Download this guide ⬇
INTRODUCTION
Scope and Purpose
Thank you for purchasing the Trusted WiFi solution. This document is a hardware configuration guide describing how to setup Ubiquiti UniFI Network Server software for a Trusted WiFi Passpoint service.
For more information on how to setup an end-to-end Trusted WiFi Passpoint service, please refer to the Trusted WiFi Passpoint Administration Guide.
For complete information on how to setup Ubiquiti UniFI Network Server software, please refer to the vendor’s original documentation.
Documentation Conventions
The following conventions are used throughout this document:
Notes: Helpful information, suggestions or references.
Warning: Important notification that something might result in a configuration not working, loss of data, equipment damage or personal injury.
Bold and/or green: commands, command options and keywords.
Italics: variable, input requirement for a valid parameter.
Passpoint Overview
Passpoint – also known as Hotspot 2.0 – is an industry-wide next generation approach to public internet access driven by the Wi-Fi Alliance that brings the following benefits:
Frictionless onboarding and roaming, thanks to a one-time registration followed by automatic access to interconnected hotspots
More secure and private Wi-Fi connections, compared with general visitor networks
Passpoint is based on the IEEE 802.11u standard, which is a set of protocols enabling cellular-like roaming. Following the initial enrollment, frequent users such as visitors, guests or employees bypass repeated logins, forms and passwords, as their mobile devices automatically join the Wi-Fi subscriber service when they return to a venue or roam between inter-linked Passpoint enabled hotpots and providers, while being better protected against potential cyber threats.
If a device supports 802.11u and is enrolled to a service, it automatically communicates with the Wi-Fi infrastructure via the access points to discover the network SSID and connects securely to it by presenting its access credentials. Upon successful authentication, the device is provisioned with Passpoint standards-based management objects - known as Per-Provider Subscription Management Objects (PPS-MO).
GlobalReach - an ASSA ABLOY company - has been involved with Passpoint since its inception and even contributed to the creation and initial pilot testing of the standard. As a result, it is one of the few trusted worldwide experts on this topic, with a proven platform backed by real-world operational experiences at scale.
The best user experience is to offer Passpoint through a customer/brand mobile app integration, as it further simplifies the onboarding process, while incentivizing app downloads and customer loyalty, leading to further engagement and monetization opportunities. To this effect, Trusted WiFi offers a Software Development Kit (SDK) for easy app integration.
End-to-End Service Components
Implementing an end-to-end Trusted WiFi Passpoint service requires a combination of the following software and hardware components:
Trusted WiFi Passpoint: the core services are offered and managed centrally via the Trusted WiFi Passpoint Module (hosted and operated by GlobalReach). Following an initial setup performed by the GlobalReach Operations team, Managed Service Providers (MSPs) can then add sites to customer realms and monitor the solution.
Customer Realm: the service requires connectivity to a realm including domain, security certificate and private key, as well as the database holding the users’ Personally Identifiable Information (PII). It is the responsibility of the Identity Provider – typically the customer/brand – to make this part available.
Mobile App: the best user experience is to offer Passpoint through a customer/brand mobile app integration. Trusted WiFi offers a Software Development Kit (SDK) for easy implementation. It is the responsibility of the app owner – typically the customer/brand – to perform the integration.
Local Networks: the local networks must be compliant with Passpoint (Hotspot 2.0). – Most recent Wi-Fi access points and controllers from major vendors support Passpoint today, however older models or products from more exotic manufacturers might not do. The configuration of the local infrastructure is typically handled by the Managed Service Providers (MSPs).
User Devices: the subscribers’ mobile devices (belonging to visitors, guests, employees, etc.) must be compliant with Passpoint (Hotspot 2.0) – All recent iOS and Android-based smartphones or tablets support Passpoint today, however older models or products running less popular operating systems might not do. Laptops compatibility is also more erratic. It is therefore essential to maintain a traditional onboarding service in parallel with Passpoint to handle non-compatible devices.
High-Level Topology
The diagram below illustrates the high-level topology for the end-to-end Trusted WiFi Passpoint service:
Glossary
The following is a glossary of the most common terms used regarding this solution.
