Alcatel-Lucent Enterprise (ALE) OmniAccess Integration with Purple WiFi

Executive summary

Alcatel-Lucent Enterprise (ALE) OmniAccess Stellar access points integrate with Purple using standard RADIUS protocols and external captive portal redirection. No proprietary middleware is required. Purple operates as a cloud overlay, sitting on top of your existing ALE infrastructure and handling authentication, data capture, and session policy without requiring hardware changes.

This guide covers three deployment scenarios. First, Guest WiFi with external captive portal redirection and Walled Garden configuration. Second, secure Staff WiFi using 802.1X with PEAP or EAP-TLS. Third, Multi-Tenant WiFi using Private Pre-Shared Keys (PPSK) and dynamic VLAN steering via RADIUS Attributes 64, 65, and 81.

Purple serves more than 80,000 live venues and processed over 440 million logins in 2024 (Purple internal data, 2024). It holds ISO 27001, GDPR, CCPA, and Cyber Essentials certifications. The platform operates at 99.999% uptime, making it a reliable authentication backend for enterprise deployments.

If you are an IT manager or network architect deploying ALE OmniAccess hardware in hospitality, retail, events, or public-sector environments, this guide gives you the exact configuration steps to go from hardware to a fully operational Identity-Based Network.

Technical architecture and integration flow

The Purple integration with ALE OmniAccess Stellar relies on two standard protocols: RADIUS for authentication and accounting, and HTTP/HTTPS redirect for captive portal delivery. The ALE AP acts as the Network Access Server (NAS), forwarding authentication requests to the Purple cloud RADIUS server and enforcing the policies returned in the Access-Accept response.

Figure 1: Authentication flow between guest device, ALE OmniAccess Stellar AP, and Purple cloud RADIUS.

The flow operates as follows. A visitor connects to the open Guest WiFi SSID. The ALE AP assigns a temporary IP address from the pre-authentication DHCP pool and intercepts the visitor's first HTTP or HTTPS request. The AP redirects the browser to the Purple captive portal URL, passing the client's MAC address and the AP's NAS identifier as URL parameters. The visitor authenticates via the Purple splash page - using email, social login, or SMS verification. Purple's RADIUS server validates the session and returns an Access-Accept message to the ALE AP. The AP grants internet access and begins sending RADIUS Accounting updates to Purple at the configured interval.

For advanced deployments using PPSK and dynamic VLAN steering, the RADIUS Access-Accept message also includes VLAN assignment attributes. The ALE AP uses these to drop the client traffic directly onto the correct VLAN segment, isolating them from other users on the same physical infrastructure.

Implementation guide

Part 1: Guest WiFi with external captive portal

This section covers the Alcatel-Lucent captive portal configuration for external redirection to Purple. These steps apply to ALE OmniAccess Stellar APs managed via OmniVista Cirrus, OmniVista 2500, or the Stellar Express web interface.

Step 1: Retrieve Purple RADIUS credentials

Log into your Purple portal. Navigate to Management > Venues, select your venue, and open the Hardware section. Add a new hardware entry and select Alcatel-Lucent OmniAccess Stellar as the hardware type. Purple generates a unique RADIUS shared secret, authentication server IP, and captive portal URL for your venue. Record these values before proceeding.

Step 2: Configure the RADIUS server on the ALE AP

In your ALE management interface, navigate to the authentication settings and add a new RADIUS server profile.

Enable a secondary RADIUS server using the backup IP from the Purple portal. This ensures failover if the primary server is temporarily unreachable.

Step 3: Configure the Walled Garden

The Walled Garden defines the domains a device can reach before authentication completes. Configure the following entries in the pre-authentication access list:

Core Purple domains (mandatory):

Social login domains (add as required):

Omitting any required domain causes the corresponding login method to fail silently. Test each login method after configuration.

Step 4: Configure the Guest WiFi SSID

Create a new WLAN profile with the following settings:

If you require HTTPS redirect, install a valid SSL certificate in the ALE AP under System > General > Certificate Management. Note that wildcard certificates are not supported by the Stellar AP for this purpose.

Step 5: Assign the SSID to an AP group

Apply the WLAN profile to the relevant AP group in OmniVista. Verify that the APs are broadcasting the SSID and that clients can associate before testing the captive portal flow.

Part 2: Secure Staff WiFi using 802.1X

For Staff WiFi, use WPA2-Enterprise or WPA3-Enterprise with 802.1X authentication. This eliminates shared passwords and ties access to individual user identities managed in Microsoft Entra ID, Okta, or Google Workspace.

Step 1: Configure the 802.1X SSID

Create a separate WLAN profile for staff. Set the security type to WPA2-Enterprise or WPA3-Enterprise and assign the Purple RADIUS server as the authentication backend. Purple's RADIUS server proxies authentication requests to your identity provider via LDAP or SAML.

