Cisco WLC and Catalyst Integration with Purple WiFi: Step-by-Step Guest Access Guide

Executive summary

Enterprise wireless networks must serve distinct user groups simultaneously: guests who need frictionless internet access, staff who require secure access to corporate resources, and headless or tenant devices that need isolation from one another. Relying on a single shared Pre-Shared Key for any of these groups is a security liability. A single compromised credential exposes the entire segment, and revoking access requires changing a global password that disrupts every device on the network.

This guide details the integration of Cisco Wireless LAN Controllers (WLC) and Catalyst 9800 series hardware with Purple's cloud overlay. We provide the step-by-step configuration for three distinct authentication tiers: an open Guest WiFi network with captive portal redirection powered by Purple, a Secure Staff WiFi network using 802.1X EAP-TLS certificate authentication, and a Multi-Tenant WiFi environment using Cisco Identity Pre-Shared Keys (iPSK) with dynamic VLAN assignment. By deploying this architecture, you isolate corporate resources from visitor traffic, automate identity-based access control, and capture first-party data through Purple's WiFi Analytics platform. Purple operates across 80,000+ live venues and recorded 440 million logins in 2024 (Purple internal data), making it a proven cloud overlay for Cisco infrastructure at scale.

Technical deep-dive: the three-tier architecture

A modern enterprise wireless deployment on Cisco hardware must cater to distinct user profiles with differing security and access requirements. The integration between Cisco WLC and Purple enables a unified hardware footprint to serve these profiles through distinct authentication mechanisms, all managed from a single Catalyst 9800 controller.

Tier 1: Guest WiFi - Central Web Authentication (CWA)

For visitors in Hospitality and Retail environments, the objective is low-friction onboarding combined with compliant data capture. This is achieved using an open SSID coupled with Central Web Authentication (CWA). When a guest connects, the Cisco WLC applies a pre-authentication Access Control List (ACL) - the walled garden. This ACL blocks general internet traffic while permitting traffic to Purple's captive portal domains, DNS, and social login endpoints.

When the guest attempts to browse, the WLC intercepts the HTTP request and issues a redirect to the Purple splash page. The guest authenticates via their chosen method (social login, email registration, or voucher code). Purple then acts as the RADIUS server, sending a RADIUS Change of Authorization (CoA) message back to the WLC. The CoA instructs the WLC to move the client from the pre-authentication state to a post-authentication state on an isolated guest VLAN, granting internet access. Every login is recorded in Purple's analytics platform, capturing first-party data in compliance with GDPR and CCPA.

Tier 2: Staff WiFi - 802.1X EAP-TLS

Corporate devices require the highest level of security. IEEE 802.1X defines port-based Network Access Control (PNAC), and when combined with EAP-TLS (Extensible Authentication Protocol - Transport Layer Security), it delivers certificate-based authentication that eliminates passwords entirely. Digital certificates are deployed to corporate devices via Mobile Device Management (MDM) - Microsoft Intune, Jamf, or equivalent. The Cisco WLC acts as the Authenticator, passing EAP messages between the supplicant (device) and the RADIUS server. The RADIUS server validates the certificate and returns an Access-Accept with optional VLAN assignment attributes.

Because authentication relies on certificates rather than passwords, there are no credentials to steal. If a device is lost or an employee leaves, you revoke the certificate. Access terminates instantly without disrupting any other user. For a comprehensive treatment of enterprise security standards including WPA3 and Zero Trust, see our guide on Enterprise WiFi Security: A Complete Guide for 2026 .

Tier 3: Multi-Tenant WiFi - Cisco iPSK and dynamic VLAN assignment

In environments like student accommodation, coworking spaces, or retail malls, you need private, segmented networks for different tenants without broadcasting dozens of SSIDs. Cisco Identity PSK (iPSK) solves this. All tenants connect to a single SSID. The WLC sends a MAC authentication request to the RADIUS server for each connecting device. The RADIUS server returns the specific PSK for that tenant as a cisco-av-pair attribute, along with standard IETF RADIUS attributes to dynamically assign the client to the correct VLAN.

The three IETF RADIUS attributes that drive dynamic VLAN assignment are:

The Tunnel-Private-Group-ID is encoded as a string, as defined in RFC 2868. The VLAN ID must exist on the WLC for the assignment to succeed.