Term | Abbreviation | Description |
|---|---|---|
Deployment | - | Enabling of a Trusted WiFi product module for a property via the Trusted WiFi interface. |
Module | - | Product or service purchased from Trusted WiFi that is managed through its own sub-section via the Trusted WiFi interface. |
License | - | Legal agreement that grants users the right to use specific software, outlining terms and conditions for its usage, distribution, and potential modifications, while protecting the intellectual property of the software developer. GlobalReach licenses comprise of two different types:
Trusted WiFi is sold as a combination of one-off licenses to activate the service and recurring licenses based on a price per Wi-Fi access point per month. |
Managed Service Provider | MSP | The third-party company that remotely manages and monitors a client's IT infrastructure and end-user systems, offering services like network and infrastructure management, security, and 24/7 technical support. |
Organization | Org | A company account in Trusted WiFi. |
Operator | - | An organization type account in Trusted WiFi that is used by MSPs to manage a property’s Wi-Fi network. |
Customer | - | An organization type account in Trusted WiFi typically used for customers/brands that allows grouping to view all properties belonging to the same company even if managed by several different MSPs. |
Linked Organization | Linked Org | A link creating a relationship between an operator and a customer account, allowing a customer to view a property while allowing an operator to manage it. |
User | - | An individual accessing a product, service or system.
|
Property | - | Trusted WiFi concept representing an Individual site or location where products are deployed. |
Linked Property | - | Site or location shared between operator and customer accounts. |
Passpoint Software Development Kit | Passpoint SDK | The service that sits within the customer’s mobile app and that is connected to the Trusted WiFi RADIUS infrastructure allowing Passpoint profiles to be created for a given Passpoint realm. |
Passpoint Realm | - | The customer specific domain that is used to provision Passpoint profiles that are approved for connection to any associated network. |
Passpoint Profile | - | The security certified profile that sits on a subscriber’s device. If installed correctly it allows seamless authentication to the secure Passpoint SSID. |
Secure Passpoint Service Set Identifier | Secure Passpoint SSID | The Wi-Fi network that is associated to the Passpoint realm configured to allow subscriber devices with a valid Passpoint profile to seamlessly connect to the Passpoint network at a property. |
Subscriber | - | An individual person using a service. |
Subscriber Device | - | The equipment – typically a smartphone, tablet or computer – the subscriber is using to connect to the service. |
Collision-Resistant Unique Identifier | CUID | A unique identifier designed to be collision-resistant – meaning engineered to minimize the likelihood of generating duplicate IDs even in distributed systems – and more efficient in terms of space and database indexing performance due to its sequential nature. In the context of Passpoint, a CUID is delivered to a subscriber device when it requests a Passpoint profile. |
Customer Loyalty Mobile Application | Mobile App | The iOS and/or Android digital application used by businesses to engage and reward their customers through loyalty programs. In the context of Passpoint, the best user experience is to offer Passpoint through a customer/brand mobile app integration using the Trusted WiFi SDK. |
UNIFI NETWORK SERVER CONFIGURATION
Supported Versions
This document is based on firmware 9.3.45.
Prerequisites
It is assumed the following prerequisites are met before configuring UniFi Network Server for a Trusted WiFi Passpoint service:
A supported UniFi account activated and licensed.
A Trusted WiFi account with operator permissions.
A core Trusted WiFi Passpoint service configured and tested.
A property in Trusted WiFi with deployed Passpoint modules.
A deployed and configured Wi-Fi network.
Notes
This document focuses on a specific part of the Ubiquiti UniFi Network Server configuration only.
Please refer to the Passpoint Administration Guide for instructions on how to configure the end-to-end Passpoint service.
Please refer to the original Ubiquiti documentation for complete instructions on Ubiquiti configuration.
Warning
All properties must share the same NAI realm, RADIUS IP / port settings and SSID name for the Passpoint service (CustomerPasspoint).
Each property requires a separate RADIUS secret and NAS identifier, both generated when a configuration is activated within the Trusted WiFi management platform.
Core Passpoint Settings
Log into Trusted WiFi, then click on the Properties icon in the left menu to view the properties list.
Select or search for the property you wish to work on. This will open its deployments page:
Click on the Passpoint tile and then click on the Configuration option in the left menu to display the Passpoint settings summary as per the example below:
Take note of the details for your respective installation as they will be required at a later step.
