Ruckus SmartZone and RUCKUS One guest WiFi vs external captive portal platforms

Ruckus SmartZone and RUCKUS One both include native guest portals with click-through and guest pass access. That suits a single venue needing basic, terms-accepted access. External platforms such as Purple connect through the Ruckus WISPr hotspot model and Northbound Interface. They add consented first-party data, auditable GDPR consent records, Passpoint onboarding and estate-wide analytics, with no new access points.

Should you use Ruckus native guest WiFi or an external captive portal?

Choose the native Ruckus portal when guest WiFi is an amenity and nothing more. Choose an external captive portal when the guest login has to produce something useful. That might be a marketing audience, a consent record you can show a regulator, or visit data across many sites.

Both options run on the same access points. The decision is about what happens after the guest connects, not about radio performance.

Use this rule of thumb:

• One venue, access only, no marketing. Native SmartZone or RUCKUS One guest access is enough.
• Many venues, or any marketing use of guest data. An external platform earns its subscription, because consent and data need one system of record.
• Mixed vendors after an acquisition or refresh. An external platform is the only way to run one portal across Ruckus and other hardware.
• Residents and visitors in one building. Use DPSK for residents and a branded guest portal for visitors, on separate SSIDs and VLANs.

Purple runs the external model at 80,000+ live venues in more than 90 countries. It handles 500 million users and logins a year. The sections below set out where the options differ, what each costs to run and how to decide for your estate.

Where Ruckus native guest WiFi and external portals genuinely differ

What Ruckus gives you natively

SmartZone controllers, physical or virtual, and the RUCKUS One cloud both include guest access in WLAN configuration. Native workflows include click-through terms acceptance and staff-issued guest passes. RUCKUS One adds self sign-in and host approval. These workflows exist to control network access. They capture what is needed to admit a guest, and little more.

How does WISPr Northbound Interface authentication work on Ruckus?

WISPr (Wireless Internet Service Provider roaming) is the redirect-and-authenticate model behind most external captive portals. A captive portal is the web page a device sees before it reaches the internet. On SmartZone you build a Hotspot (WISPr) WLAN. On RUCKUS One you choose the third-party captive portal (WISPr) network type.

The flow runs in five steps:

1. Association. The guest joins the SSID. The access point holds the device in an unauthorised state.
2. Walled garden. Only approved destinations are reachable. These are DNS, the portal's domains and any social login domains you allow.
3. Redirect. The first web request goes to the external portal URL. Ruckus appends parameters identifying the client MAC address, access point and SSID. On SmartZone, the parameters also carry the controller's Northbound Interface address.
4. Portal sign-in. The guest completes the branded flow: form or social login, terms and marketing opt-ins.
5. Authorisation. The portal calls the controller's Northbound Interface, an authenticated JSON API, to log the client in. The controller then sends a RADIUS Access-Request to the configured server. On Access-Accept, Ruckus releases the client and applies returned attributes such as session timeout.

RADIUS is the authentication, authorisation and accounting protocol defined in IETF RFC 2865. Access points use it to ask a server whether to admit a device. RADIUS accounting then reports session start, stop and data volumes. Purple acts as both the portal and the cloud RADIUS server, so you host neither.

RUCKUS One follows the same pattern, with redirect parameters and RADIUS servers set in the cloud console. Parameter names and API behaviour change between releases. Follow the current Ruckus Northbound Interface reference and Purple's Ruckus setup article in the Purple support centre. Do not copy values from older third-party guides.

Three security habits apply to any WISPr build. Call the Northbound Interface over HTTPS. Keep its password on the portal server, never in browser code. Limit the walled garden to the domains the portal needs.

What do external portals add on top of Ruckus access points?

Guest data capture. Native workflows record enough to admit a guest. An external platform turns each login into a first-party profile: name, email, opt-in status, visit count and dwell time per venue. Purple WiFi Analytics reports repeat visits and dwell across every site from one dashboard.

Consent audit. GDPR Article 7(1) requires you to demonstrate that a person consented. You need to store who agreed, when, to which wording and through which channel. Purple uses conscious-choice opt-ins, which keep marketing consent separate from accepting the terms. That design follows the GDPR Article 4(11) definition of consent and UK PECR regulation 22 on email marketing. Each record is timestamped and exportable. That supports subject access requests within the one-month deadline in GDPR Article 12(3).

