommended)
RADIUS gives you authenticated sessions rather than click-through access. This means MyWiFi can enforce session timeouts, bandwidth limits, and per-user policies.
In the Meraki Dashboard under Wireless → SSIDs → Access control, configure:
- •RADIUS server: Enter the MyWiFi RADIUS server IP and port provided in your MyWiFi dashboard under Location → Hardware Settings → RADIUS Configuration
- •RADIUS secret: Use the shared secret from the same MyWiFi configuration page
- •RADIUS accounting: Enable this. Accounting packets tell MyWiFi when a session starts, how long it lasts, and how much data the guest transfers. This feeds your analytics dashboard.
- •RADIUS CoA (Change of Authorization): Enable if you want MyWiFi to dynamically disconnect or re-authorize users mid-session (useful for time-limited free WiFi before paid upgrade).
Test the RADIUS connection from the Meraki Dashboard. Meraki provides a built-in RADIUS test under the access control settings. A successful test returns an Access-Accept response.
Step 4: CMX Scanning API for presence analytics
The Meraki CMX (Connected Mobile Experiences) Scanning API is what separates Meraki from most other vendors in terms of analytics depth. CMX sends real-time location data to a webhook endpoint — MyWiFi processes this into actionable analytics.
Setup in Meraki Dashboard:
- •Navigate to Network-wide → General → Scanning API
- •Enable the Scanning API
- •Add MyWiFi's CMX webhook URL (found in your MyWiFi dashboard under Location → Hardware Settings → CMX Configuration)
- •Set the scanning interval (60 seconds is standard; lower intervals increase API call volume)
- •Meraki will send a validation request to confirm the endpoint. MyWiFi handles this automatically.
What CMX provides:
- •Footfall: Count of unique devices detected by APs, including those that did not connect. This is the "passersby" metric — people who were in range but did not log in.
- •Dwell time: How long each device was within AP range. Useful for understanding venue engagement patterns.
- •New vs. returning: Device MAC comparison across time periods. MyWiFi deduplicates across randomized MACs where possible using authenticated session data.
- •Heatmaps: If you upload a floor plan to Meraki, CMX can estimate device positions. MyWiFi can visualize this as a presence heatmap in the analytics dashboard.
CMX data is aggregated in your MyWiFi dashboard alongside captive portal login data, giving you a complete picture: how many people were present, how many connected, how many logged in, and what they did after.
Step 5: Client isolation and security policies
Guest networks should be isolated from your client's production network. Meraki makes this straightforward.
Under Wireless → SSIDs → Firewall & traffic shaping:
- •Client isolation: Enable Layer 3 client isolation. This prevents guest devices from communicating with each other on the same SSID.
- •Deny local LAN access: Add a firewall rule blocking traffic from the guest SSID to the production VLAN range. Typical rule: Deny → Destination → Local LAN.
Under Wireless → SSIDs → Addressing and traffic:
- •VLAN tagging: Assign the guest SSID to a dedicated VLAN (e.g., VLAN 100). This isolates guest traffic at the switch level.
- •DHCP: Either use the Meraki MX as DHCP server for the guest VLAN, or configure a separate DHCP scope on your client's router.
Bandwidth limits: Under the same traffic shaping settings, set per-client bandwidth limits. A reasonable default for guest WiFi is 5 Mbps down / 2 Mbps up. This prevents a single guest from saturating the link while keeping the experience functional. Adjust per venue type — a hotel with loyalty programs may want higher limits for premium guests.
Step 6: Testing and verification
Before going live at a client venue, test the complete flow:
- •Connect to the guest SSID from a mobile device (test on both iOS and Android)
- •Verify the splash page loads — you should see your branded MyWiFi captive portal, not a Meraki default page or a timeout
- •Complete a login using each method you have enabled (social, email, WhatsApp, etc.)
- •Confirm internet access is granted after login
- •Check the MyWiFi dashboard — the test connection should appear in the location's guest list within 60 seconds
- •Verify CMX data — if Scanning API is enabled, presence data should start flowing within the scanning interval
Common issues:
- •Splash page does not load: Walled garden is missing entries. Double-check that all MyWiFi and social provider domains are listed.
- •Login completes but internet access is denied: RADIUS configuration mismatch. Verify the shared secret, server IP, and port match exactly between Meraki and MyWiFi.
- •CMX data not appearing: The Scanning API validation request failed. Re-add the webhook URL and check that MyWiFi's endpoint returned a 200 response to Meraki's validator.
Scaling across multiple venues
The real value of Meraki for resellers is multi-venue management. If your client has 30 locations under one Meraki organization, you can template the SSID configuration and apply it across all networks.
Meraki Configuration Templates: Create a template network in the Meraki Dashboard with the guest SSID, splash page, RADIUS, and walled garden pre-configured. Bind client networks to this template. Any change to the template propagates to all bound networks.
