View podcast transcript
Welcome to Purple's Technical Briefing. Today we are covering a topic that comes up constantly in our conversations with IT managers and network architects across hospitality, retail, and multi-tenant venues: how to integrate NETGEAR Insight and WAX series access points with Purple WiFi. If you are running a hotel, a retail park, a conference centre, or a mixed-use development, this briefing is directly relevant to your next deployment decision.
Let us set the scene. NETGEAR's WAX series - the WAX610, WAX620, and WAX630 - are WiFi 6 access points managed through the Insight cloud platform. They support up to eight separate SSIDs per radio, WPA3 encryption, and up to six gigabits of throughput on the WAX630. They are PoE-powered, ceiling-mountable, and managed from a single pane of glass through the Insight Cloud Portal. For an IT installer or SMB network administrator, this is a genuinely capable platform at a price point well below the Cisco Meraki or HPE Aruba tier.
Purple is a hardware-agnostic cloud overlay. We sit on top of your existing infrastructure and we add the guest experience layer, the data capture layer, and the analytics layer. We have processed 440 million logins in 2024 across 80,000 live venues. The integration with NETGEAR Insight is clean and well-documented, and it covers four distinct use cases that we will walk through today.
Now let us get into the technical deep-dive. The four use cases are: Guest WiFi with a Purple captive portal, Secure Staff WiFi using 802.1X, Multi-Tenant segmentation using NETGEAR's PPSK feature, and dynamic VLAN assignment via RADIUS for Identity-Based Networks.
Use case one: Guest WiFi with a Purple captive portal. This is the most common starting point. You create a dedicated Guest SSID in NETGEAR Insight and you configure it as an open network. The key configuration is in the Captive Portal section of the SSID settings. You select External Captive Portal, and you paste in the Splash Page URL that Purple provides.
Next, you configure the authentication type. For most Purple deployments, you will select RADIUS authentication. Purple provides you with a primary RADIUS server IP address, port 1812 for authentication and port 1813 for accounting, and a shared secret. You paste those into the NETGEAR Insight External Captive Portal configuration. You also set a NAS Identifier - this is a string that identifies this specific access point or location to the RADIUS server. Use something meaningful, like your venue name and location code.
The walled garden is the piece that trips up most installers. Before a guest authenticates, their device needs to be able to reach the Purple splash page, the authentication servers, and any social login providers you have enabled. NETGEAR Insight has a dedicated Walled Garden section in the External Captive Portal configuration where you add these URLs. Purple's support documentation provides the exact list of domains to whitelist. Get this wrong and guests will see a blank page instead of your branded portal.
Once configured, the flow works like this: a guest connects to the Hotel Guest SSID. The access point intercepts their first HTTP request and redirects them to the Purple splash page. The guest sees your branded portal, accepts the terms, and optionally provides their email address or logs in via social media. Purple's RADIUS server returns an Access-Accept message to the access point, and the guest is granted internet access. Purple captures the consent data, logs the session, and that data flows into your Purple analytics dashboard.
Use case two: Secure Staff WiFi using 802.1X. This is where you move away from shared passwords entirely. For staff networks, a pre-shared key is a liability - when an employee leaves, you have to change the password for everyone. 802.1X, defined in the IEEE 802.1X standard, gives every user an individual credential. When they leave, you disable their account in your directory and their access is revoked instantly.
In NETGEAR Insight, you configure a separate Staff SSID with WPA2 Enterprise security. This tells the access point to use 802.1X authentication rather than a pre-shared key. You then configure the RADIUS server settings at the network location level. Go to the network location settings, select RADIUS, enable 802.1X Access Authentication, and enter your RADIUS server IP, port, and shared secret. The default re-authentication interval is 3,600 seconds - one hour - which is a reasonable starting point for most venues.
The most common EAP method in SMB deployments is PEAP-MSCHAPv2, which uses a server-side certificate to create an encrypted tunnel inside which the user authenticates with their Active Directory username and password. EAP-TLS is more secure - it uses certificates on both sides - but it requires a PKI infrastructure and MDM to push certificates to devices.
One critical point: enforce certificate validation on every client device. Configure your Windows devices via Group Policy Objects and your mobile devices via MDM profiles to validate the RADIUS server's certificate. If you skip this step, devices are vulnerable to rogue access point attacks where an attacker presents a fake certificate and captures credentials.
Use case three: NETGEAR PPSK for multi-tenant venues. Private Pre-Shared Key solves a specific problem in retail parks, mixed-use developments, and co-working spaces. You have multiple tenants sharing the same physical WiFi infrastructure. You do not want to run separate SSIDs for each tenant - that creates radio frequency congestion and management complexity. But you also cannot give everyone the same password, because then Tenant A can see Tenant B's traffic.
PPSK solves this elegantly. You create a single SSID and you create multiple pre-shared keys in NETGEAR Insight under Wireless, Settings, Advanced, Multi PSK Settings. Each key is associated with a specific VLAN. Tenant A gets a unique 16-character password that maps to VLAN 30. Tenant B gets a different password that maps to VLAN 40. The venue management team gets a third password that maps to VLAN 20, which has access to management systems.
