Replacing separate guest WiFi, RADIUS and DNS filtering vendors: the consolidation case for multi-site estates

Consolidate when one estate pays three suppliers to run one connection. Guest sign-in, staff RADIUS and DNS filtering overlap on VLAN mapping, identity and logs, so faults routinely cross supplier boundaries. Purple runs all three on your existing access points: Purple Access for guest sign-in and cloud RADIUS, Purple Shield for DNS filtering per network and VLAN.

Should you consolidate guest WiFi, RADIUS and DNS filtering onto one platform?

For most multi-site estates, yes. Guest sign-in, staff authentication and DNS filtering look like three products. On the network, they act on one connection, in sequence, using shared configuration.

Here is the sequence. A guest joins an SSID, and the access point redirects them to a captive portal, the sign-in page shown before internet access. The controller then asks a RADIUS server whether to let them on. RADIUS, defined in RFC 2865, is the protocol access points use for that decision. Staff devices use the same protocol through IEEE 802.1X, the port-based access control standard. Once either device is online, every DNS lookup passes through the filtering service.

Three suppliers means three contracts, three consoles, three support desks and three sets of logs for one event. The case for WiFi vendor consolidation rests on removing that duplication. Our recommendation:

• Consolidate fully where one team runs guest and staff WiFi across 10 or more sites and contracts can be aligned within 18 months.
• Consolidate and retain one specialist where a requirement sits outside WiFi access, such as wired posture checks or TLS inspection on managed laptops.
• Hold your current stack until renewal where exit fees exceed the running cost you would remove in the remaining term.

Purple runs all three functions on the access points you already own. There is no rip and replace.

Where do guest WiFi, RADIUS and DNS filtering vendors overlap?

These overlaps are not about marketing claims. They come from configuration held in two places, identity held in three and personal data processed by all three.

Two RADIUS paths for one estate

Most guest platforms already act as a RADIUS server. On many controllers, the external captive portal flow ends with a RADIUS authorisation that releases the guest onto the network. Your staff network then runs a second RADIUS service. That is often a server pair at head office or a separate cloud RADIUS contract.

You pay for RADIUS twice, maintain two sets of shared secrets per site and patch two services. With Purple, Guest WiFi and staff authentication use the same cloud RADIUS. Each access point points at one service.

VLAN and policy mapping held twice

A VLAN is a virtual LAN, a logical network segment on shared hardware. RADIUS can return a VLAN assignment with each accept message, using the tunnel attributes described in RFC 3580. Your DNS filtering vendor then applies policy by VLAN, subnet or egress IP address.

The link between "this is the guest network" and "this is the guest policy" therefore lives in two consoles. When you renumber a subnet or split a VLAN at one site, both must change on the same day. When only one changes, staff get the guest policy, or guests get no filtering at all.

Three identity records that never meet

The guest platform knows who signed in and what they consented to. The RADIUS service knows which staff identity authenticated. The DNS filter knows which IP address requested which domain.

None of them shares a key with the others. Answering "who was on which network when this domain was blocked" means three exports. You then align three timestamp formats and match on IP address and time. On one platform, the sign-in record that feeds WiFi Analytics sits alongside authentication and filtering policy.

Three processors of the same personal data

Each supplier processes personal data: names, email addresses, device MAC addresses, IP addresses and requested domains. Under UK GDPR Article 28, each needs its own processor contract. Under Article 30, each appears in your record of processing. One guest WiFi and RADIUS vendor plus a filtering vendor means three entries for one service.

What does each hand-off between suppliers cost?

A hand-off is any point where a ticket leaves one supplier's queue and enters another's. Each one adds waiting, re-explanation and evidence-gathering. These five hand-offs recur in three-supplier estates.

1. Guests cannot reach the sign-in page. The DNS filter blocks a domain the captive portal depends on, or an operating system's captive-portal detection hostname. The portal vendor reports the page is up. The filtering vendor reports the policy is correct. Your network team proves the fault between them.
2. Staff land on the wrong VLAN. RADIUS returns an unexpected VLAN, and the DNS filter applies guest policy to staff devices. Two vendors share one symptom.
3. A leaver keeps WiFi access. The RADIUS service is not tied to your identity provider, so a disabled account still authenticates. The fault sits between HR, IT and the RADIUS supplier.
4. A visitor complains about a blocked site. Answering needs the sign-in record, the network assignment and the DNS log. That is three exports from three suppliers.
5. A RADIUS certificate renewal breaks staff WiFi. Devices that validate the old server certificate refuse the new one. The RADIUS supplier, your device management team and the access point configuration all sit in the fault path.