In MyWiFi, each venue is a separate location with its own portal design, branding, and analytics. The RADIUS credentials and splash page URL are unique per location. When you bind a Meraki network to a template, override the splash page URL at the network level to point to the correct MyWiFi location.
For resellers managing large portfolios, MyWiFi's white-label platform lets you assign each client their own dashboard with only their locations visible. Your Meraki integration details stay in the parent account.
Analytics and reporting for your clients
Once Meraki and MyWiFi are connected, your client's analytics dashboard includes:
- •Guest capture rate: Percentage of connected users who completed the captive portal login. Industry average is 30 to 45%. Optimized portals with one-click social login push this above 60%. See our captive portal best practices guide for conversion optimization.
- •Visitor demographics: Name, email, age range, gender (from social login), device type, OS, and visit frequency
- •Presence vs. connection: CMX provides the total foot traffic number; captive portal provides the opted-in subset. The gap between these two numbers is your client's conversion opportunity.
- •Marketing automation: Triggered campaigns fire on connect, disconnect, inactive period, and birthday. Marketing automation workflows turn guest data into revenue for your clients.
Schedule automated PDF reports from MyWiFi to your clients. Weekly or monthly reports with venue-level metrics keep your managed service sticky.
Meraki licensing considerations for resellers
Meraki APs require an active dashboard license to function. This is a per-AP, per-year cost that your clients pay to Cisco. As a reseller, factor this into your pricing model.
- •License tiers: Meraki offers Standard and Advanced licenses. Standard covers all captive portal and RADIUS features needed for MyWiFi integration. Advanced adds features like RF optimization and air marshal — useful for dense deployments but not required for WiFi marketing.
- •Co-termination: Meraki licenses within an organization co-terminate. Adding a new AP extends or shortens the license expiration date for all APs in that org. Plan renewals accordingly.
- •Cost comparison: Meraki's licensing adds $150 to $300/year per AP depending on model and license tier. For resellers price-sensitive on hardware costs, compare with Ubiquiti UniFi (no recurring license) or Cambium Networks (no per-AP licensing, coming soon to MyWiFi).
Your pricing model should account for hardware licensing as a pass-through or bundled cost. Many resellers include hardware management in their monthly fee, absorbing Meraki licensing into the service margin.
FAQ
How long does the Meraki captive portal setup take?
Initial configuration takes 15 to 20 minutes per SSID if you have Meraki Dashboard access and a MyWiFi location already created. Template-based deployments across multiple venues take 5 minutes per additional network.
Does MyWiFi support Meraki MR, MS, and MX devices?
The captive portal integration applies to Meraki MR access points (the wireless APs). MS switches and MX security appliances handle network infrastructure but do not serve SSIDs directly. The MX can act as a DHCP server and firewall for the guest VLAN.
Can I use Meraki's built-in splash page instead of MyWiFi?
Meraki has a basic built-in splash page editor, but it does not support social login, marketing automation, analytics, or white-labeling. MyWiFi replaces Meraki's splash page with a full-featured captive portal. The integration uses Meraki's "External splash page" mode, which is the configuration described in this guide.
What happens if the Meraki license expires?
If a Meraki license expires, the AP continues to function for a grace period (typically 30 days), but Dashboard management is restricted. After the grace period, APs may stop serving SSIDs entirely. This would take down the guest network and captive portal. Monitor license expiration dates proactively.
Does the integration work with Meraki Go (GR series)?
Meraki Go is a separate product line targeted at small businesses without IT staff. It uses a different management app and does not support external splash pages or RADIUS in the same way as the enterprise MR series. MyWiFi's Meraki integration is designed for the enterprise MR line managed through dashboard.meraki.com.
Can I run WiFi marketing on the same SSID as corporate access?
Do not do this. Always create a dedicated guest SSID for the captive portal. Mixing guest portal traffic with corporate access creates security risks and confuses the authentication flow. Meraki supports up to 15 SSIDs per AP — there is no shortage of SSID slots.
Next steps
- •Set up your first Meraki venue — Create a location in MyWiFi, configure the Meraki SSID, and test the captive portal flow end-to-end
- •Explore the full hardware lineup — MyWiFi supports 20+ hardware vendors including Aruba, Ruckus, UniFi, Fortinet, and more
- •Optimize your portal design — Read the captive portal design patterns guide for conversion-tested templates
- •Review pricing — See MyWiFi pricing plans to match your deployment scale
- •Request a demo — Book a demo to see the Meraki integration in a live environment
Cisco Meraki and MyWiFi Networks together give resellers a fully cloud-managed, enterprise-grade WiFi marketing stack. The hardware is proven, the integration is native, and every feature — from WhatsApp login to automated guest segmentation — works at full parity on Meraki infrastructure. Configure once, deploy across your entire client portfolio, and let the data compound.