Passpoint and OpenRoaming. Passpoint, also called Hotspot 2.0, builds on IEEE 802.11u. A device with a stored profile finds and joins the network automatically. It authenticates over WPA2 or WPA3-Enterprise using IEEE 802.1X, the port-based access control standard. OpenRoaming, run by the Wireless Broadband Alliance, federates Passpoint identity providers so one profile works across many networks.

Ruckus supports Hotspot 2.0 on SmartZone and RUCKUS One, but it needs an identity provider behind it. An external platform supplies that role. The guest signs in once through the portal, then reconnects automatically, and encrypted, on later visits.

The case for Passpoint grows each year. Current iOS and Android releases use a private, randomised MAC address per network by default, according to Apple and Google platform documentation. That makes MAC-based recognition of returning devices unreliable. A Passpoint profile carries a stable identity instead.

Multi-vendor reach. Purple is hardware-agnostic. The same portal and consent policy run on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet.

Side-by-side comparison

Capability	Ruckus SmartZone native	RUCKUS One native	Purple on Ruckus (external portal)
Where it runs	Your SmartZone controller, physical or virtual	Ruckus cloud	Purple cloud overlay on SmartZone or RUCKUS One
Guest access methods	Click-through and staff-issued guest passes	Click-through, guest pass, self sign-in and host approval	Branded forms, social login and conscious-choice opt-ins
Integration method	Built in	Built in	Hotspot (WISPr) WLAN, Northbound Interface and RADIUS
Data captured	Details needed to admit the guest	Details needed to admit the guest	First-party profile, opt-in status, visits and dwell per venue
Consent audit	Terms acceptance	Terms acceptance	Timestamped opt-in records to evidence GDPR Article 7
Passpoint	Hotspot 2.0 supported, identity provider sourced separately	Hotspot 2.0 supported, identity provider sourced separately	Profile offered after first portal login
Hardware coverage	Ruckus only	Ruckus only	Eight vendors, Ruckus included
Reporting audience	Network team: AP and client health	Network team: venue and AP health	Marketing and operations: visitor behaviour
Best suited to	Single site, access-only guest WiFi	Cloud-managed Ruckus sites, access only	Multi-site estates that use guest data

When Ruckus native guest access is the right call

Native guest access is the right call when the network team owns guest WiFi and no one downstream needs the data. Examples include a council office reception, a warehouse visitor network or a clinic waiting room. In Healthcare, visitors and patients often need internet access and nothing else.

Native wins on three counts:

• No extra subscription. Your existing SmartZone AP licences or RUCKUS One device subscription cover guest access.
• One console. Your team configures the guest WLAN beside staff and IoT WLANs, in the same Ruckus interface.
• Fewer dependencies. There is no external RADIUS server and no third-party walled garden to maintain.

Accept the limits before you commit. There is no marketing consent ledger, and little reporting a marketing team can use. Every additional estate, or every other vendor, needs its own portal. If any of those becomes a requirement within your contract term, plan the external portal now. Reconfiguring twice costs more than configuring once.

Where Ruckus Cloudpath fits

Cloudpath Enrollment System is Ruckus's onboarding product for certificates and DPSK. If you already run it for staff, its sponsored guest workflows can admit visitors too. That keeps onboarding in one Ruckus product. It remains an access tool rather than a guest data and consent platform, so treat it as a native option in this comparison.

When an external captive portal platform is the right call

An external portal is the right call when guest login has a business owner beyond IT. Think of Hotels building direct-booking audiences, or Retail chains building first-party shopper lists. Stadiums need it for sponsor activation. Rail operators on Trains need passenger connection data for reporting.

Look for these signals:

• You run more than one venue, or plan to.
• Marketing emails guests, so you need GDPR Article 7 evidence.
• You run mixed hardware now, or expect to after an acquisition.
• Returning visitors should reconnect automatically through Passpoint.
• Operations want visit frequency and dwell to plan staffing and space.

None of this requires new access points. Purple layers on top of existing Ruckus controllers and APs as a cloud overlay. The case is set out in Why your next WiFi upgrade doesn't need new hardware. For sector depth, see Hotel guest WiFi platforms: PMS integration, Passpoint and tiered bandwidth compared and Stadium and arena guest WiFi platforms: high-density onboarding and sponsor activation compared.

How do MDU and hospitality operators combine DPSK with a branded guest portal?

DPSK (Dynamic Pre-Shared Key) is the Ruckus feature that gives each person or device a unique key on one SSID. Other vendors call the idea iPSK or PPSK (private pre-shared key). The controller maps each key to a VLAN, an IEEE 802.1Q virtual LAN. Every resident's devices then sit in their own segment on shared infrastructure.

