TP-Link Omada and Purple WiFi for SMB Deployments

TP-Link Omada and Purple WiFi for SMB Deployments — Podcast Script Approximate runtime: 10 minutes | UK English voice | Consultant briefing tone --- [INTRO & CONTEXT — approximately 1 minute] Welcome. If you're evaluating WiFi infrastructure for a small or medium-sized business — whether that's a boutique hotel, a retail chain, a conference centre, or a public-sector venue — this briefing is for you. Today we're covering TP-Link Omada access points integrated with Purple's guest WiFi platform. Specifically: does it work, how do you configure it, when does it make more sense than UniFi, and what are the limits you need to know about before you commit. I'll keep this tight and practical. No fluff. Let's get into it. --- [TECHNICAL DEEP-DIVE — approximately 5 minutes] First, the headline: yes, Purple fully supports TP-Link Omada. It's on Purple's official supported hardware list, and there's a documented configuration path for both Omada Controller v3 and v4 plus. If you're running the current software — which you should be — you're working with v4 plus. Now, how does the integration actually work? Purple uses an External RADIUS Server model combined with an External Web Portal. That's the key architectural point. The Omada controller doesn't do the authentication itself — it delegates that entirely to Purple's cloud RADIUS infrastructure. This is actually a strength, not a limitation, because it means Purple handles all the identity management, data capture, GDPR compliance, and analytics on its side, while Omada handles what it's good at: radio management, roaming, and network control. Let me walk you through the three configuration steps. Step one is wireless settings. You create a new SSID — call it Guest WiFi or whatever fits your venue branding. You enable Guest Network mode, set security to None — because the authentication is handled at the portal layer, not the wireless layer — and apply dual-band across 2.4 and 5 gigahertz. Step two is the guest portal configuration. This is where the integration lives. In the Wireless Control tab, you add a new portal and set the Authentication Type to External RADIUS Server. You then input Purple's RADIUS server IP address and secret, which you get from your Purple dashboard. Port 1812 for authentication, port 1813 for accounting. You set the Authentication Mode to PAP, enable RADIUS Accounting with an interim update interval of 120 seconds, and critically, you set Portal Customisation to External Web Portal and paste in Purple's access URL. That URL is what redirects the guest to Purple's branded splash page. Step three is the walled garden. This is often overlooked and it's where deployments break. Before a guest authenticates, their device needs to be able to reach Purple's servers to load the splash page. You do this by adding Purple's domains to the Pre-Authentication Access List under Access Control. Purple maintains a published list of these domains — you need all of them, not just the obvious ones. For venues that want to go further — specifically, enabling Purple's SecurePass or Passpoint functionality for seamless reconnection — there's an additional configuration step. You create a separate RADIUS profile pointing at Purple's secure WiFi servers, create a WPA-Enterprise SSID called PurpleConnex, enable Hotspot 2.0, and configure the NAI realm as securewifi.purple.ai with EAP-TTLS authentication. This is the path to passwordless, profile-based reconnection for returning guests — no splash page on subsequent visits. Now, a word on the Omada controller itself. You have three deployment options: software controller running on a local server or VM, the OC200 or OC300 hardware controller appliance, or Omada Cloud — which is TP-Link's hosted cloud management platform and is free. For most SMB deployments, the cloud option is the right call. It removes the single point of failure of a local controller, and it costs nothing. The only reason to go local is if you have strict data residency requirements or an unreliable internet connection at the site. One important architectural note: the Omada controller must remain reachable for ongoing network management, but the RADIUS authentication path goes directly from the access point to Purple's cloud servers. So if your controller goes offline temporarily, existing authenticated sessions stay up — it's only new authentications and network changes that are affected. --- [OMADA VS UNIFI — part of the technical deep-dive] Let's address the Omada versus UniFi question directly, because it comes up constantly. Hardware cost is the most obvious difference. Omada access points are consistently 15 to 30 percent cheaper than comparable UniFi hardware. A WiFi 6 ceiling-mount AP from Omada — the EAP670, for example — retails around 130 to 150 US dollars. The equivalent UniFi U6 Pro sits at 179 dollars. Multiply that across 20 or 30 access points in a mid-sized venue and you're talking about a meaningful budget difference. Cloud