WatchGuard Firebox Integration with Purple WiFi: Setup and Configuration Guide

Executive summary

Deploying a secure, scalable wireless infrastructure across complex venues requires precise integration between your security gateway and identity provider. This guide details the integration of WatchGuard Firebox and WatchGuard Access Points with Purple, covering three distinct access tiers: Guest WiFi captive portal redirection, Secure Staff WiFi using IEEE 802.1X, and Multi-Tenant WiFi segmentation via WatchGuard Private Pre-Shared Keys (PPSK).

By combining WatchGuard's unified security platform with Purple's cloud overlay, you automate identity-based access control, enforce granular security policies, and capture first-party data at scale. Purple operates across 80,000+ live venues and processed 440 million logins in 2024 (Purple internal data). The integration is hardware-agnostic by design - WatchGuard sits alongside Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet in Purple's supported hardware list. For a broader view of enterprise WiFi security standards, see our Enterprise WiFi Security: A Complete Guide for 2026 .

Technical architecture

The integration connects WatchGuard hardware to Purple's cloud services using two standard mechanisms: RADIUS (Remote Authentication Dial-In User Service) for authentication and accounting, and HTTP redirection for captive portal delivery. The architecture supports three access tiers on a single physical infrastructure.

All three tiers can run simultaneously across the same WatchGuard Access Point fleet. WatchGuard Wi-Fi 6 models - the AP130, AP230W, AP330, AP332CR, AP430CR, and AP432 - support PPSK from firmware v2.6 onwards.

Configuring Guest WiFi captive portal redirection

The WatchGuard captive portal integration redirects unauthenticated HTTP requests to Purple's hosted splash page. This is the primary mechanism for capturing first-party data and enforcing terms of service.

Step 1: RADIUS server configuration

In WatchGuard Cloud or Firebox Policy Manager, define Purple as the RADIUS authentication and accounting server.

• Primary RADIUS server: Set to the Purple RADIUS IP address for your region (available in the Purple portal under Settings > Hardware Integration).
• Authentication port: 1812
• Accounting port: 1813
• Shared secret: Enter the unique secret provided in the Purple portal.
• NAS ID: Set this to the MAC address of the Firebox or AP using the %m format specifier. This identifies the venue to Purple and routes analytics to the correct account.
• Accounting interval: Set to 10 minutes to ensure session data flows to Purple's analytics dashboard at regular intervals.

Step 2: SSID and captive portal settings

In WatchGuard Cloud, navigate to Configure > Devices > [Your AP] > Device Configuration > SSIDs. Create or edit the Guest SSID.

• Security: Open (no pre-authentication password).
• Captive portal type: Select Third-Party Hosted Captive Portal with RADIUS Authentication.
• Splash Page URL: Enter the Purple splash page URL (e.g., https://wifi.mypurple.com/splash). Retrieve this from Purple > Analyze > Portals.
• Shared secret: Enter the portal shared secret from the same Purple Analyze Portals page. This secret generates the HMAC-SHA1 digest that WatchGuard uses to validate the authentication success response from Purple.

Step 3: Walled Garden configuration

The Walled Garden defines which domains a device can access before authentication completes. Without this, the device cannot load the Purple splash page. Add the following entries to Websites that users can access before login:

• *.mypurple.com
• api.mypurple.com
• cdn.mypurple.com
• assets.mypurple.com

If you enable social or federated logins via Microsoft Entra ID, Okta, or Google Workspace, add the relevant identity provider domains (e.g., login.microsoftonline.com, accounts.google.com). For legal and compliance context on shared WiFi infrastructure, see our guide on Legal and Compliance Requirements for Shared WiFi Infrastructure .

How the HMAC authentication flow works

Understanding this flow helps you diagnose failures quickly.

1. The guest device connects to the open SSID and makes an HTTP request.
2. The WatchGuard AP intercepts the request and redirects the browser to the Purple splash page URL, appending a challenge parameter (a random hex string) and the device MAC address.
3. Purple displays the splash page. The guest completes the login form.
4. Purple generates an HMAC-SHA1 digest using the portal shared secret and the challenge value.
5. Purple redirects the browser back to the WatchGuard AP's login URL, appending the challenge and digest.
6. The WatchGuard AP validates the digest using the same shared secret. If it matches, the AP grants internet access and sends a RADIUS Accounting Start packet to Purple.

Secure Staff WiFi with 802.1X

For Staff WiFi, you replace the captive portal with IEEE 802.1X - the enterprise standard for port-based network access control. Each staff member authenticates with unique credentials or a certificate, eliminating the shared-password risk.

In WatchGuard Cloud, configure the Staff SSID with WPA3 Enterprise security and point the Authentication Domain to Purple's RADIUS server. Purple acts as the RADIUS server and can proxy authentication requests to Microsoft Entra ID, Okta, or Google Workspace via SAML or LDAP.

For certificate-based authentication (EAP-TLS), deploy client certificates via your MDM to managed devices. For credential-based authentication (PEAP-MSCHAPv2), users authenticate with their directory credentials. Purple validates the request against the configured identity provider and returns a RADIUS Access-Accept or Access-Reject to the WatchGuard AP.

For a detailed walkthrough of 802.1X configuration across device types, see our guide on 802.1X authentication: securing network access on modern devices .

Important note on MAC randomisation: Modern iOS and Android devices randomise their MAC addresses by default. For 802.1X Staff WiFi, instruct staff to disable MAC randomisation for the Staff SSID. Randomised MACs cause inconsistent authentication logs and break MAC-based policy enforcement.