UniFi Network Server Configuration
RADIUS Profile
Log into the UniFi Dashboard with your credentials to display the page below:
On the left-hand side menu items, click on Settings > Profiles > RADIUS. The following screen will appear:
Click Create New and the following pop up will appear on the right:
Complete the fields, as per the description:
Field
Description
Name
Provide a RADIUS name
RADIUS Assigned VLAN Support
Select the Wireless Network checkbox
TLS
Leave unchecked
IP Address
Enter the <Primary RADIUS IP> from Trusted WiFi
Port
Enter the <RADIUS Authentication Port> from Trusted WiFi
Shared Secret
Enter the <RADIUS Shared Secret> from Trusted WiFi
Select Add and to add the Secondary RADIUS Sever IP from Trusted WiFi
IP Address
Enter the <Secondary RADIUS IP> from Trusted WiFi
Port
Enter the < RADIUS Authentication Port> from Trusted WiFi
Shared Secret
Enter the < RADIUS Shared Secret> from Trusted WiFi
Accounting Server
Enable this check box
IP Address
Enter the <Primary RADIUS IP> from Trusted WiFi
Port
Enter the < RADIUS Accounting Port> from Trusted WiFi
Shared Secret
Enter the < RADIUS Shared Secret> from Trusted WiFi
Select Add and to add the Secondary RADIUS Sever IP from NTrusted WiFi
IP Address
Enter the <Secondary RADIUS IP> from Trusted WiFi
Port
Enter the < RADIUS Authentication Port> from Trusted WiFi
Shared Secret
Enter the < RADIUS Shared Secret> from Trusted WiFi
Interim Update Interval
Enable this checkbox and enter a value or leave the default as 3600 seconds
Click Add to save this RADIUS profile configuration and add it to the account:
Passpoint (Hotspot 2.0)
Proceed to the WiFi page on the left of the screen to display the view below:
Click Create New and the following screen will be displayed:
Complete the fields, as per the description below:
Field
Description
Name
Enter a name for the SSID
Password
Leave blank
Broadcasting APs
Select All, Specific or Group radio button
Advanced
Select Manual
Private Pre-Shared Keys
Leave unchecked
Hotspot 2.0
Select Passpoint radio button
Venue Name
Provide your venue name
Venue Type
Select the appropriate venue type from the drop down. e.g. Assembly Area
Network Type
Select appropriate network type from the drop down
NAI Realm
Click Add and enter the name realm. e.g. customer.cloud.global
EAP Method: EAP-TTLS
Sub Method: MSCHAP v2
Roaming Consortium List
Leave blank
3GPP Cellular Network
Leave blank
Domain List
Add the domain e.g. customer.cloud.global
Operator Friendly Name
Provide the operator’s friendly name
Enhanced IoT Connectivity
Leave unchecked
WiFi Band
Select 2.4 GHZ and 5 GHZ
Band Steering
Enable this checkbox
Hide WiFi Name
Leave unchecked
Client Device Isolation
You can toggle the checkbox on or off as needed
Proxy ARP
You can toggle the checkbox on or off as needed
BSS Transition
Enable this checkbox
UAPSD
You can toggle the checkbox on or off as needed
Fast Roaming
You can toggle the checkbox on or off as needed
WiFi Speed Limit
You can toggle the checkbox on or off as needed
Multicast Enhancement
You can toggle the checkbox on or off as needed
Multicast and Broadcast Control
You can toggle the checkbox on or off as needed
802.11 DTIM Period
Enable the Auto checkbox
Minimum Data Rate Control
Select the Auto radio button
MAC Address Filter
Leave unchecked
RADIUS MAC Authentication
Leave unchecked
Security Procol
Select WPA2 Enterprise
RADIUS Profile
Select the RADIUS Profile you configured from the step above
NAS ID
Select Custom. Enter the <NAS ID> from Trusted WiFi
DAS/DAC(CoA)
Leave unchecked
PMF
Select Disabled
Group Rekey Inerval
Leave unchecked
WiFi Blackout Scheduler
Select Off
Your configuration will appear similar to the below:
Select Add WiFi Network:
The configuration is now completed.