--- title: "Cisco Meraki Captive Portal Setup with MyWiFi (2026 Guide)" description: "Step-by-step Cisco Meraki captive portal setup for WiFi marketing resellers. Configure SSID, splash page, RADIUS, and analytics with MyWiFi Networks." keywords: ["meraki captive portal setup", "cisco meraki wifi marketing", "meraki splash page configuration", "meraki radius setup", "meraki guest wifi reseller"] canonical: "/blog/cisco-meraki-captive-portal-setup" meta_title: "Cisco Meraki Captive Portal Setup Guide | MyWiFi Networks" meta_description: "Step-by-step Cisco Meraki captive portal setup for WiFi marketing resellers. Configure SSID, splash page, RADIUS, and analytics with MyWiFi Networks." slug: "cisco-meraki-captive-portal-setup" date: "2026-03-25" author: "MyWiFi Networks" brand: "MyWiFi Networks" category: Technology tags: ["wifi hardware", "cisco meraki", "captive portal", "reseller"] geo_optimized: true geo_date: "2026-03-25" reading_time: "8 min" og_image_alt: "Cisco Meraki captive portal setup with MyWiFi Networks dashboard" canonical_url: "https://www.mywifinetworks.com/blog/cisco-meraki-captive-portal-setup" schema_type: "BlogPosting" target_keyword: "meraki captive portal setup" featured: false --- # Cisco Meraki Captive Portal Setup with MyWiFi (2026 Guide) > **Key Takeaways:** Cisco Meraki is the most-deployed enterprise WiFi platform on MyWiFi Networks. Configuration takes under 20 minutes per SSID using the Meraki Dashboard and MyWiFi's external splash page integration. Meraki's CMX Scanning API feeds real-time presence analytics — footfall, dwell time, new vs. returning — directly into your reseller dashboard. RADIUS authentication is optional but recommended for venues requiring WPA2-Enterprise. Every feature in MyWiFi (social login, WhatsApp, marketing automation, white-label portals) works with Meraki hardware at full parity. Cisco Meraki is cloud-managed by design. Every access point, switch, and security appliance reports back to the Meraki Dashboard, which means configuration changes propagate to hundreds of APs without touching physical hardware. For WiFi marketing resellers, this matters because your clients' Meraki infrastructure is already centralized — you connect MyWiFi once at the dashboard level, and every venue under that Meraki organization inherits the captive portal setup. This guide walks through the complete configuration: SSID setup, splash page integration, RADIUS authentication, walled garden rules, CMX analytics, and the common mistakes that burn hours on support tickets. --- ## Why Meraki is the top choice for reseller deployments Meraki holds the "Most Popular" badge on the MyWiFi [hardware compatibility page](/hardware) for a reason. The cloud-first architecture eliminates the on-site controller that other enterprise vendors require. Your client's IT team manages APs from a browser, and your captive portal integration lives alongside their network policies without conflict. The Meraki Dashboard API and CMX Scanning API give resellers two data channels. The Dashboard API handles configuration — SSIDs, splash page URLs, client policies. The CMX Scanning API pushes real-time location and presence data to MyWiFi for analytics: how many people walked past versus connected, average dwell time, visit frequency, and device fingerprints. For resellers managing 10 to 200 venues, Meraki's organizational hierarchy (Organization → Network → SSID) maps cleanly to MyWiFi's multi-location structure. One Meraki organization can contain dozens of networks, each with its own guest SSID pointed at a different branded captive portal. --- ## Prerequisites Before starting, confirm these are in place: - **Meraki Dashboard access** with Organization Admin or Network Admin privileges - **Meraki license** active on all APs that will serve the guest SSID (Meraki APs require an active license to function) - **MyWiFi account** with at least one location created. If you are white-labeling, the location should already be assigned to your client's sub-account - **DNS access** if you are using a custom captive portal domain (e.g., `wifi.youragency.com`) --- ## Step 1: Create the guest SSID in Meraki Dashboard Log into the Meraki Dashboard at `dashboard.meraki.com`. Navigate to **Wireless → SSIDs**. Meraki supports up to 15 SSIDs per AP. Select an unused SSID slot and enable it. **SSID configuration:** - **Name:** Use your client's brand or a descriptive guest network name. MyWiFi supports emoji in SSID names, but Meraki does not — keep it alphanumeric with spaces and