Nama ff iPSK: a comprehensive guide for businesses

Executive summary

Traditional WiFi security forces a choice between two inadequate options. Standard WPA2-Personal is simple but offers no individual accountability - one leaked password compromises the entire network. WPA2/3-Enterprise (IEEE 802.1X) delivers per-user control but breaks connectivity for gaming consoles, smart TVs, and IoT devices that cannot process digital certificates.

Identity Pre-Shared Key (iPSK) resolves this tension. It assigns a unique password to every individual user or device on a single SSID, enabling dynamic VLAN assignment and Layer 2 isolation via a central RADIUS server. For Build-to-Rent (BTR) operators, property developers, and landlords, iPSK is the definitive standard for multi-tenant connectivity. It supports 100% of resident devices, creates a Private Area Network (PAN) for each unit, and scales through automated lifecycle management integrated with identity providers like Microsoft Entra ID, Okta, or Google Workspace. Purple automates this entire workflow across 80,000+ live venues, integrating with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet.

Technical deep-dive

The mechanics of Identity PSK

iPSK modifies the standard WPA2 four-way EAPOL handshake. When a client device associates with an access point using a specific pre-shared key, the access point does not grant access immediately. Instead, it sends a RADIUS-REQUEST message to the central authentication server. This request contains vendor-specific attributes - for Cisco Meraki, these are the Meraki-IPSK attributes including Meraki-IPSK-Anonce and Meraki-IPSK-EAPOL. The RADIUS server runs a dictionary check against its database of configured iPSKs. If a match is found, it responds with an ACCESS-ACCEPT message containing the Tunnel-Password attribute and, critically, a dynamic VLAN assignment via Tunnel-Private-Group-Id.

This architecture requires no certificate infrastructure. The client device sees a standard WPA2-Personal network and connects with a password. The complexity is handled entirely between the access point and the RADIUS server.

Layer 2 isolation and Private Area Networks

In a multi-tenant environment, a single SSID across hundreds of apartments is efficient for RF planning but creates serious security risks without proper segmentation. iPSK enables the creation of a Private Area Network (PAN) for each resident.

When a resident authenticates with their unique iPSK, the RADIUS server assigns their devices to a specific VLAN. The network infrastructure enforces Layer 2 isolation between these VLANs. Resident A's iPhone can see their own printer or Chromecast, but Resident B in the next apartment cannot discover or interact with those devices. This micro-segmentation is critical for GDPR compliance and for maintaining resident trust.

Because each resident has their own isolated VLAN, you can enable mDNS reflection within that specific VLAN. mDNS is the protocol that enables AirPlay, Chromecast casting, and wireless printing. Enabling mDNS reflection within each resident's private VLAN allows their own devices to communicate with each other, while remaining completely isolated from all other residents. The result is a home-like experience on shared infrastructure.

Hardware vendor implementations

Enterprise hardware vendors use different terminology for per-device PSK, but the underlying RADIUS mechanics are consistent. The table below maps vendor names to the canonical implementation:

Purple is hardware-agnostic and integrates with all of these platforms as a cloud overlay, providing a unified management layer regardless of which hardware you have deployed.

WPA3 and the 6 GHz consideration

iPSK currently operates on WPA2. WPA3 uses Simultaneous Authentication of Equals (SAE), which is not compatible with the standard iPSK dictionary-check approach. If you are deploying WiFi 6E or WiFi 7 access points that operate on the 6 GHz band - which mandates WPA3 - you need a separate strategy for those clients. The practical approach is to maintain WPA2 iPSK on the 2.4 GHz and 5 GHz bands for broad device compatibility, while using WPA3-Enterprise for 6 GHz capable devices. See our related guide Uu PPSK: comparing features and deployment models for a deeper comparison of per-device PSK implementations and WPA3 transition planning.

Implementation guide

Step 1: RADIUS server configuration

The foundation of an iPSK deployment is a robust RADIUS infrastructure. The server must support the vendor-specific attributes required by your access points. For Cisco Meraki, configure the Meraki-IPSK attribute dictionary. For HPE Aruba, configure the Aruba-MPSK-Passphrase attribute. The RADIUS server must be highly available - a RADIUS outage will prevent new client authentications. Use a cloud-hosted RADIUS service with redundant instances rather than an on-premises single server.

Step 2: SSID and VLAN provisioning

Configure a single SSID across the property. Enable iPSK with RADIUS authentication on the wireless controller or cloud management dashboard. Define the VLAN pool for dynamic assignment - for example, VLAN 100 to VLAN 600 for a 500-unit development. Ensure that the core network switches are configured to trunk all of these VLANs to the access points, and that inter-VLAN routing is strictly controlled by firewall policy to maintain isolation.

For the three-SSID design pattern - Resident WiFi, Staff WiFi, and IoT WiFi - see our related article Three SSIDs to rule them all: guest, Passpoint, and IoT WiFi .

Step 3: Identity provider integration

Manual key management does not scale beyond a handful of units. Integrate your network management platform with an Identity Provider (IdP). Purple integrates with Microsoft Entra ID, Okta, and Google Workspace. When a new resident signs a lease and is added to your property management system, the integration automatically generates a unique iPSK, assigns a VLAN, and emails the credentials to the resident before their move-in date. When their lease ends and they are removed from the system, Purple revokes the key automatically.

