A Meraki Group Policy is a named set of network rules that can be applied to any device or IPSK identity on a network. Policies can control:
QuuPass attaches a group policy to each credential it issues. This lets you give different tiers of guests (e.g. standard visitors vs. event VIPs) different levels of network access without changing the SSID configuration.
The group policy ID is embedded directly in the IPSK identity record that QuuPass creates via the Meraki API. Meraki applies the policy as soon as the device connects using that credential's passphrase.
The RADIUS Access-Accept response from QuuPass includes a Filter-Id attribute (RADIUS attribute 11) containing the group policy name. Meraki reads this attribute and applies the matching group policy to the session. The SSID must have RADIUS attribute for group policies set to Filter-Id.
The right group policies will vary by venue, but below are the configurations we recommend as a starting point for most guest deployments.
Add L3 firewall rules denying access to 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Even if guests are on a separate VLAN, an explicit firewall rule prevents accidental routing between guest and corporate segments.
In Mode B, QuuPass sends the group policy name (not its ID) in the RADIUS Filter-Id attribute. The name must match exactly what is configured in Meraki Dashboard — including capitalisation and spacing. Use names like Guest-Standard or Guest-VIP and avoid special characters.
Using a VLAN in the group policy places guest traffic on an isolated segment at Layer 2, making it easier to apply QoS and monitor usage independently from your core network.
Bandwidth limits in a group policy apply per-client. Avoid relying solely on SSID-level limits, which cap the total throughput shared across all connected clients and are difficult to adjust without affecting everyone.
Meraki group policies support per-day scheduling. For venues like conference centres or schools where access should be restricted outside opening hours, combine QuuPass credential expiry with Meraki's schedule feature for defence in depth.
If QuuPass cannot match a RADIUS Filter-Id to a policy name it falls back to the default network policy. Make sure your default policy is restrictive — treat it as a "minimal access" state rather than assuming it will never be hit.
Guest-Standard)