When Tenant A's devices connect using their password, the access point automatically places them on VLAN 30. They cannot see any traffic on VLAN 40 or VLAN 20. From a tenant's perspective, they just have a WiFi password. From your perspective as the network administrator, you have complete traffic isolation between tenants with zero additional hardware.
There are two important limitations to know. First, PPSK in NETGEAR Insight requires WPA2 Personal or WPA2 Personal Mixed encryption. It does not work on the 6 GHz band. Second, PPSK cannot be combined with captive portal on the same SSID. If you need both, you need two separate SSIDs - which is fine, because WAX series access points support up to eight.
Use case four: dynamic VLAN assignment via RADIUS. This is the most sophisticated configuration and the one that underpins Purple's Identity-Based Networks capability. Instead of statically assigning a VLAN to a password or an SSID, you let the RADIUS server decide which VLAN to assign based on who is authenticating.
The mechanism uses three standard RADIUS attributes: Tunnel-Type, which must be set to value 13 for VLAN; Tunnel-Medium-Type, which must be set to value 6 for IEEE 802; and Tunnel-Private-Group-ID, which carries the VLAN ID as a string. When a user authenticates successfully, the RADIUS server returns these three attributes in the Access-Accept message. The access point reads them and places the client on the specified VLAN.
In practice, this means you can have a single WPA2 Enterprise SSID where a hotel manager authenticates and lands on VLAN 20 with access to property management systems, a front desk agent authenticates and lands on VLAN 21 with access to the check-in system only, and a contractor authenticates and lands on VLAN 50 with internet-only access. All from the same SSID, all enforced automatically by the RADIUS server based on Active Directory group membership.
Now, let us talk about implementation recommendations and pitfalls. The first pitfall is the walled garden. Every external captive portal deployment fails at the walled garden at least once. The symptom is guests connecting to the SSID but seeing a browser error instead of the splash page. The fix is methodical: open the Purple support documentation, copy every domain in the walled garden list, and paste them into NETGEAR Insight's Walled Garden section. Test with a device that has no cached credentials.
The second pitfall is RADIUS reachability. The NETGEAR access point needs to reach your RADIUS server. RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting. Open those ports from the access point management IP to the RADIUS server IP. Test with a RADIUS test tool before you go live.
The third pitfall is PPSK and captive portal conflict. NETGEAR Insight does not allow PPSK and captive portal on the same SSID. If you need both, create two SSIDs. Name them clearly - one for PPSK tenants and one for the captive portal guests.
The fourth pitfall is certificate validation on 802.1X clients. Every Windows device needs a Group Policy Object that specifies the trusted Certificate Authority and the expected RADIUS server name. Every mobile device needs an MDM profile with the same settings. Without this, a user could unknowingly authenticate to a rogue access point and hand over their Active Directory credentials.
Now for a rapid-fire question and answer session. Question one: Can I use Purple with NETGEAR Insight without a RADIUS server? Yes, for guest captive portal deployments, you can use Purple's web authentication mode rather than RADIUS. The access point redirects to the splash page via HTTP, and Purple handles authentication through a web session. RADIUS gives you more control and better accounting data, but it is not mandatory for basic guest portal deployments.
Question two: How many PPSK keys can I create in NETGEAR Insight? NETGEAR Insight supports up to 64 PPSK keys per SSID on WAX series access points. For most multi-tenant venues, this is more than sufficient. If you have more than 64 tenants, you need to move to a RADIUS-based dynamic VLAN solution instead.
Question three: Does NETGEAR Insight support WPA3 Enterprise for 802.1X? Yes, WAX series access points support WPA3 Enterprise. For most SMB deployments, WPA2 Enterprise is sufficient and has broader client device compatibility. WPA3 Enterprise is worth considering for environments handling sensitive data, such as healthcare or financial services.
Question four: What happens if the Purple RADIUS server is unreachable? NETGEAR Insight supports a failsafe option in the External Captive Portal configuration. If you enable failsafe, guests are granted internet access for a short period even if the captive portal servers are unreachable. Purple maintains 99.999% uptime across our infrastructure, but enabling failsafe is good practice for any production deployment.
To summarise the key takeaways from today's briefing. NETGEAR WAX series access points integrate with Purple via the External Captive Portal mechanism in NETGEAR Insight. You configure the splash page URL, RADIUS server credentials, and walled garden domains in the Insight Cloud Portal. For staff networks, use WPA2 Enterprise with 802.1X and enforce certificate validation on every client device. For multi-tenant venues, NETGEAR's PPSK feature gives you per-tenant VLAN isolation from a single SSID with up to 64 unique keys. For the most sophisticated deployments, dynamic VLAN assignment via RADIUS attributes gives you identity-driven network segmentation that adapts to who is connecting, not just where they are connecting from.
If you are planning a NETGEAR deployment with Purple, the next step is to request your Purple RADIUS credentials and walled garden domain list from Purple's support team, and to test the captive portal redirect on a staging SSID before rolling out to production. The configuration takes under 30 minutes once you have those credentials in hand.
Thank you for listening to Purple's Technical Briefing. For the full written guide, including step-by-step configuration details and worked examples, visit purple.ai.