Implementation guide: Cisco Catalyst 9800 WLC configuration

The following steps detail the configuration for a Cisco Catalyst 9800 WLC running IOS-XE to integrate with Purple for Guest WiFi redirection. For legacy AireOS WLC deployments, the equivalent settings are available in the Purple support portal.

Step 1: Configure RADIUS authentication and accounting

You must point the WLC to Purple's RADIUS servers to handle guest authentication and session accounting.

1. Navigate to Configuration > Security > AAA > Servers/Groups > RADIUS > Servers > + Add.
2. Enter the primary Purple RADIUS server IP address, set auth-port to 1812, acct-port to 1813, and enter the shared secret from the Purple portal.
3. Enable Support for CoA - this is mandatory for captive portal redirection.
4. Repeat for the secondary Purple RADIUS server.
5. Navigate to RADIUS > Server Groups > + Add and create a group containing both servers.
6. Navigate to AAA Method List > Authorization > + Add, set Type to network, and point it to the RADIUS server group.
7. Navigate to AAA Method List > Accounting > + Add, set Type to identity, and point it to the same group.

The equivalent CLI commands on IOS-XE are:

radius server Purple-Primary
 address ipv4  auth-port 1812 acct-port 1813
 key 0 
!
radius server Purple-Secondary
 address ipv4  auth-port 1812 acct-port 1813
 key 0 
!
aaa group server radius Purple-RADIUS-Group
 server name Purple-Primary
 server name Purple-Secondary
!
aaa authorization network Purple-Authz group Purple-RADIUS-Group
aaa accounting identity Purple-Acct start-stop group Purple-RADIUS-Group

Step 2: Define the pre-authentication ACL (walled garden)

The pre-authentication ACL permits traffic to Purple's splash page and essential services before the user authenticates. This is the walled garden.

1. Navigate to Configuration > Security > ACL > + Add.
2. Create an IPv4 Extended ACL named Purple_Guest_Walled_Garden.
3. Add rules to deny traffic to the WLC management IP and RADIUS server IPs.
4. Add rules to permit DNS (UDP port 53) to your DNS servers.
5. Add rules to permit traffic to Purple's walled garden IP ranges and domains (obtain the current list from the Purple support portal for your specific hardware type).
6. Add a final permit ip any any rule - the WLC will redirect permitted traffic to the CPU for portal processing.

Step 3: Configure the guest WLAN

1. Navigate to Configuration > Tags & Profiles > WLANs > + Add.
2. Create a WLAN named Guest-WiFi with your chosen SSID.
3. Under Security > Layer 2, set security to None (Open).
4. Under Security > Layer 3, enable Web Policy and set Web Auth type to External.
5. Enter your Purple access URL in the redirect field.
6. Apply the Purple_Guest_Walled_Garden ACL.
7. Under Security > AAA Servers, assign the Purple RADIUS servers to both Authentication and Accounting.

Step 4: Configure the Policy Profile

1. Navigate to Configuration > Tags & Profiles > Policy > + Add.
2. Under Access Policies, assign VLAN 20 (or your designated guest VLAN).
3. Under Advanced, enable Allow AAA Override and NAC State.
4. Assign the Purple accounting method list.

The CLI equivalent:

wireless profile policy Guest-Policy
 aaa-override
 nac
 vlan 20
 accounting-list Purple-Acct
 no shutdown
!
wireless tag policy Guest-Policy-Tag
 wlan Guest-WiFi policy Guest-Policy

Step 5: Configure iPSK for multi-tenant or IoT deployments

For iPSK, the WLAN configuration differs from the guest setup. The WLAN uses WPA2-PSK with MAC filtering enabled, and the Policy Profile has AAA Override active to accept the per-client PSK and VLAN from the RADIUS server.

wlan Tenant-WiFi 2 Tenant-WiFi
 mac-filtering Purple-Authz
 security wpa psk set-key ascii 0 DefaultKey123
 no security wpa akm dot1x
 security wpa akm psk
 peer-blocking allow-private-group
 no shutdown
!
wireless profile policy Tenant-Policy
 aaa-override
 accounting-list Purple-Acct
 vlan 30
 no shutdown

The RADIUS server (configured in Purple or your RADIUS platform) returns the following attributes per tenant group:

cisco-av-pair = psk-mode=ascii
cisco-av-pair = psk=
Tunnel-Type = VLAN
Tunnel-Medium-Type = 802
Tunnel-Private-Group-ID = 

Best practices

Adherence to established standards ensures stability, security, and regulatory compliance across your deployment.