Multi-Tenant WiFi with WatchGuard PPSK

Broadcasting a separate SSID per tenant in a retail centre, coworking space, or Build-to-Rent (BTR) development causes co-channel interference and clutters the RF environment. WatchGuard PPSK (Private Pre-Shared Key) - introduced in AP firmware v2.6 - solves this by assigning a unique password to each user or tenant on a single SSID.

Step 1: Enable PPSK on the SSID

In WatchGuard Cloud, edit the target SSID (e.g., Venue-WiFi).

• Security: WPA2 Personal or WPA3 Personal.
• Authentication: Enable Private Pre-Shared Key (PPSK).
• RADIUS server: Point to Purple's RADIUS server. Purple manages the PPSK credential store and returns VLAN attributes on authentication.

Step 2: Configure Dynamic VLAN assignment

To isolate tenant traffic, the WatchGuard AP assigns a specific VLAN based on the PPSK used.

• VLAN setting: Select Dynamic VLAN assigned by RADIUS.
• Unassigned clients fallback: Select an isolated quarantine VLAN (e.g., VLAN 999) to ensure devices that fail RADIUS validation cannot access the corporate network.

Requirements for Dynamic VLANs on WatchGuard Access Points:

• AP firmware v2.2 or higher.
• NAT must be disabled on the SSID.
• Dynamic VLANs and Captive Portal cannot run on the same SSID simultaneously.
• The switch port connected to the AP must be configured as a trunk port carrying all relevant VLANs.

Step 3: RADIUS attributes for VLAN steering

When a user connects using a PPSK, the WatchGuard AP sends a RADIUS Access-Request to Purple. Purple validates the key and returns an Access-Accept packet containing three IETF RADIUS attributes:

The WatchGuard AP reads attribute 81 and places the client on the corresponding VLAN. In Purple, you map each PPSK credential to a specific VLAN ID and role. This is the mechanism behind Identity-Based Networks - the credential determines the network segment, not the SSID.

Implementation best practices

These recommendations apply to hospitality , retail , healthcare , and transport deployments.

Session timeouts: Configure session timeouts in both Purple and WatchGuard to force re-authentication at regular intervals. This keeps analytics accurate and prevents stale sessions from consuming bandwidth. Set RADIUS Interim-Update (Acct-Interim-Interval) to 600 seconds (10 minutes).

Firmware management: Ensure WatchGuard Access Points run firmware v2.6 or higher for PPSK support. Use WatchGuard Cloud to schedule firmware upgrades during off-peak hours to avoid coverage gaps.

PCI DSS compliance: For retail environments processing card payments, isolate POS devices on a dedicated VLAN (e.g., VLAN 200) using PPSK. Ensure the Guest WiFi VLAN has no route to the POS VLAN. This supports PCI DSS network segmentation requirements.

GDPR and data collection: Purple's captive portal uses conscious-choice opt-ins, ensuring data collection meets GDPR requirements. Purple is ISO 27001, GDPR, CCPA, and Cyber Essentials certified. Ensure your splash page includes a clear privacy notice and terms of service link before data capture begins.

Troubleshooting and risk mitigation

Captive portal fails to load: The Walled Garden is the first place to check. If the device cannot resolve DNS or reach Purple's servers pre-authentication, the browser shows a timeout error rather than the splash page. Verify all Purple domains are in the Walled Garden list and that the WatchGuard DNS settings allow pre-auth resolution.

HMAC digest validation errors: If WatchGuard logs show authentication failures with HMAC errors, the Captive Portal Shared Secret does not match between WatchGuard and Purple. It must be identical in both systems. Regenerate the secret in Purple and re-enter it in WatchGuard Cloud.

VLAN steering fails: If a PPSK user receives an IP from the wrong VLAN, check the RADIUS logs in the Purple portal. Verify that Purple is returning all three IETF RADIUS attributes. Ensure the Tunnel-Private-Group-ID value is formatted as a string and matches a VLAN ID configured on the switch trunk port.

PPSK and Captive Portal conflict: WatchGuard does not support Dynamic VLANs and Captive Portal on the same SSID. If you need both, use two SSIDs: one for guest captive portal and one for PPSK multi-tenant access.

802.1X authentication failures: Use the packet capture tool available in WatchGuard AP firmware v2.5 and higher to capture traffic between the AP and the RADIUS server. Look for RADIUS Access-Reject packets and the reason code in the reply message attribute.

ROI and business impact

The WatchGuard and Purple integration consolidates security and analytics into a single architecture. A 200-room hotel using this integration eliminates the need for separate guest and staff gateways, reducing hardware expenditure by approximately 30% compared to a multi-gateway deployment (Purple internal data). The Guest WiFi captive portal captures first-party data - email addresses, demographic information, and visit frequency - that drives direct marketing revenue through Purple's Engage plan.

For multi-tenant venues, PPSK eliminates the operational overhead of managing multiple SSIDs. A retail centre managing 15 shop units on a single SSID reduces AP radio utilisation and simplifies network audits. WiFi Analytics from Purple provides venue operators with dwell time, footfall, and repeat visit data - metrics that justify the infrastructure investment to finance teams.

Purple maintains 99.999% uptime (Purple internal data), ensuring the Guest WiFi captive portal remains available even during peak periods at high-density venues like stadiums and conference centres.