hyphens. - **Association mode:** Set to **Open (no encryption)**. This is standard for guest captive portals. Guests connect without a password and are redirected to the splash page. - **Splash page:** Select **Sign-on with → My RADIUS server** if using RADIUS authentication, or **Click-through splash page** for basic redirect. For MyWiFi integration, the recommended setting is **Sign-on with → my RADIUS server** to use full authentication flow. - **Walled garden:** This is critical. Add the MyWiFi splash page domains and any social login provider domains to the walled garden so guests can reach the login page before full internet access is granted. **Walled garden entries for MyWiFi:** ```text *.mywifi.io *.mywifinetworks.com *.facebook.com *.google.com *.googleapis.com *.apple.com *.whatsapp.com ``` Add your custom portal domain if applicable. Without the correct walled garden entries, guests will see connection timeouts instead of your splash page. --- ## Step 2: Configure the splash page URL Under **Wireless → SSIDs → Splash page**, set the **Custom splash URL** to your MyWiFi portal URL. This URL is found in your MyWiFi dashboard under **Location → Portal Settings → Portal URL**. The URL format is typically: ```text https://portal.mywifi.io/location/{location-id} ``` Or, if you have configured a custom portal domain: ```text https://wifi.youragency.com/location/{location-id} ``` Meraki will redirect all unauthenticated clients on this SSID to this URL. After the guest completes the login process (social login, email form, [WhatsApp OTP](/blog/whatsapp-wifi-login-native), or any other method), MyWiFi sends the authorization callback to Meraki, and the guest gains internet access. **Redirect behavior:** Meraki passes several query parameters to your splash URL including `base_grant_url`, `user_continue_url`, `node_mac`, and `client_mac`. MyWiFi's Meraki integration parses these automatically. Do not strip query parameters from the redirect. --- ## Step 3: RADIUS authentication (recommended) RADIUS gives you authenticated sessions rather than click-through access. This means MyWiFi can enforce session timeouts, bandwidth limits, and per-user policies. In the Meraki Dashboard under **Wireless → SSIDs → Access control**, configure: - **RADIUS server:** Enter the MyWiFi RADIUS server IP and port provided in your MyWiFi dashboard under **Location → Hardware Settings → RADIUS Configuration** - **RADIUS secret:** Use the shared secret from the same MyWiFi configuration page - **RADIUS accounting:** Enable this. Accounting packets tell MyWiFi when a session starts, how long it lasts, and how much data the guest transfers. This feeds your analytics dashboard. - **RADIUS CoA (Change of Authorization):** Enable if you want MyWiFi to dynamically disconnect or re-authorize users mid-session (useful for time-limited free WiFi before paid upgrade). Test the RADIUS connection from the Meraki Dashboard. Meraki provides a built-in RADIUS test under the access control settings. A successful test returns an `Access-Accept` response. --- ## Step 4: CMX Scanning API for presence analytics The Meraki CMX (Connected Mobile Experiences) Scanning API is what separates Meraki from most other vendors in terms of analytics depth. CMX sends real-time location data to a webhook endpoint — MyWiFi processes this into actionable analytics. **Setup in Meraki Dashboard:** 1. Navigate to **Network-wide → General → Scanning API** 2. Enable the Scanning API 3. Add MyWiFi's CMX webhook URL (found in your MyWiFi dashboard under **Location → Hardware Settings → CMX Configuration**) 4. Set the scanning interval (60 seconds is standard; lower intervals increase API call volume) 5. Meraki will send a validation request to confirm the endpoint. MyWiFi handles this automatically. **What CMX provides:** - **Footfall:** Count of unique devices detected by APs, including those that did not connect. This is the "passersby" metric — people who were in range but did not log in. - **Dwell time:** How long each device was within AP range. Useful for understanding venue engagement patterns. - **New vs. returning:** Device MAC comparison across time periods. MyWiFi deduplicates across randomized MACs where possible using authenticated session data. - **Heatmaps:** If you upload a floor plan to Meraki, CMX can estimate device positions. MyWiFi can visualize this as a presence heatmap in the analytics dashboard. CMX data is aggregated in your MyWiFi dashboard alongside captive portal login data, giving you a complete picture: how many