A worked model you can run on your own ticket data

You do not need industry averages, because your service desk already holds the numbers. Filter 12 months of WiFi tickets for any that named more than one supplier. Then apply this model.

The inputs below are illustrative, not reported results. Replace them with your own:

• 30 multi-supplier tickets a month across the estate.
• Two hand-offs per ticket on average.
• 40 minutes of engineer time per hand-off, covering logging, waiting, re-explaining and joining calls.

That gives 30 × 2 × 40 = 2,400 minutes, or 40 engineer hours a month. Over a year, it is 480 hours. On a single WiFi platform, those cross-supplier hand-offs disappear. The fault still needs fixing, but it sits in one queue with one log.

Elapsed time matters more than engineer time during an incident. Each hand-off adds the next supplier's response time to your time-to-resolve. Your guests wait through all of it.

How does one platform change your audit evidence?

Auditors ask two kinds of question about WiFi. Is the service controlled? Are the suppliers controlled? Three suppliers triple the answers to the second question and fragment the answers to the first.

ISO/IEC 27001:2022 Annex A controls 5.19 to 5.22 cover supplier relationships. They include security in supplier agreements, the ICT supply chain, and monitoring and review of supplier services. Every WiFi supplier falls in scope for each control.

PCI DSS v4.0 requirement 11.4.5 requires testing of segmentation controls where you rely on segmentation to reduce cardholder data scope. For a retailer or hotel, that test spans RADIUS VLAN assignment and the filtering policy on each segment.

Evidence item	Three suppliers	Purple single platform
Supplier security assessments (ISO 27001 A.5.19 to A.5.21)	3	1
Supplier service reviews (ISO 27001 A.5.22)	3	1
GDPR Article 28 processor agreements	3	1
Processors named in the WiFi processing record	3	1
Admin consoles in your access reviews	3	1
Systems holding VLAN-to-policy mapping	2	1
Log sources to correlate for one incident	3	1
Certificates and attestations to collect	One set from each of 3 suppliers	Purple's ISO 27001 and Cyber Essentials certificates

Purple has operated since 2012 and runs at 80,000+ live venues in over 90 countries. It is ISO 27001 certified, Cyber Essentials certified, GDPR and CCPA compliant, and a certified B Corp. One supplier assessment covers sign-in, authentication and filtering. When you change filtering on a guest VLAN, your change record names one system rather than two.

Three suppliers, one platform or a hybrid: where each fits

The estates that gain most share one trait. The same team owns guest and staff WiFi across many sites. That applies to hotels, retail chains with shopper WiFi in every store, and operators running passenger WiFi on trains.

Multi-tenant venues fit too. The design issues in shopping centre WiFi map closely onto separate guest, tenant and staff segments, each with its own filtering policy.

Axis	Three suppliers	Purple single platform	Purple plus one retained specialist
Contracts and renewal dates	3, usually on different dates	1	2
GDPR Article 28 agreements for WiFi data	3	1	2
Support route for a sign-in fault	3 suppliers plus your network team	Purple plus your network team	Purple plus your network team
Admin consoles	3	1	2
Where VLAN-to-policy mapping lives	RADIUS service and DNS filter separately	Purple	Purple for WiFi, specialist for its own scope
Access point replacement needed	None	None	None
Supplier reviews per audit cycle	3	1	2
Suits	Estates with exit fees above remaining running costs	One team running guest and staff WiFi at 10+ sites	Estates with filtering or access control needs beyond WiFi

What does each option cost to run?

Licence cost is the visible line. Most of the running cost sits elsewhere. Build a three-year view of your current stack against these six lines:

• Licences. Three suppliers often price on different units: per site, per access point or per device. Normalise them to cost per site before comparing.
• Infrastructure. On-premises RADIUS means servers, operating system patches and certificate renewals. Purple's cloud RADIUS removes the servers.
• Integration upkeep. Each supplier needs its own admin sign-on, API connections and device management profiles.
• Supplier management. Due diligence, processor agreement review and annual service review are triplicated. Price the hours your security and procurement teams spend on each.
• Incident time. Use the hand-off model above with your own ticket data.
• Renewal misalignment. Three renewal dates mean three negotiations and three notice periods to watch.

