Aruba Central guest WiFi vs dedicated captive portal platforms: CRM, Passpoint and reporting compared

Aruba Central includes a hosted splash page with click-through, social and sponsored sign-in, which is enough for basic guest access. It has no native CRM connectors or marketing-consent workflow. ClearPass Guest adds policy depth but needs servers and specialist skills. Dedicated platforms such as Purple add CRM sync, Passpoint and visitor analytics on existing Aruba hardware through external RADIUS.

Which Aruba guest WiFi option should you choose?

An HPE Aruba estate gives you three realistic architectures for guest access. All three run on the access points you already own. They differ in who operates them, what they cost to run and what happens to the data.

Two terms first. A captive portal is the web page a device sees before it is allowed online. RADIUS (Remote Authentication Dial-In User Service) is the protocol an access point uses to ask a server whether to admit a device, and on what terms.

• Central native guest access. The Cloud Guest splash page hosted inside HPE Aruba Networking Central. It handles click-through terms, operator-created guest accounts, sponsor-approved visitors and social login.
• ClearPass Guest. The guest module of HPE Aruba Networking ClearPass Policy Manager, which runs on your own virtual machines or appliances. It suits teams where guest access is one part of a wider network access control programme.
• A dedicated cloud guest platform. An external captive portal and cloud RADIUS service, such as Purple Guest WiFi, connected to Central through standard redirect and RADIUS settings. It suits estates where marketing, CRM and visitor reporting are the reason the network exists.

Use this rule of thumb. If the network team owns guest WiFi and nobody downstream needs the data, Central's native guest access is enough. If you already run ClearPass for staff IEEE 802.1X (the port-based authentication standard behind enterprise WiFi) and device posture, extend it to guests. If marketing or operations needs consented first-party data in a CRM across many sites with no local IT, a cloud platform is simpler to run.

Where Aruba Central guest WiFi and dedicated platforms genuinely differ

This Aruba Central guest WiFi comparison comes down to four areas: sign-in, CRM and consent, returning-guest recognition, and reporting.

Splash page and sign-in

Central's Cloud Guest lets you set a logo, colours, background and terms of use. Sign-in options cover anonymous click-through, guest accounts created by operators, sponsor-approved access and social login. For a reception desk or a conference room, that covers the brief.

The Aruba Central captive portal limitations appear when the splash page has to do more than grant access. Cloud Guest is designed to admit a device, not to run a data-capture programme. It does not write sign-in data straight into a marketing platform, and it does not hold a consent record per guest that marketing can act on.

CRM and consent

Aruba guest WiFi CRM integration is where the three options separate most clearly. Guest data in Central stays inside Central unless you pull it out through Central's REST APIs. Someone has to write, host and maintain that integration.

ClearPass can call external systems through its REST APIs and Context Server Actions, its outbound HTTP integration feature. That is flexible, but every connector is a small software project your team owns.

Consent is the harder requirement. GDPR Article 7 requires you to demonstrate that each person consented, and Recital 32 states that pre-ticked boxes do not count. A terms-of-use checkbox on a splash page is not marketing consent. Purple uses conscious-choice opt-ins that keep marketing consent separate from network terms. Purple integrates with CRM and marketing platforms, holds ISO 27001 certification, and is GDPR and CCPA compliant.

Passpoint and returning guests

Recognising returning guests by MAC address no longer works reliably. Apple introduced private addresses per network in iOS 14, and Android 10 randomises the MAC address by default. A returning device can therefore look new, which forces repeat sign-ins and inflates visitor counts.

Passpoint, also known as Hotspot 2.0, addresses this. It lets a device join a network automatically and securely using a profile installed once. It builds on IEEE 802.11u for network discovery and uses 802.1X with EAP (Extensible Authentication Protocol) for encrypted authentication. OpenRoaming, the Wireless Broadband Alliance federation built on Passpoint, lets a device with a profile from one identity provider join any participating venue.

Aruba Instant and AOS-10 access points can advertise Passpoint networks configured in Central. Advertising is only half the job, because the profile and the authentication still need an identity service behind them. ClearPass Onboard can provision profiles. Purple supports Passpoint and OpenRoaming from the same platform that runs the captive portal. For hotel-specific detail, see Hotel guest WiFi platforms: PMS integration, Passpoint and tiered bandwidth compared.

Reporting

Central reports what a network engineer needs: client counts, access point utilisation, guest session numbers and connection health. ClearPass Insight reports authentication outcomes and audit trails. Neither is built to answer a marketing or operations question, such as how many guests returned this month.