The pattern that works in build-to-rent, student accommodation and hotels has three parts:

1. Resident SSID on DPSK. Each resident gets a unique passphrase mapped to a per-unit VLAN. DPSK3 extends the model to WPA3. Smart TVs, speakers and games consoles join without a portal or 802.1X client.
2. Guest SSID with a branded portal. Visitors and amenity spaces use the external portal through WISPr. Turn on client isolation and keep the guest VLAN apart from residents and building systems.
3. Lifecycle control. Tie keys to joiners, movers and leavers. When a resident moves out, revoke their key the same day.

Purple Guest WiFi runs the visitor portal in this design. For residents, you can keep Ruckus DPSK or Cloudpath. Alternatively, Purple Multi-Tenant WiFi with SecurePass is the Cloudpath alternative. It gives each resident a private network bubble under Purple's Identity-Based Networks model, managed beside guest WiFi.

Hotels add a third population. Staff authenticate with 802.1X against Microsoft Entra ID, Okta or Google Workspace. Long-stay or serviced-apartment guests use DPSK. Short-stay guests and conference delegates use the branded portal.

Worked scenarios on Ruckus estates

The scenarios below are illustrative, based on common deployment patterns. The outcomes are the countable changes each architecture produces, not reported results from a named venue.

A 220-room hotel on SmartZone moves guest login to an external portal

Situation. The hotel ran native SmartZone guest passes. Reception printed a code at every check-in, and codes circulated beyond residents. Marketing had no consented email list. The data protection officer could not show which guests had agreed to contact.

What was done. IT created a Hotspot (WISPr) WLAN pointing at the Purple portal and Purple cloud RADIUS. Staff 802.1X and back-office WLANs stayed untouched. The portal asked for marketing consent as a separate, unticked choice. Guests were offered a Passpoint profile after first login.

Outcome.

• Codes issued by reception fell from one per check-in to zero.
• Access points replaced: none.
• Every opted-in guest produced one timestamped consent record, exportable for GDPR Article 15 access requests.
• Guests holding a Passpoint profile reconnected on later stays without the portal, encrypted by 802.1X.

A 400-unit build-to-rent block on RUCKUS One separates residents and visitors

Situation. Each floor shared one pre-shared key. Leavers kept working keys until the next floor-wide change. Residents gave their key to visitors, and lounge and gym WiFi sat on the same network.

What was done. The operator issued a DPSK per resident, mapped to a per-unit VLAN. A separate guest SSID served visitors and amenity spaces through a branded portal. Move-out in the leasing process triggered key revocation.

Outcome.

• Shared keys in circulation fell from one per floor to zero.
• Leaver revocation moved from the next floor-wide key change to the move-out day.
• Visitor devices on resident VLANs: none, by design.
• Operations gained dwell data per amenity space to plan cleaning and opening hours.

A 60-store retail chain runs one portal across Ruckus and Cisco Meraki

Situation. An acquisition left 40 stores on Ruckus and 20 on Cisco Meraki. The chain ran two portals, with two sets of terms and two consent wordings. PCI DSS Requirement 1 also demands network security controls between guest traffic and the cardholder data environment.

What was done. The chain deployed one Purple portal across both vendors, using WISPr on Ruckus and the Meraki splash page integration. Guest VLANs stayed segmented from point-of-sale networks at every store.

Outcome.

• Portals fell from two to one.
• Consent wordings fell from two to one.
• Shopper visit reporting covered all 60 stores in one dashboard.

What each option costs to run on a Ruckus estate

Costs fall into four buckets: licences, hardware, configuration effort and compliance overhead. The licence line is the visible one. The compliance line is the one that hurts if it goes wrong.

Cost element	Ruckus native (SmartZone or RUCKUS One)	Purple on Ruckus (external portal)
Licence	Covered by existing SmartZone AP licences or RUCKUS One device subscription	Purple subscription on top, on the Connect, Capture or Engage plan
New hardware	None	None: cloud overlay on existing Ruckus APs and controllers
Initial configuration	Guest WLAN per zone or venue in the Ruckus console	WISPr WLAN, walled garden and RADIUS entry per controller or venue, plus portal design
Ongoing administration	IT manages passes, terms and portal changes	Marketing edits portal and campaigns, IT owns the WLAN
Consent and access requests	Manual process held outside the network	Exportable consent and profile records
Mixed-vendor sites	Separate portal per vendor	One portal across eight vendors
Controller migration	Guest settings rebuilt in the new console	Portal and data stay in Purple, WLAN repointed

Two costs rarely appear on a quote. The first is staff time spent issuing and resetting guest codes. The second is regulatory exposure. UK GDPR fines reach £17.5 million or 4% of annual worldwide turnover, whichever is higher.

