Aruba Mobility Controllers

Download this guide ⬇

Introduction

Scope and Purpose

Thank you for purchasing the Trusted WiFi solution. This document is a hardware configuration guide describing how to setup Aruba Mobility Controllers for a Trusted WiFi Passpoint service.

• For more information on how to setup an end-to-end Trusted WiFi Passpoint service, please refer to the Trusted WiFi Passpoint Administration Guide.

• For complete information on how to setup Aruba Mobility Controllers, please refer to the vendor’s original documentation.

Documentation Conventions

Passpoint Overview

Passpoint – also known as Hotspot 2.0 – is an industry-wide next generation approach to public internet access driven by the Wi-Fi Alliance that brings the following benefits:

• Frictionless onboarding and roaming, thanks to a one-time registration followed by automatic access to interconnected hotspots

• More secure and private Wi-Fi connections, compared with general visitor networks

Passpoint is based on the IEEE 802.11u standard, which is a set of protocols enabling cellular-like roaming. Following the initial enrollment, frequent users such as visitors, guests or employees bypass repeated logins, forms and passwords, as their mobile devices automatically join the Wi-Fi subscriber service when they return to a venue or roam between inter-linked Passpoint enabled hotpots and providers, while being better protected against potential cyber threats.

If a device supports 802.11u and is enrolled to a service, it automatically communicates with the Wi-Fi infrastructure via the access points to discover the network SSID and connects securely to it by presenting its access credentials. Upon successful authentication, the device is provisioned with Passpoint standards-based management objects - known as Per-Provider Subscription Management Objects (PPS-MO).

GlobalReach - an ASSA ABLOY company - has been involved with Passpoint since its inception and even contributed to the creation and initial pilot testing of the standard. As a result, it is one of the few trusted worldwide experts on this topic, with a proven platform backed by real-world operational experiences at scale.

The best user experience is to offer Passpoint through a customer/brand mobile app integration, as it further simplifies the onboarding process, while incentivizing app downloads and customer loyalty, leading to further engagement and monetization opportunities. To this effect, Trusted WiFi offers a Software Development Kit (SDK) for easy app integration.

End-to-End Service Components

Implementing an end-to-end Trusted WiFi Passpoint service requires a combination of the following software and hardware components:

• Trusted WiFi Passpoint: the core services are offered and managed centrally via the Trusted WiFi Passpoint Module (hosted and operated by GlobalReach). Following an initial setup performed by the GlobalReach Operations team, Managed Service Providers (MSPs) can then add sites to customer realms and monitor the solution.

• Customer Realm: the service requires connectivity to a realm including domain, security certificate and private key, as well as the database holding the users’ Personally Identifiable Information (PII). It is the responsibility of the Identity Provider – typically the customer/brand – to make this part available.

• Mobile App: the best user experience is to offer Passpoint through a customer/brand mobile app integration. Trusted WiFi offers a Software Development Kit (SDK) for easy implementation. It is the responsibility of the app owner – typically the customer/brand – to perform the integration.

• Local Networks: the local networks must be compliant with Passpoint (Hotspot 2.0). – Most recent   Wi-Fi access points and controllers from major vendors support Passpoint today, however older models or products from more exotic manufacturers might not do. The configuration of the local infrastructure is typically handled by the Managed Service Providers (MSPs).

• User Devices: the subscribers’ mobile devices (belonging to visitors, guests, employees, etc.) must be compliant with Passpoint (Hotspot 2.0) – All recent iOS and Android-based smartphones or tablets support Passpoint today, however older models or products running less popular operating systems might not do. Laptops compatibility is also more erratic. It is therefore essential to maintain a traditional onboarding service in parallel with Passpoint to handle non-compatible devices.

High-Level Topology

The diagram below illustrates the high-level topology for the end-to-end Trusted WiFi Passpoint service:

Glossary

The following is a glossary of the most common terms used regarding this solution.

ARUBA MOBILITY CONTROLLERS CONFIGURATION

Supported Versions

Aruba Mobility Controllers support Passpoint from AOS v8.6. Aruba recommends upgrading to the latest version of AOS.

Note

Please refer to the Aruba documentation for further information on which versions of OS code supports which APs.

Warning

The configuration of the RADIUS is documented using the WLAN configuration option. The alternative method, under Configuration > Authentication, is not covered in this document.

Prerequisites

It is assumed the following prerequisites are met before configuring Aruba Mobility Controllers for a Trusted WiFi Passpoint service:

• A supported Aruba Mobility Controller running version 8.6 or greater, activated and licensed.

• A Trusted WiFi account with operator permissions.

• A core Trusted WiFi Passpoint service configured and tested.

• A property in Trusted WiFi with deployed Gateway and Passpoint modules.

• A deployed and configured Wi-Fi network.

Note

This document focuses on a specific part of the Aruba Mobility Controller configuration only.

• Please refer to the Passpoint Administration Guide for instructions on how to configure the end-to-end Passpoint service.