Purple WiFi Analytics reports visits, repeat visits, dwell time and opt-in growth by venue. The dataset behind it is large: Purple handles 500 million users and logins a year.

Capability	Aruba Central native guest	ClearPass Guest	Dedicated cloud platform (Purple)
Where it runs	Hosted in HPE Aruba Networking Central	Your virtual machines or hardware appliances	Purple cloud, overlaid on your Aruba access points
Sign-in methods	Click-through, operator accounts, sponsored, social login	Self-registration, sponsored, operator accounts, social login	Branded forms, social login, conscious-choice opt-ins
CRM and marketing connectors	None built in; REST API only	Custom build via REST APIs and Context Server Actions	Integrates with CRM and marketing platforms
Marketing consent record	Terms-of-use acceptance only	Custom fields you design and maintain	Separate opt-in stored with each profile
Passpoint	Access point advertisement configured in Central	Profile provisioning through ClearPass Onboard	Passpoint profiles plus OpenRoaming
Reporting focus	Network health and session counts	Authentication and audit reports in Insight	Visits, repeat visits, dwell time and opt-ins
Skills to run day to day	Aruba network administrator	ClearPass specialist	Marketing or operations team, with IT for setup
Best suited to	Offices, councils, small venues with access-only needs	Estates running ClearPass for staff NAC and posture	Hotel groups, retail chains, stadiums and multi-site venues

How do external RADIUS and CoA work with Aruba Instant and AOS-10?

An external platform connects to Aruba through two standard mechanisms. The captive portal redirect sends the guest to the external sign-in page. RADIUS carries the decision back to the network.

The external captive portal flow

1. A guest device joins the open guest SSID and receives a pre-authentication role.
2. That role allows only the walled garden, the list of destinations a device can reach before sign-in.
3. The access point intercepts the first web request and redirects the browser to the external captive portal. The redirect carries parameters such as the client MAC address, access point and SSID.
4. The guest signs in. The platform's cloud RADIUS service returns an Access-Accept to the Aruba device.
5. The Access-Accept can carry the Aruba-User-Role vendor-specific attribute (VSA), a RADIUS field defined by HPE Aruba. It moves the device into a post-authentication role with its own firewall policy and bandwidth contract.

Central supports an external captive portal as a standard splash page option on the WLAN. You configure it once at the Central group level and every device in that group inherits it.

Aruba Instant: the virtual controller and Dynamic RADIUS Proxy

In an Aruba Instant cluster, each access point can send its own RADIUS requests. A cloud RADIUS service would then have to trust every access point address at every site.

Dynamic RADIUS Proxy changes that. When enabled, the Instant virtual controller proxies RADIUS traffic for the cluster, so the RADIUS server sees one source per site. That makes firewall rules and shared-secret management far easier across a large estate.

AOS-10: access points authenticate, gateways enforce

AOS-10 moves WLAN client authentication to the access point, including for tunnelled SSIDs. Gateways handle the datapath and role enforcement for tunnelled traffic. Before go-live, confirm in the HPE Aruba Networking AOS-10 documentation which device sources RADIUS requests in your design. Your RADIUS service must trust that address, and your CoA messages must reach it.

Change of Authorisation for sessions, tiers and revocation

Change of Authorisation (CoA), defined in RFC 5176, lets a RADIUS server alter or end a live session without the guest reconnecting. Three uses matter in guest WiFi:

• End a session when a time-limited voucher or event pass expires.
• Upgrade a tier after a hotel guest buys a premium bandwidth package.
• Revoke access for a device that breaches the acceptable use policy.

Most failed CoA tests come down to three causes. The firewall blocks inbound dynamic authorisation traffic to the Aruba device. The shared secret does not match. Or the role name returned by RADIUS does not exist on the access point or gateway. Purple's HPE Aruba integration article in the Purple support centre walks through each setting step by step.

When is Aruba Central's native guest access the right call?

Central's native guest access is the right call when access is the whole requirement. Choose it when:

• Guests need terms of use, a time limit and nothing else.
• Sponsor approval by email covers your visitor process.
• Nobody in marketing or operations needs the sign-in data.
• You have fewer than a handful of sites, and the network team is happy to own the splash page.

A county council reception area is a typical fit. Visitors accept the terms, receive a session limit and leave. There is no CRM to feed and no consent to record, so an external platform adds cost without adding value.

When is ClearPass Guest the right call?

ClearPass Guest earns its operating cost when guest access is part of a wider access control programme. Choose it when:

• You already run ClearPass for staff 802.1X, wired port control or device posture with OnGuard.
• Your security team needs one policy engine for corporate, guest and IoT devices.
• Policy requires authentication servers inside your own data centre.
• You employ, or contract, engineers with ClearPass expertise. HPE Aruba runs a dedicated ClearPass certification track for this reason.