On the platform side, Purple is ISO 27001, Cyber Essentials and B Corp certified, and compliant with GDPR and CCPA. It runs at 99.999% uptime (Purple data).

How do you decide for your Ruckus estate?

Map your situation to a recommendation:

Your situation	Recommendation
One site, guest WiFi as an amenity, no marketing use	Ruckus native guest access
Cloudpath already deployed for staff, visitors need sponsored access only	Cloudpath sponsored guest workflows
Several Ruckus venues, marketing emails guests	Purple Guest WiFi through WISPr and the Northbound Interface
Ruckus plus other vendors	Purple across all vendors
Build-to-rent, student or MDU block with residents and visitors	DPSK for residents, Purple portal for visitors
Hotel with long-stay rooms and conference delegates	802.1X for staff, DPSK for long stays, Purple portal for guests and delegates
Returning visitors should connect automatically	Purple portal plus Passpoint on Ruckus Hotspot 2.0

Then put five questions to your team:

1. Who owns guest data? If marketing or operations does, you need an external platform.
2. How many sites and vendors will you run in three years? Growth or acquisitions favour one hardware-agnostic portal.
3. Can you demonstrate consent today? If not, GDPR Article 7 is already a gap.
4. Do residents or long-stay guests need private networks? If yes, plan DPSK or SecurePass beside the guest portal.
5. Are you moving from SmartZone to RUCKUS One? An external portal travels with you, so you repoint one WLAN rather than rebuilding guest access.

Frequently asked questions

Does Purple work with my existing Ruckus access points and controllers?

Yes, Purple runs on your existing Ruckus estate with no new hardware. It connects to SmartZone through a Hotspot (WISPr) WLAN, the Northbound Interface and RADIUS. On RUCKUS One, it uses the third-party captive portal (WISPr) network type. The same portal also runs on Cisco Meraki, HPE Aruba, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Purple's Ruckus setup article in the Purple support centre lists the current configuration steps.

Do I need to move from SmartZone to RUCKUS One to use an external captive portal?

No, both platforms support external captive portals through WISPr. You can connect Purple to SmartZone today and keep it when you migrate. During a move to RUCKUS One, the portal, consent records and visitor data stay in Purple. You recreate one WISPr network in the RUCKUS One console and point it at the same portal and RADIUS servers.

Is an external captive portal on Ruckus GDPR compliant?

Yes, provided the portal records consent properly. GDPR Article 7(1) requires you to demonstrate that each person consented. Purple stores a timestamped record of who agreed, when and to which wording. Conscious-choice opt-ins keep marketing consent separate from accepting the terms. Purple is ISO 27001 certified and compliant with GDPR and CCPA. Your own privacy notice and lawful basis remain your responsibility as data controller.

Can I keep Ruckus DPSK or Cloudpath for residents and use Purple for visitors?

Yes, this is a common split in build-to-rent, student accommodation and hotels. Residents stay on DPSK or Cloudpath on their own SSID and per-unit VLANs. Visitors and amenity spaces use a separate SSID with the Purple branded portal through WISPr. If you later want one platform for both, Purple Multi-Tenant WiFi with SecurePass replaces Cloudpath for resident access.

How much work is a migration from native Ruckus guest access to Purple?

Migration is a configuration change, not a hardware project. You create a WISPr WLAN, add walled garden entries and register Purple's RADIUS servers on each controller or RUCKUS One venue. Then you design the portal and consent wording. Staff, IoT and back-office WLANs stay untouched. Purple's Ruckus support article covers the exact steps for your controller release.

How is an external portal licensed compared with native Ruckus guest access?

Native Ruckus guest access is covered by your existing SmartZone AP licences or RUCKUS One device subscription. An external portal adds a Purple subscription on top, on the Connect, Capture or Engage plan. You pay nothing for new hardware either way. The subscription buys consent records, first-party guest data, cross-vendor reporting and Passpoint onboarding that native guest workflows do not provide.

Does Passpoint replace the captive portal on Ruckus?

No, Passpoint complements the captive portal rather than replacing it. The guest signs in through the portal once and accepts terms and any marketing opt-in. Purple then offers a Passpoint profile. On later visits, the device joins automatically over WPA2 or WPA3-Enterprise with 802.1X, without seeing the portal. Ruckus supports Hotspot 2.0 on SmartZone and RUCKUS One, and Purple supplies the identity provider role.