Hi there,

We currently have an existing Meraki RADIUS application that points to an existing Okta RADIUS running v2.19.0. I’ve spun up a couple new nodes that I’ve put behind a load balancer that are running Okta RADIUS server v2.24.2 and have created a new Meraki RADIUS application to point to this new infrastructure. 

I’ve cloned the settings on the existing Meraki RADIUS application settings that work (other than the port and the secret) for the new application. Here’s the existing app:

And the new:

But every time I try to authenticate with the RADIUS wifi that points to the new RADIUS servers, I see the following in the logs:

2025-04-22 02:31:59 UTC [radius2, pool-2-thread-5] : ERROR - malformed RADIUS packet. Exception message: Access-Request: User-Password or CHAP-Password/CHAP-Challenge missing

2025-04-22 02:31:59 UTC [radius2, pool-2-thread-5] : INFO - Completed processing. packetId=0, totalProcessingTime=0ms, queueTime=0ms, oktaTime=0ms, httpCode=N/A, result=FAILED, remoteAddress=N/A

A Google search returns this:

https://support.okta.com/help/s/article/Unable-to-Authenticate-Users-to-Cisco-Meraki-ERROR-malformed-RADIUS-packet

Which says that Okta RADIUS doesn’t support CHAP and the Meraki has to be configured to use PAP. But it’s obviously configured properly as it’s working with another RADIUS SSID.

I’ve also tried selecting “Use PAP authentication” but I see the same error messages in the Okta RADIUS server logs.

Here’s the config of one of the new RADIUS servers:

*version of OKTARadiusAgent

ragent.version=2.24.2

ragent.okta.token = <MYTOKEN>

ragent.okta.api_endpoint = https://mycompany.okta.com

ragent.ssl.pinning = true

ragent.proxy.enabled = false

ragent.id = <MYRAGENTID>

And the old:

*version of OKTARadiusAgent

ragent.version=2.19.0

ragent.okta.token = <MYTOKEN>

ragent.okta.api_endpoint = https://mycompany.okta.com

ragent.ssl.pinning = true

ragent.proxy.enabled = false

ragent.id = <MYRAGENTID>

BTW, are you supposed to have the okta.radius.sharedSecret config in there or do you not need it since the Meraki will be passing that? I’m guessing it’s not needed since the old one doesn’t have it and it’s working.

So I’m at a bit of a loss. The Okta app seems like it’s configured the same as the existing one that works and the only difference in the Meraki is that it’s pointing to the IPs of the new RADIUS servers. Any help would be greatly appreciated.

Thank you very much!