Step 2: Select the EAP method

For most deployments, use PEAP with MSCHAPv2. This requires only a server-side certificate and works with standard Windows, macOS, iOS, and Android supplicants. For higher-security environments, use EAP-TLS with client certificates issued via your PKI.

Step 3: Assign staff to a dedicated VLAN

Configure the Purple RADIUS server to return Tunnel-Private-Group-ID = your staff VLAN ID in the Access-Accept response. This ensures staff devices land on the corporate network segment, separated from guest traffic at Layer 2.

Part 3: Multi-Tenant WiFi using PPSK and dynamic VLAN steering

PPSK (Private Pre-Shared Key) - also referred to as iPSK (Identity PSK) in some vendor documentation - allows a single SSID to serve multiple isolated user groups. Each group receives a unique passphrase. The RADIUS server maps each passphrase to a specific VLAN, providing per-tenant network isolation without the RF overhead of multiple SSIDs.

Figure 2: PPSK multi-tenant VLAN segmentation on a single ALE OmniAccess SSID.

Step 1: Create the PPSK SSID

Create a new WLAN profile and set the authentication type to WPA2-PSK with RADIUS-backed PSK validation. In Stellar firmware 4.0.8.16 and above (for AP1301 and higher models), dynamic VLAN assignment via RADIUS is supported in Express Mode. For older models or earlier firmware, use OmniVista-managed mode.

Step 2: Define tenant passphrases in Purple

In the Purple portal, create a PPSK group for each tenant. Assign a unique passphrase per tenant and map each passphrase to the corresponding VLAN ID. Purple stores these mappings in its RADIUS database.

Step 3: Configure RADIUS attributes for VLAN steering

Ensure the Purple RADIUS server returns the following IETF standard attributes in every Access-Accept response:

All three attributes must be present. If any one is missing, the ALE AP ignores the VLAN assignment and places the client on the default VLAN.

Step 4: Verify VLAN trunking on the uplink

Ensure that all tenant VLANs are tagged on the uplink port between the ALE AP and the distribution switch. An AP cannot steer traffic to a VLAN that is not permitted on its uplink trunk.

Best practices

The following recommendations reflect standard practice for enterprise wireless deployments and align with IEEE 802.1X, PCI DSS 4.0, and GDPR requirements.

Separate Guest WiFi from Staff WiFi at Layer 2. Never place guest and staff traffic on the same VLAN. Use RADIUS-driven VLAN assignment to enforce this separation automatically, regardless of which AP the user connects to.

Use HTTPS for all captive portal redirections. Install a valid SSL certificate on the ALE AP to enable HTTPS redirect. This prevents browsers from displaying security warnings on the splash page, which reduces abandonment rates and aligns with GDPR requirements for secure data handling.

Set the RADIUS Accounting interval to 300 seconds. This provides Purple with regular session updates for analytics accuracy. An interval longer than 600 seconds risks losing session data if a client disconnects without a clean de-authentication.

Test the Walled Garden before go-live. Connect a test device to the Guest WiFi SSID and attempt to access each social login provider. If a login fails, the corresponding domain is missing from the Walled Garden.

Segment IoT devices using PPSK. In retail and hospitality environments, IoT devices such as digital signage, payment terminals, and environmental sensors should each receive a unique PPSK mapped to an isolated VLAN. This prevents a compromised IoT device from accessing the broader network.

For further reading on enterprise WiFi security standards and architecture, see our enterprise WiFi security guide .

Troubleshooting and risk mitigation

The following table covers the most common failure modes in ALE OmniAccess and Purple integrations.

For persistent RADIUS issues, enable debug logging on the ALE AP and capture the RADIUS exchange. Look for Access-Reject messages and check the reject reason code. Common codes include 16 (authentication failure) and 18 (missing attribute).

ROI and business impact

Deploying Purple on ALE OmniAccess hardware converts a passive network into an active data asset. Every authenticated session generates a visitor profile: email address, visit frequency, dwell time, and device type. This first-party data feeds directly into your CRM via Purple's library of over 400 connectors.

Harrods achieved a 57x marketing ROI from their Guest WiFi deployment by using Purple's data capture to drive loyalty programme sign-ups (Purple case study, 2023). AGS Airports generated an 842% ROI by implementing tiered bandwidth Paid WiFi across their estate (Purple case study, 2022).

For hospitality operators, the captive portal is the primary touchpoint for guest data capture. For retail environments, it enables shopper behaviour analytics and targeted promotions. For transport hubs, it provides passenger flow data and compliance-ready session logging.

Purple's Guest WiFi platform and WiFi Analytics tools give you the reporting infrastructure to measure these outcomes. Track authentication rates, session durations, repeat visitor rates, and opt-in conversion from a single dashboard.

For related integration guidance, see the WatchGuard Firebox integration guide , which covers a similar RADIUS-based architecture on a different hardware platform.