A hospital trust that already uses ClearPass to profile clinical devices is a good example. Extending the same cluster to patient and visitor WiFi keeps one audit trail for the Healthcare estate. The marginal effort is lower than introducing a second platform.

When is a cloud guest platform simpler than ClearPass Guest?

For hospitality and retail teams, a cloud platform is simpler for structural reasons. Those teams rarely have local IT. Marketing owns the guest experience. And the estate grows by acquisition, often onto mixed hardware.

A ClearPass Guest alternative in the cloud removes the parts of ClearPass that hospitality and retail teams find hardest. There are no servers to patch, no clusters to size and no certificates to renew on your side. Purple is hardware-agnostic. It works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. One guest platform can therefore cover an Aruba estate and an acquired Meraki estate side by side.

Purple runs at 80,000+ live venues in more than 90 countries (Purple master deck, captured 2026), with 99.999% uptime (Purple's own data). Hospitality brands including Premier Inn, Whitbread and Pizza Express run guest WiFi on Purple.

Worked example: a 40-hotel group on Aruba Instant

Situation. A group runs 40 Hotels averaging 120 rooms, on Aruba Instant access points managed in Central. Two network engineers cover the whole estate from head office. Guest WiFi uses a Central click-through splash page. Marketing wants consented guest emails in the CRM and a view of repeat stays. A ClearPass Guest proposal requires a central cluster that every hotel must reach over the WAN.

What they do. The engineers point the guest WLAN in the Central group at Purple's external captive portal and cloud RADIUS. They enable Dynamic RADIUS Proxy so each hotel presents one source address. They add the walled garden entries, then offer a Passpoint profile at first sign-in so returning guests connect automatically.

Outcome to measure. On the IT side, one configuration change at group level reaches all 40 hotels, with no servers added. On the marketing side, the arithmetic looks like this. The figures are modelled from stated assumptions, not reported results.

• 40 hotels × 120 rooms = 4,800 rooms.
• At 75% occupancy, that is 3,600 occupied rooms a night, or 1,314,000 room-nights a year.
• With a two-night average stay and one sign-in per stay, that is 657,000 stays.
• At a 30% marketing opt-in rate, that is around 197,000 consented guest profiles a year.

The group then measures actual opt-in rate, repeat-stay rate and CRM match rate against these baselines.

Worked example: a 150-store fashion retailer on AOS-10

Situation. A 150-store Retail chain runs AOS-10 access points managed in Central, bridged locally at each store. Store teams have no IT role. Head office wants sign-ups linked to the loyalty CRM and a repeat-visit rate for each store.

What they do. The network team deploys one external captive portal configuration across the Central group, with store-level branding handled in Purple. Purple syncs consented shopper profiles to the CRM. Repeat visits are attributed through sign-in identity rather than device address alone, which limits the effect of MAC randomisation.

Outcome to measure. Again, the figures are modelled. If each store sees 3,000 shoppers a week and 5% connect, the chain logs 22,500 connections a week, or 1,170,000 a year. Head office compares repeat-visit rate by store and opt-in rate by region. Marketing changes the splash campaign in Purple without raising a network change ticket.

Where stores also hand tablets or personal devices to staff, see BYOD WiFi Onboarding: Managing Unmanaged Devices in Hotels and Retail.

What does each Aruba guest WiFi option cost to run?

Licence price is the smallest part of the comparison. Run cost comes from infrastructure, upgrades and the people who own the platform. None of the three options requires new access points, which is the same argument made in Why your next WiFi upgrade doesn't need new hardware.

Cost component	Aruba Central native guest	ClearPass Guest	Dedicated cloud platform (Purple)
Licences	Within your Central access point subscription	Per-endpoint licences on top of Central	Subscription on the Connect, Capture or Engage plan
Servers	None	Virtual machines or appliances, usually two or more nodes for resilience	None
Certificates	Hosted by HPE Aruba	HTTPS and RADIUS server certificates renewed by your team	Hosted by Purple
Software upgrades	Delivered by HPE Aruba in Central	Planned and applied by your team, cluster by cluster	Delivered by Purple
CRM integration	Custom build against Central's REST API	Custom build with REST APIs and Context Server Actions	Platform integrations with CRM and marketing tools
Day-to-day owner	Network administrator	ClearPass specialist	Marketing or operations team

The hidden cost of Central's native option is the data you do not collect. The hidden cost of ClearPass Guest is specialist time spent maintaining guest features that marketing could run itself. Price each option over three years, including staff hours, before you compare licence quotes.