Then set the Purple quote against that total, plus migration effort and any exit fees. Hardware does not enter the comparison. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Why your next WiFi upgrade doesn't need new hardware covers that model in more depth.

What are the risks of consolidating, and how do you manage them?

Concentration risk

One supplier now carries guest sign-in, staff authentication and filtering. If it fails, all three fail together. Three suppliers do not remove this risk, though. The services act in sequence, so a fault in any one stops a guest getting online.

Manage this in due diligence. Purple runs at 99.999% uptime and handles 500 million users and logins a year. Ask how RADIUS and DNS resolution fail over, and test that behaviour at your pilot site.

Certificate trust on staff devices

PEAP (Protected EAP) wraps a username and password inside a TLS tunnel. EAP-TLS authenticates with client certificates instead of passwords. Devices using either method validate the RADIUS server's certificate before sending credentials. When the RADIUS server changes, devices must trust the new certificate, or they refuse to connect.

Push updated WiFi profiles through device management before each site cuts over. How to set up enterprise WiFi on iOS and macOS with 802.1X covers profile structure for Apple estates. The cutover is also a good point to review WPA3 on staff SSIDs. WPA2 vs WPA3 sets out the trade-offs.

Filtering policy parity

Export every filtering category, allow-list and block-list per network before migration. Map each to a Shield policy per VLAN. Test the result at the pilot site against the old block-list.

Agree sign-off criteria with whoever owns the filtering requirement. That may be a safeguarding lead, HR or the person named on a premises licence.

Commercial overlap

Staggered renewals mean you may pay for two services during migration. Map every contract's term, notice period and exit fee. Where penalties are high, sequence migration to renewal dates.

Exit risk

Purple sits on hardware you own, so leaving later is a controller configuration change, not a hardware replacement. Agree data export and retention terms in the contract before you sign.

Limits no DNS filter removes

DNS filtering acts at name resolution. Devices using DNS over HTTPS (RFC 8484) or hard-coded resolvers can bypass any DNS filter, from any supplier. Block outbound DNS to unapproved resolvers at your firewall. Block known DNS over HTTPS endpoints where your policy requires it. DNS filtering decides by domain, so it does not inspect page content.

When should you keep a specialist vendor?

Keep a specialist for scope outside WiFi access, and consolidate everything inside it. Four situations justify a retained supplier or a delayed move.

• Managed endpoints need more than DNS-layer control. If corporate laptops need TLS inspection, or filtering that follows them off site, keep that service for those endpoints. Run Purple Shield on your WiFi networks.
• Wired ports need posture-based access control. Keep your wired network access control for corporate ports. Run Purple Access for guest and staff WiFi.
• Clinical or operational devices run on dedicated access control. In healthcare, leave clinical device controls in place. Consolidate patient, visitor and staff WiFi onto Purple.
• Exit fees exceed the saving. If penalties outweigh the running cost removed in the remaining term, stay until renewal. Then move.

A named statutory filtering standard is a verification step, not a reason to stay. Schools in England, for example, follow Keeping Children Safe in Education, which expects appropriate filtering and monitoring. Validate Shield's categories against the requirement at your pilot site, then consolidate.

What consolidation looks like in practice

These are worked examples built on stated assumptions. They show the arithmetic of consolidation, not reported results from named venues.

Hospitality: a 60-hotel group on Cisco Meraki

Situation. The group runs a guest WiFi vendor for sign-in and a pair of head-office RADIUS servers for staff PEAP. A third supplier filters DNS on the guest VLAN. The contracts renew in three different quarters.

Approach. Purple Access replaces guest sign-in and staff RADIUS on the existing Meraki access points. Purple Shield takes over filtering on guest and staff VLANs. Rollout runs in six regional waves of 10 hotels. Staff WiFi profiles are reissued through device management before each wave.

Measurable outcome. Contracts fall from three to one, and Article 28 agreements from three to one. Two head-office RADIUS servers retire. At 30 multi-supplier tickets a month, the hand-off model above removes 480 engineer hours a year.

Public sector: a council with 25 libraries and leisure centres

Situation. Public WiFi for visitors must filter adult and illegal content. Staff WiFi authenticates over 802.1X against Microsoft Entra ID through a separate RADIUS supplier. A third supplier filters DNS by each site's egress IP. The annual audit asks for supplier evidence from all three.