people were present, how many connected, how many logged in, and what they did after. --- ## Step 5: Client isolation and security policies Guest networks should be isolated from your client's production network. Meraki makes this straightforward. **Under Wireless → SSIDs → Firewall & traffic shaping:** - **Client isolation:** Enable Layer 3 client isolation. This prevents guest devices from communicating with each other on the same SSID. - **Deny local LAN access:** Add a firewall rule blocking traffic from the guest SSID to the production VLAN range. Typical rule: Deny → Destination → Local LAN. **Under Wireless → SSIDs → Addressing and traffic:** - **VLAN tagging:** Assign the guest SSID to a dedicated VLAN (e.g., VLAN 100). This isolates guest traffic at the switch level. - **DHCP:** Either use the Meraki MX as DHCP server for the guest VLAN, or configure a separate DHCP scope on your client's router. **Bandwidth limits:** Under the same traffic shaping settings, set per-client bandwidth limits. A reasonable default for guest WiFi is 5 Mbps down / 2 Mbps up. This prevents a single guest from saturating the link while keeping the experience functional. Adjust per venue type — a [hotel with loyalty programs](/blog/hotel-wifi-data-loyalty-programs) may want higher limits for premium guests. --- ## Step 6: Testing and verification Before going live at a client venue, test the complete flow: 1. **Connect to the guest SSID** from a mobile device (test on both iOS and Android) 2. **Verify the splash page loads** — you should see your branded MyWiFi captive portal, not a Meraki default page or a timeout 3. **Complete a login** using each method you have enabled (social, email, WhatsApp, etc.) 4. **Confirm internet access** is granted after login 5. **Check the MyWiFi dashboard** — the test connection should appear in the location's guest list within 60 seconds 6. **Verify CMX data** — if Scanning API is enabled, presence data should start flowing within the scanning interval **Common issues:** - **Splash page does not load:** Walled garden is missing entries. Double-check that all MyWiFi and social provider domains are listed. - **Login completes but internet access is denied:** RADIUS configuration mismatch. Verify the shared secret, server IP, and port match exactly between Meraki and MyWiFi. - **CMX data not appearing:** The Scanning API validation request failed. Re-add the webhook URL and check that MyWiFi's endpoint returned a 200 response to Meraki's validator. --- ## Scaling across multiple venues The real value of Meraki for resellers is multi-venue management. If your client has 30 locations under one Meraki organization, you can template the SSID configuration and apply it across all networks. **Meraki Configuration Templates:** Create a template network in the Meraki Dashboard with the guest SSID, splash page, RADIUS, and walled garden pre-configured. Bind client networks to this template. Any change to the template propagates to all bound networks. In MyWiFi, each venue is a separate location with its own portal design, branding, and analytics. The RADIUS credentials and splash page URL are unique per location. When you bind a Meraki network to a template, override the splash page URL at the network level to point to the correct MyWiFi location. For resellers managing large portfolios, MyWiFi's [white-label platform](/blog/white-label-wifi-agency-pitch) lets you assign each client their own dashboard with only their locations visible. Your Meraki integration details stay in the parent account. --- ## Analytics and reporting for your clients Once Meraki and MyWiFi are connected, your client's analytics dashboard includes: - **Guest capture rate:** Percentage of connected users who completed the captive portal login. Industry average is 30 to 45%. Optimized portals with one-click social login push this above 60%. See our [captive portal best practices guide](/blog/captive-portal-best-practices) for conversion optimization. - **Visitor demographics:** Name, email, age range, gender (from social login), device type, OS, and visit frequency - **Presence vs. connection:** CMX provides the total foot traffic number; captive portal provides the opted-in subset. The gap between these two numbers is your client's conversion opportunity. - **Marketing automation:** Triggered campaigns fire on connect, disconnect, inactive period, and birthday. [Marketing automation workflows](/blog/wifi-marketing-revenue-streams-guide) turn guest data into revenue for your clients. Schedule automated