How do you decide for your Aruba estate?

Start from the situation, not the feature list. This decision matrix maps the most common Aruba estates to a recommendation.

Your situation	Recommendation	Why
One to five sites, access-only guest WiFi, no CRM	Central native guest	Already included; nothing else to run
ClearPass already runs staff 802.1X and posture, guest data stays with IT	Extend ClearPass Guest	One policy engine and one audit trail
Multi-site hotel or retail group, marketing wants consented data	Dedicated cloud platform	CRM sync and consent without servers
Mixed estate of Aruba and other vendors after an acquisition	Dedicated cloud platform	Hardware-agnostic; one guest platform across vendors
Returning guests must connect without re-signing in	Cloud platform or ClearPass Onboard with Passpoint	Central advertises Passpoint but needs an identity service
ClearPass for staff, marketing wants guest data	ClearPass for staff, cloud platform for guests	Each tool does the job it was built for

Then answer five questions with your network and marketing leads in the room:

1. Who will own the splash page day to day, and do they have ClearPass skills?
2. Which system must guest data land in, and who maintains that connection?
3. How will you record marketing consent to the standard GDPR Article 7 requires?
4. How many sites will you add in the next 24 months, and on which hardware?
5. Do returning guests need automatic, encrypted connection through Passpoint or OpenRoaming?

If the answers point to marketing ownership, a CRM destination and a growing estate, a cloud platform over Central is the lower-effort route. If they point to IT ownership and one policy engine for every device, ClearPass is the better fit.

Frequently asked questions

Does Aruba Central include a captive portal, or do I need an external one?

Yes, Aruba Central includes a hosted captive portal called Cloud Guest. It supports click-through terms, operator-created guest accounts, sponsor-approved access and social login, with your logo and colours. You need an external captive portal when sign-in data must reach a CRM, when you need a marketing consent record, or when you want visitor reporting beyond network statistics. Central supports external captive portals as a standard option in the WLAN settings.

Can Purple run on our existing HPE Aruba access points?

Yes, Purple runs on existing HPE Aruba access points managed in Aruba Central, on both Aruba Instant and AOS-10. Purple is a cloud overlay. You point the guest WLAN at Purple's captive portal and cloud RADIUS service, and you keep your hardware. Purple is hardware-agnostic, so the same platform also covers Cisco Meraki, Ruckus and Juniper Mist estates you acquire later.

Do we need ClearPass Guest to connect Aruba guest WiFi to a CRM?

No, ClearPass Guest is not required for Aruba guest WiFi CRM integration. ClearPass can call external systems through its REST APIs and Context Server Actions, but your team has to build and maintain each connector. A dedicated cloud platform connects to Aruba access points through standard external captive portal and RADIUS settings. It then syncs consented guest data to CRM and marketing platforms without on-premises servers.

Does Aruba support Passpoint for guest WiFi?

Yes, Aruba Instant and AOS-10 access points can advertise Passpoint (Hotspot 2.0) networks configured in Aruba Central. Advertising the network is only half the job. Guest devices also need a Passpoint profile and an identity service that authenticates them over 802.1X. ClearPass Onboard or a cloud platform such as Purple provides that side. Purple also supports OpenRoaming, so profiled devices join participating venues automatically.

How does an external captive portal handle GDPR consent on Aruba networks?

The external platform records consent, not the access point. GDPR Article 7 requires you to demonstrate that each person consented, and Recital 32 rules out pre-ticked boxes. Purple uses conscious-choice opt-ins that keep marketing consent separate from accepting the terms of use. It stores the consent record with each profile. Purple holds ISO 27001 certification and complies with GDPR and CCPA.

What does moving from ClearPass Guest to a cloud platform involve?

Moving from ClearPass Guest is a WLAN and RADIUS change, not a hardware project. You point the guest SSID's captive portal and authentication servers at the cloud platform and update the walled garden. You also confirm that role names returned in RADIUS responses exist on your Aruba devices. Most teams pilot one site, compare session data, then roll out through Central groups. ClearPass can keep staff 802.1X.

How is a cloud guest platform licensed compared with ClearPass Guest?

A cloud guest platform is licensed as a subscription, with no servers to buy or host. ClearPass needs per-endpoint licences plus virtual machines or appliances, usually two or more nodes for resilience. It also needs staff time for upgrades and certificate renewals. Purple is sold on three plans: Connect, Capture and Engage. Central's native guest access sits inside your existing access point subscription.