Approach. Purple Access handles visitor sign-in and staff cloud RADIUS. Purple's Identity-Based Networks tie staff access to Microsoft Entra ID, so joiners, movers and leavers follow changes made there. Shield applies a strict policy on the public VLAN and a separate policy on the staff VLAN.

Measurable outcome. Supplier assessments for the WiFi service fall from three to one. Log sources for a filtering complaint fall from three to one. VLAN-to-policy mapping drops from 50 entries across two systems to 25 sites in one.

Events: a stadium and conference venue keeping one specialist

Situation. The venue buys fan WiFi, staff RADIUS and DNS filtering from three suppliers. Group IT also runs a secure web gateway with TLS inspection for managed laptops.

Approach. Purple Access covers fan and attendee sign-in plus staff RADIUS. Shield filters the fan and staff WiFi VLANs. The secure web gateway stays in place for managed laptops on and off site.

Measurable outcome. WiFi contracts fall from three to one. Security-related contracts across the venue fall from four to two.

How to decide for your estate

Start with your contract map and your ticket data, then find your row below.

Your situation	Recommendation
All three contracts end within 18 months	Consolidate onto Purple in one programme: one pilot site, then regional waves
Contracts end across two to three years	Move each function to Purple at its renewal, guest sign-in and guest filtering first
One team runs guest and staff WiFi at 10+ sites	Consolidate onto Purple; hand-off and audit savings scale with site count
Managed laptops need TLS inspection or off-site filtering	Hybrid: keep the endpoint service for laptops, run Purple Shield on WiFi VLANs
Wired ports need posture-based access control	Hybrid: keep wired access control, run Purple Access for guest and staff WiFi
Exit fees exceed remaining-term running costs	Stay until renewal, then consolidate onto Purple
Filtering must meet a named statutory standard	Validate Shield categories at the pilot site, then consolidate

Whichever row fits, run the hand-off model on 12 months of your own tickets first. That number, plus the audit evidence table, usually settles the business case for DNS filtering and guest WiFi on one contract.

Frequently asked questions

Does Purple work with the access points we already own?

Yes. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You point your SSIDs at Purple for guest sign-in and RADIUS, with no access point replacement. Consolidating three suppliers onto Purple is a configuration change on your controller or cloud dashboard, not a hardware project.

Can Purple replace our current RADIUS server for staff WiFi?

Yes. Purple Access includes cloud RADIUS for staff authentication over IEEE 802.1X on your existing access points, so on-premises RADIUS servers can retire. Staff access ties to Microsoft Entra ID, Okta or Google Workspace, so joiners, movers and leavers follow changes made there. Before each site moves, reissue WiFi profiles so staff devices trust the new RADIUS server certificate.

How is DNS filtering licensed alongside guest WiFi?

Purple Shield is a security add-on to your Purple plan, so DNS filtering sits on the same contract as guest sign-in and RADIUS. Shield applies filtering per network and per VLAN. Your guest, staff and public networks can therefore carry different policies at every site. You manage one renewal date and one supplier review instead of separate agreements.

Can we move one supplier at a time rather than all three at once?

Yes, and most estates should. Start with the contract that renews first, or with guest sign-in and guest VLAN filtering, which carry the lowest risk. Move staff RADIUS once device profiles are ready. Run each phase at a pilot site before regional waves. Keep VLAN-to-policy mapping documented in one place until the old supplier exits.

Does putting everything with one supplier increase our outage risk?

It concentrates dependency, so assess it directly. Purple runs at 99.999% uptime across 80,000+ live venues and handles 500 million users and logins a year. Ask for the RADIUS and DNS failover design during due diligence, and test it at your pilot site. Three suppliers carry their own risk: a fault in any one of them stops a guest getting online.

Is Purple compliant with GDPR for guest and staff data?

Yes. Purple is GDPR and CCPA compliant, and certified to ISO 27001 and Cyber Essentials. Guest sign-in uses conscious-choice opt-ins, so marketing consent is explicit and recorded. Consolidating onto Purple replaces three Article 28 processor agreements with one. Your WiFi processing record then names one processor for sign-in, authentication and filtering data.

When does keeping our current filtering vendor make more sense?

Keep a specialist only for scope outside WiFi access. If managed laptops need TLS inspection, or filtering that follows them off site, keep that service for those endpoints. Run Purple Shield on your WiFi networks. If exit fees exceed the running cost you would remove, move at renewal. For guest and staff WiFi filtering per network and per VLAN, Shield covers the requirement.