Enforce strict certificate validation. When deploying 802.1X, configure client devices via MDM to explicitly trust your RADIUS server's certificate authority and specify the expected server name. Failure to enforce this leaves clients vulnerable to rogue access point attacks, where an attacker presents a fraudulent certificate to capture credentials. This is a hard requirement, not a recommendation.

Isolate guest traffic at the network layer. Guest WiFi must terminate on a dedicated VLAN that is firewalled from all corporate resources. PCI DSS 4.0 requires that cardholder data environments are isolated from public networks. A guest on VLAN 20 must have no route to the corporate network on VLAN 10.

Use iPSK for IoT devices, not MAC Authentication Bypass. MAC addresses are broadcast in plaintext and are trivial to spoof. iPSK provides cryptographic security for headless devices. For guidance on how display and IoT devices interact with wireless protocols, see What Is Wireless Display: Protocols & Best Practices 2026 .

Define clear terms of use. Your captive portal must present a terms of use agreement before granting access. This is a GDPR requirement for data collection and a legal necessity for network usage policies. For internal staff networks, consult Staff WiFi Terms and Conditions: Legal and Compliance Essentials .

Deploy RADIUS redundancy. Always configure a primary and secondary RADIUS server. Purple provides two server IP addresses for this purpose. A single RADIUS server failure will prevent all guest logins.

Troubleshooting and risk mitigation

Even with careful configuration, integration issues arise. Address the most common failure modes systematically before escalating.

Issue: Guests connect but the splash page does not appear.

This is the most common issue. The pre-authentication ACL is blocking DNS. Without DNS, the client cannot resolve the initial HTTP request, and the operating system will not trigger the captive portal mini-browser. Verify that UDP port 53 is permitted to your DNS servers in the walled garden ACL. On the WLC, run show wireless client summary to confirm the client is in a Webauth Pending state rather than Run.

Issue: iPSK clients fail to connect or land on the wrong VLAN.

The VLAN specified in Tunnel-Private-Group-ID does not exist on the WLC, or the cisco-av-pair attributes are malformed. Run debug radius all on the WLC to inspect the raw RADIUS response. Verify the VLAN ID is created under Configuration > Layer 2 > VLAN > VLAN List.

Issue: 802.1X staff clients fail to authenticate intermittently.

This is typically a RADIUS server timeout or a certificate trust issue on the client. Check the RADIUS server logs for Access-Reject messages. On Windows clients, verify the WiFi profile is configured to validate the server certificate and specifies the correct trusted CA.

Issue: CoA from Purple is not processed by the WLC.

The CoA shared secret must match the RADIUS shared secret configured on the WLC. On IOS-XE 17.4 and later, the CoA key is configured separately from the shared secret. Verify both match the values in the Purple portal.

ROI and business impact

Transitioning from basic PSK networks to a structured, identity-based architecture with Purple delivers measurable business outcomes across Hospitality , Retail , Healthcare , and Transport verticals.

First, the architecture eliminates the operational cost of managing shared passwords. When staff leave, you revoke their certificate. You do not change a global password and update every device on the estate. Second, the integration with Purple's captive portal turns an IT cost centre into a revenue driver. Purple's platform captures compliant first-party data at every login, enabling automated marketing campaigns and visitor analytics. With 29 billion data points collected across the Purple network (Purple internal data), the platform provides actionable insight into visitor behaviour, dwell time, and return rates.

For venue operators running surveys to understand visitor satisfaction, the Purple platform integrates directly with research workflows. See Design of a Survey: A Practical Guide for Venues for guidance on structuring effective venue surveys delivered via the captive portal.

By integrating Cisco's enterprise-grade hardware with Purple's cloud overlay, you achieve a secure, scalable network that actively contributes to the venue's commercial objectives. Purple is ISO 27001 certified, GDPR and CCPA compliant, Cyber Essentials certified, and B Corp certified - meeting the compliance requirements of enterprise procurement teams.