Extreme Networks and Purple WiFi: ExtremeCloud IQ Integration

Extreme Networks and Purple WiFi: ExtremeCloud IQ Integration — A Consultant Briefing [INTRODUCTION — approximately 1 minute] Welcome. If you're running an Extreme Networks environment and you've been asked to deliver a guest WiFi experience that actually does something useful — captures data, drives marketing, stays compliant — then this briefing is exactly what you need. I'm going to walk you through how ExtremeCloud IQ and Purple WiFi fit together: the architecture, the RADIUS flow, the VLAN segmentation, and the practical steps to get this live in your environment. Whether you're managing a hotel estate, a retail portfolio, a stadium, or a public-sector campus, the principles are the same. Let's get into it. [TECHNICAL DEEP-DIVE — approximately 5 minutes] First, a quick orientation on the two platforms. ExtremeCloud IQ is Extreme Networks' cloud-based network management platform. It gives you centralised visibility and configuration across your entire AP estate — whether that's a handful of APs in a single venue or thousands of devices across a national estate. The platform supports the full Extreme AP portfolio: the 302 series for cost-sensitive deployments, the 410 and 460 series for high-density environments, and the 630 series for Wi-Fi 6E deployments where you need maximum throughput and spectrum efficiency. Purple WiFi is an enterprise guest WiFi intelligence platform. It handles the captive portal — the branded splash page your guests see when they connect — and it also acts as a RADIUS authentication server, a data capture engine, and a marketing automation platform. The combination of ExtremeCloud IQ and Purple gives you a production-grade guest WiFi stack that is both technically robust and commercially valuable. Now, let's talk about the integration architecture. The core mechanism is a captive portal redirect combined with RADIUS authentication. Here's how the flow works in practice. A guest device associates with your guest SSID. That SSID is configured in ExtremeCloud IQ as an open or WPA3-SAE network — no pre-shared key for guests. The AP or the ExtremeCloud IQ controller intercepts the first HTTP request from the device and redirects it to Purple's captive portal URL. This redirect is configured in ExtremeCloud IQ under the SSID's captive portal settings — you point the redirect URL to your Purple venue's portal endpoint. The guest then interacts with the Purple portal. They might authenticate via social login, email, SMS verification, or a custom form — Purple supports all of these. Once they complete the authentication flow, Purple's backend sends a RADIUS Access-Accept message back to ExtremeCloud IQ. The AP then moves the device from the pre-authentication state to full network access. The RADIUS configuration in ExtremeCloud IQ is straightforward. You navigate to the Network Policy for your guest SSID, go to the AAA settings, and add Purple's RADIUS server details: the server IP address or hostname, the shared secret, and the authentication port — which is standard UDP 1812. You'll also want to configure the accounting port on UDP 1813 so that Purple receives session data for analytics and compliance purposes. Now, VLAN assignment. This is where the integration becomes genuinely powerful for network segmentation. Purple can return a RADIUS attribute — specifically the Tunnel-Private-Group-ID attribute — in the Access-Accept response. ExtremeCloud IQ reads this attribute and assigns the authenticated guest device to the corresponding VLAN. This means you can dynamically segment your guest traffic: standard guests go to one VLAN, VIP guests or loyalty members go to another, staff devices go to a third. All of this is driven by Purple's user profile logic, with no manual intervention required at the network layer. From a security and compliance perspective, this architecture aligns with IEEE 802.1X principles for port-based access control, even though the initial authentication is portal-based rather than certificate-based. The RADIUS exchange ensures that unauthenticated devices never reach the production network. For PCI DSS compliance — relevant if you have any payment processing on the same physical network — this VLAN segmentation is a critical control. For GDPR compliance, Purple's data capture mechanisms include consent management built into the portal flow, so you have an auditable record of every guest's consent at the point of authentication. On the ExtremeXOS side — for those of you running on-premises ExtremeXOS switches rather than pure cloud — the configuration approach is similar but uses the ExtremeXOS CLI or the legacy Extreme Management Centre. You configure the SSID on the AP using the ExtremeXOS wireless commands, define the RADIUS server profile, and set the captive portal redirect URL. The key difference is that in a pure ExtremeCloud IQ deployment, all of this is managed centrally through the cloud console, which significantly reduces per-site configuration overhead. Let me also mention the AP compatibility picture. The Purple integration works across the full range of Extreme APs