PDF reports from MyWiFi to your clients. Weekly or monthly reports with venue-level metrics keep your managed service sticky. --- ## Meraki licensing considerations for resellers Meraki APs require an active dashboard license to function. This is a per-AP, per-year cost that your clients pay to Cisco. As a reseller, factor this into your pricing model. - **License tiers:** Meraki offers Standard and Advanced licenses. Standard covers all captive portal and RADIUS features needed for MyWiFi integration. Advanced adds features like RF optimization and air marshal — useful for dense deployments but not required for WiFi marketing. - **Co-termination:** Meraki licenses within an organization co-terminate. Adding a new AP extends or shortens the license expiration date for all APs in that org. Plan renewals accordingly. - **Cost comparison:** Meraki's licensing adds $150 to $300/year per AP depending on model and license tier. For resellers price-sensitive on hardware costs, compare with [Ubiquiti UniFi](/blog/ubiquiti-unifi-guest-wifi-marketing) (no recurring license) or Cambium Networks (no per-AP licensing, [coming soon to MyWiFi](/blog/cambium-cnmaestro-integration)). Your [pricing model](/pricing) should account for hardware licensing as a pass-through or bundled cost. Many resellers include hardware management in their monthly fee, absorbing Meraki licensing into the service margin. --- ## FAQ ### How long does the Meraki captive portal setup take? Initial configuration takes 15 to 20 minutes per SSID if you have Meraki Dashboard access and a MyWiFi location already created. Template-based deployments across multiple venues take 5 minutes per additional network. ### Does MyWiFi support Meraki MR, MS, and MX devices? The captive portal integration applies to Meraki MR access points (the wireless APs). MS switches and MX security appliances handle network infrastructure but do not serve SSIDs directly. The MX can act as a DHCP server and firewall for the guest VLAN. ### Can I use Meraki's built-in splash page instead of MyWiFi? Meraki has a basic built-in splash page editor, but it does not support social login, marketing automation, analytics, or white-labeling. MyWiFi replaces Meraki's splash page with a full-featured captive portal. The integration uses Meraki's "External splash page" mode, which is the configuration described in this guide. ### What happens if the Meraki license expires? If a Meraki license expires, the AP continues to function for a grace period (typically 30 days), but Dashboard management is restricted. After the grace period, APs may stop serving SSIDs entirely. This would take down the guest network and captive portal. Monitor license expiration dates proactively. ### Does the integration work with Meraki Go (GR series)? Meraki Go is a separate product line targeted at small businesses without IT staff. It uses a different management app and does not support external splash pages or RADIUS in the same way as the enterprise MR series. MyWiFi's Meraki integration is designed for the enterprise MR line managed through `dashboard.meraki.com`. ### Can I run WiFi marketing on the same SSID as corporate access? Do not do this. Always create a dedicated guest SSID for the captive portal. Mixing guest portal traffic with corporate access creates security risks and confuses the authentication flow. Meraki supports up to 15 SSIDs per AP — there is no shortage of SSID slots. --- ## Next steps 1. **Set up your first Meraki venue** — Create a location in MyWiFi, configure the Meraki SSID, and test the captive portal flow end-to-end 2. **Explore the full hardware lineup** — MyWiFi supports [20+ hardware vendors](/hardware) including Aruba, Ruckus, UniFi, Fortinet, and more 3. **Optimize your portal design** — Read the [captive portal design patterns](/blog/captive-portal-design-patterns) guide for conversion-tested templates 4. **Review pricing** — See [MyWiFi pricing plans](/pricing) to match your deployment scale 5. **Request a demo** — [Book a demo](/demo) to see the Meraki integration in a live environment Cisco Meraki and MyWiFi Networks together give resellers a fully cloud-managed, enterprise-grade WiFi marketing stack. The hardware is proven, the integration is native, and every feature — from [WhatsApp login](/blog/whatsapp-wifi-login-native) to [automated guest segmentation](/blog/ai-powered-guest-segmentation-explained) — works at full parity on Meraki infrastructure. Configure once, deploy across your entire client portfolio, and let the data compound.