• Please refer to the original Aruba documentation for complete instructions on Aruba Mobility Controllers configuration.

Warning

• The Aruba configuration is focusing on Passpoint v1.0.

• All properties must share the same NAI realm, RADIUS IP / port settings and SSID name for the Passpoint service (CustomerPasspoint).

• Each property requires a separate RADIUS secret and NAS identifier, both generated when a configuration is activated within the Trusted WiFi management platform.

Core Passpoint Settings

• Log into Trusted WiFi, then click on the Properties icon in the left menu to view the properties list.

• Select or search for the property you wish to work on. This will open its deployments page:
  

• Click on the Passpoint tile and then click on the Configuration option in the left menu to display the Passpoint settings summary as per the example below:
  

• Take note of the details for your respective installation as they will be required at a later step.

Aruba Mobility Controllers Configuration

Wi-Fi Network

• Log into the Aruba Mobility Controller with your credentials to display the page below:
  

• In the left-hand navigation menu, proceed to Configuration > WLANs to display the page below:
  

• Click on the + on the lower left side of the screen and enter the Name of the SSID as shown below:
  

• Click on Next and enter the VLAN to be assigned to this SSID, as shown below:
  

• Click on Next to display the page below:
  

• Set the Key management to WPA2 Enterprise from the drop-down list.

• Click on the + symbol in the Auth server’s window to display the page below:
  

• Complete the fields as per the description below:

  Field	Description
  Name	Enter the name of the Server.
  IP address	Enter the <Primary RADIUS IP> from Trusted WiFi.
  Auth Port	Enter the <RADIUS Authentication Port> from Trusted WiFi.
  Accounting port	Enter the <RADIUS Accounting Port> from Trusted WiFi.
  Shared Secret	Enter the <RADIUS Shared Secret> from Trusted WiFi.
  Retype Key	Re-enter the <RADIUS Shared Secret> from Trusted WiFi.
  Timeout	Enter a timeout value.

• Click Submit to save, repeat this operation for the Secondary Server and click Submit to save.

• Click Next to display the page below:
  

• Click on Finish to save the newly configured SSID. The new WLAN displays in the WLANs table.

NAS ID

• In the left-hand menu items, proceed to Configuration > Authentication, then proceed to the Auth Servers tab.

• Under the All Servers heading, select the Auth RADIUS Server that was created earlier to display the page below:
  

• Complete the fields as per the description below:

  Field	Description
  NAS ID	Enter the NAS ID from Trusted WiFi.
  Called Station ID
  Station ID type	MAC Address.
  Station ID Delimiter	Colon.

• Verify all information is correct then click Submit.

Passpoint (Hotspot 2.0)

• Click on the Login Name at the top right of the screen. Select Preferences and check the Show advanced profiles box.
  

Warning

You must be in Advanced mode to configure Passpoint (Hostpot 2.0).

• Click on Save.

• In the left-hand menu items, proceed to Configuration > WLANs to display the page below:
  

• In the WLANs table menu, click on the newly created Passpoint SSID:
  

• Click on Profiles in the SSID section to display the page below and proceed to Wireless LAN > Virtual AP > [SSID name]:
  

• In the side menu tree, select the Hotspot 2.0 option:
  

Note

The Hotspot 2.0 profile shown above is an example that has been previously configured.

• To configure a new Hotspot profile, click on the + symbol to display the options below:
  

• Complete the fields as per the description below:

  Field	Description
  Advertise Hotspot 2.0 Capability	Check the box.
  ANQP Domain ID	Enter a sequential: 1.
  OSU NAI	Enter the <customer realm> from Trusted WiFi.
  Access network Type	Select public-free from the drop-down list.
  Roaming Consortium OI value 1	Keep blank.
  Time zone	Enter the time zone (scroll to the bottom of the page).

• Click on Submit.

ANQP NAI Realm

• In the left-hand menu items, proceed to Configuration > System, then select the Profiles tab:
  

• Click on the Wireless LAN tab to display the following options:
  

• Click on ANQP NAI Realm to display the following options:
  

• Click on the + to the right of the ANQP NAI Realm Profile to create a new NAI realm:
  

• Complete the fields as per the description below:

  Field	Description
  NAI Realm Name	Enter the <customer realm> from Trusted WiFi.
  NAI Realm EAP Method 1	Select eap-ttls.
  ANQP NAI Realm Authentication Param 1	Click the + icon to create a new one and enter the values as below:
  ID	expanded-eap.
  VALUE	eap-peap-mschapv2. Click OK to save.
  NAI Realm EAP Method 2	None.

• Click on Submit to save the realm configuration.

• Go to Profile > Advertisement > ANPQ NAI Realm to display the options below:
  

• Select the ANQP NAI realm that was previously created and click Submit to save.

Deploy Changes

• To save the above Passpoint configuration to the Aruba Mobility Controller, click on the Pending Changes button at the top right of the screen and click Deploy Changes.
  

Note

You can click on the blue + sign to view the configuration if desired.