managed by ExtremeCloud IQ. The 302i and 302e are your indoor and outdoor entry-level options — perfectly adequate for hotels and retail. The 410i and 410e are the workhorses for high-density environments like conference centres and stadiums. The 460 series adds Wi-Fi 6 capability, and the 630 series brings Wi-Fi 6E with 6 GHz band support. All of these APs support the captive portal redirect and RADIUS authentication mechanisms that the Purple integration relies on. [IMPLEMENTATION RECOMMENDATIONS AND PITFALLS — approximately 2 minutes] Right, let's talk about what can go wrong and how to avoid it. The most common pitfall is misconfigured walled garden entries. When a guest device is in the pre-authentication state — before they've completed the Purple portal — the AP needs to allow DNS resolution and HTTP/HTTPS access to the Purple portal domain. If you lock down the walled garden too tightly, the redirect never happens and guests just see a connection timeout. Make sure you whitelist Purple's portal domains and any CDN endpoints they use for portal assets. The second common issue is RADIUS shared secret mismatches. This sounds obvious, but in large deployments with multiple sites, it's easy to have a shared secret configured differently in ExtremeCloud IQ versus what Purple has on record. Always verify the shared secret on both sides before going live, and use a strong, randomly generated secret — not something like "purple123". Third: certificate validation for the captive portal redirect. Modern mobile operating systems — iOS in particular — are increasingly strict about HTTPS certificate validity. Purple's portal endpoints use valid TLS certificates, but if you're running any kind of SSL inspection or proxy in your network path, you may inadvertently break the redirect. Exclude the Purple portal domains from any SSL inspection policies. Fourth: accounting data. Don't skip the RADIUS accounting configuration. The accounting records are what Purple uses to build session analytics — dwell time, visit frequency, device type. If you don't configure accounting, you lose a significant portion of the analytics value that Purple provides. It's a five-minute configuration step that unlocks a lot of downstream value. Finally, test your VLAN assignment before go-live. Use a test device and verify that after authentication, the device lands on the correct VLAN. Check this with a simple traceroute or by verifying the IP address range the device receives. Dynamic VLAN assignment failures are silent — the device gets network access but on the wrong segment — so you need to actively verify it. [RAPID-FIRE Q&A — approximately 1 minute] Can I use Purple with ExtremeCloud IQ without RADIUS — just a simple redirect? Yes, you can configure a basic captive portal redirect without RADIUS, but you lose dynamic VLAN assignment and the session accounting data. For anything beyond a basic splash page, RADIUS is strongly recommended. Does Purple support WPA3? Yes. Purple's portal-based authentication is compatible with WPA3-SAE on the SSID. The RADIUS flow is independent of the wireless security protocol. Can I run Purple across multiple Extreme sites from a single Purple account? Absolutely. Purple's multi-venue architecture is designed exactly for this. Each site maps to a venue in Purple, and you configure the RADIUS server details per venue. ExtremeCloud IQ's network policies can be applied per-site, so the configuration scales cleanly. What about roaming between APs within a site? ExtremeCloud IQ handles intra-site roaming transparently. Once a guest is authenticated via Purple, the RADIUS session persists and the guest doesn't need to re-authenticate when they roam between APs on the same site. [SUMMARY AND NEXT STEPS — approximately 1 minute] To summarise: the ExtremeCloud IQ and Purple integration is a well-proven architecture that delivers guest WiFi with data capture, RADIUS authentication, dynamic VLAN segmentation, and full analytics — all managed centrally through ExtremeCloud IQ's cloud console. The key steps to get this live are: configure your guest SSID in ExtremeCloud IQ with captive portal redirect pointing to Purple, add Purple's RADIUS server details in the AAA policy, configure your walled garden entries, enable RADIUS accounting, and verify VLAN assignment post-authentication. If you're evaluating this for a hospitality or retail deployment, the ROI case is straightforward: Purple's analytics platform turns your guest WiFi from a cost centre into a first-party data asset. Combined with Extreme's enterprise-grade infrastructure, you get a solution that scales from a single venue to a national estate without architectural changes. For your next steps: get Purple's RADIUS server details from your Purple account manager, pull up the ExtremeCloud IQ network policy for your guest SSID, and run through the configuration checklist. Most deployments go live within a day for a single site. Thanks for listening. If you want to go deeper on any of these topics — captive portal design, VLAN segmentation strategy, or analytics configuration — the Purple documentation and support team are the right next call.