management is another differentiator. Omada Cloud is free, permanently. UniFi's cloud management — UniFi Cloud — requires a subscription at 29 US dollars per site per month, or you self-host the Network Application. For MSPs managing multiple SMB sites, that subscription cost adds up quickly. Where UniFi wins is ecosystem maturity and feature depth. UniFi has a more polished management interface, a broader hardware range including cameras and access control, and a larger community producing documentation and integrations. If your client is already deep in the UniFi ecosystem, there's no compelling reason to migrate. For a greenfield SMB deployment where budget is the primary constraint, Omada is the right call. For a venue that needs a unified security and networking platform with cameras, door access, and VoIP all in one pane of glass, UniFi's ecosystem advantage becomes relevant. The good news: Purple works equally well on both. The RADIUS integration path is identical. So your Purple investment is hardware-agnostic. --- [IMPLEMENTATION RECOMMENDATIONS & PITFALLS — approximately 2 minutes] A few things I see go wrong in Omada plus Purple deployments. The most common issue is an incomplete walled garden. If you don't whitelist all of Purple's required domains, guests on iOS devices will see a broken captive portal — the Captive Network Assistant on iOS is particularly unforgiving about this. Always cross-reference Purple's published walled garden list and test with an iPhone before you sign off on a deployment. The second pitfall is HTTPS redirect. Leave it disabled. Purple's portal flow requires HTTP redirect to intercept the initial connection. Enabling HTTPS redirect on the Omada portal breaks the splash page redirect chain. Third: NAS ID. Set it to something meaningful — typically the venue name or SSID name. This value appears in Purple's RADIUS accounting logs and makes troubleshooting significantly easier when you're trying to identify which site or SSID a session came from. Fourth: interim update interval. Set it to 120 seconds for the standard captive portal, and 240 seconds for the SecurePass RADIUS profile. This controls how frequently session accounting data is sent to Purple. Too long and you lose granularity in the analytics. Too short and you're generating unnecessary RADIUS traffic. Finally: controller reachability. If you're using the OC200 hardware controller on-site, make sure it's on a UPS. A controller reboot during peak hours won't drop existing sessions, but it will prevent new authentications until it comes back up. --- [RAPID-FIRE Q&A — approximately 1 minute] Does Purple work with TP-Link Omada? Yes. Fully supported, documented configuration available. Do I need a paid Purple plan? No. The Connect plan is free and supports the full RADIUS captive portal integration with Omada. You get branded splash pages, network analytics, and GDPR-compliant data handling at zero cost. Can I run multiple SSIDs — one for guests and one for staff — on the same Omada deployment? Yes. Create separate SSIDs: guest SSID using Purple's External RADIUS portal, staff SSID using WPA2 or WPA3-Enterprise against your Active Directory or Entra ID via Purple's SAML connector. What's the maximum number of concurrent users Omada APs support? It varies by model. The EAP670 supports up to 574 concurrent clients. For high-density venues like conference centres or stadiums, look at the EAP660 HD which is purpose-built for dense deployments. Is the integration PCI DSS compliant? The guest network isolation — enforced by Omada's Guest Network mode — combined with Purple's GDPR-compliant data handling gives you a solid compliance baseline. For full PCI DSS scope, you'll need to ensure the guest VLAN is properly segmented from any cardholder data environment. --- [SUMMARY & NEXT STEPS — approximately 1 minute] To wrap up: TP-Link Omada and Purple is a well-supported, cost-effective combination for SMB guest WiFi deployments. The hardware cost advantage over UniFi is real and meaningful at scale. The integration is straightforward if you follow the three-step configuration — SSID, portal with External RADIUS, and walled garden. The most common failure points are the walled garden and HTTPS redirect settings, both of which are easy to get right if you know to look for them. For next steps: if you're evaluating this for a client, start with Purple's free Connect plan — there's no financial risk. Spin up an Omada Cloud account, deploy a single EAP650 or EAP670 as a proof of concept, and run through the configuration. You'll have a working captive portal in under an hour. If you're ready to go further — data capture, CRM integration, behavioural analytics — that's where Purple's Capture and Engage plans come in. But start with Connect, prove the value, and scale from there. Thanks for listening. If you found this useful, there's a full written guide with configuration tables, architecture diagrams, and worked examples available at purple.ai. --- END OF SCRIPT