Step 4: Change of Authorization (CoA) configuration

Key revocation in the RADIUS database does not immediately disconnect an already-associated device. The RADIUS authentication only occurs during the initial connection handshake. To force immediate disconnection on lease termination, configure your management platform to send a Change of Authorization (CoA) message directly to the wireless controller. This instructs the controller to drop the client session immediately. Verify CoA is working end-to-end in your test environment before go-live.

Step 5: Device onboarding and resident experience

Residents connect their smartphones, laptops, and smart TVs using their unique iPSK. The network automatically places them in their Private Area Network. For headless devices - gaming consoles, smart thermostats, wireless printers - the resident enters the iPSK during the standard WiFi setup process on the device. No captive portal, no certificate, no helpdesk call.

For hospitality deployments, iPSK eliminates the most common guest complaint: the recurring captive portal login. For retail environments, it enables secure staff device segmentation on the same physical infrastructure as Guest WiFi . For healthcare settings, it isolates sensitive medical IoT devices on a dedicated VLAN while providing simple connectivity for patients and visitors.

Best practices

Automate lifecycle management. Never manage keys manually. Use an orchestration layer like Purple to automate key creation and revocation based on lease dates or employment status. Manual management fails at scale and creates security gaps when residents leave.

Enforce strict Layer 2 isolation. Providing unique keys is only half the solution. Verify that Layer 2 isolation is functioning correctly by using network scanning tools to confirm that devices in different VLANs cannot discover each other via mDNS or broadcast traffic. This is the step most commonly skipped in initial deployments.

Plan for MAC address randomisation. Modern smartphones randomise their MAC address to protect user privacy. If your iPSK deployment relies strictly on MAC Address Bypass (MAB), randomisation will break authentication. Ensure your infrastructure uses EAPOL-based iPSK verification, which does not require pre-registering MAC addresses.

Monitor RADIUS performance. iPSK places a heavier load on the RADIUS server than standard 802.1X because of the dictionary checks required during the EAPOL handshake. Monitor authentication latency and scale the RADIUS infrastructure accordingly. In deployments with tens of thousands of keys, ensure the RADIUS database is properly indexed.

Reference IEEE 802.1X and PCI DSS. For properties that include retail or co-working spaces, the network segmentation provided by iPSK supports PCI DSS compliance by isolating payment card environments from general resident traffic. Document your VLAN segmentation and RADIUS access controls as part of your PCI DSS audit trail.

Troubleshooting and risk mitigation

Authentication timeouts

If the RADIUS server takes too long to process the EAPOL parameters and find a matching iPSK, the client device will time out and fail to connect. This is common in deployments with tens of thousands of keys. Mitigate this by ensuring the RADIUS database is indexed on the PSK field, and by using a high-performance cloud RADIUS service. Cisco Meraki documentation notes that an EAPOL handshake timeout after message two is expected behaviour during the initial lookup - the AP restarts the handshake once the RADIUS server returns the PMK.

VLAN assignment failures

If a client connects but does not receive an IP address, the RADIUS server may be failing to pass the correct VLAN attributes, or the network switch may not have the assigned VLAN configured. Verify the Tunnel-Private-Group-Id attribute in the RADIUS ACCESS-ACCEPT message using a packet capture, and check that the switch port is trunking the assigned VLAN to the access point.

MAC randomisation breaking MAB-based iPSK

If residents report intermittent connection failures, particularly after iOS or Android updates, MAC randomisation is the most likely cause. Migrate to EAPOL-based iPSK verification (Cisco Easy PSK from MR 32.1.3+) which does not require pre-registered MAC addresses.

Devices connecting but not reaching the correct VLAN

In Cisco Meraki deployments, VLAN override via RADIUS requires the SSID to be configured in Bridge mode with VLAN tagging enabled and RADIUS override set to "Override VLAN tag". Verify this configuration if clients are landing on the default SSID VLAN rather than their assigned VLAN.

ROI and business impact

iPSK delivers measurable business value for property developers and landlords across three dimensions.

Hardware cost reduction. Eliminating individual consumer-grade routers from every apartment removes a significant capital and operational expense. A 250-unit development deploying one consumer router per unit at £80 each represents £20,000 in hardware alone, plus ongoing replacement and support costs. Shared infrastructure with iPSK eliminates this entirely.

RF environment improvement. Each consumer router broadcasts its own SSID, creating competing WiFi networks that degrade signal quality for all residents. Removing individual routers and replacing them with a professionally planned access point deployment reduces interference and improves throughput for every resident.

Resident satisfaction and retention. Residents receive their unique iPSK before move-in, providing instant-on WiFi from day one. This removes the most common connectivity complaint in BTR developments. Managed WiFi with a clear service level is increasingly a differentiator in the BTR market, where residents compare amenities directly.

Operational efficiency. Automated credential provisioning and revocation eliminates helpdesk tickets related to password resets, move-in setup, and move-out procedures. Purple's WiFi Analytics platform provides usage data and network health monitoring, giving property managers visibility into their infrastructure without requiring dedicated IT staff on site.

For transport and public-sector operators managing multi-tenant environments, the same architecture applies. Purple's 99.999% uptime SLA, ISO 27001 certification, and GDPR compliance make it a credible choice for regulated environments where network availability and data protection are non-negotiable.