Passpoint and OpenRoaming: Complete Guide

Executive Summary

Enterprise connectivity demands have shifted from manual, captive-portal-based guest access to automated, secure, and frictionless onboarding. Passpoint (defined by the Wi-Fi Alliance as Hotspot 2.0) and OpenRoaming (orchestrated by the Wireless Broadband Alliance) represent the standardization of this shift. By utilizing IEEE 802.11u protocols and WPA3-Enterprise security, these technologies allow mobile devices to discover, authenticate, and connect to secure WiFi networks automatically without user intervention.

This guide serves as an authoritative reference for network architects and IT directors planning to deploy these technologies across large-scale venues, retail environments, and corporate campuses. We examine the underlying cryptographic handshakes, the federation architecture, and the practical configuration steps required to integrate these standards into existing wireless infrastructure. By adopting these frameworks, organizations can eliminate the friction of traditional guest portals while significantly enhancing their wireless security posture.

Technical Deep-Dive

To understand Passpoint and OpenRoaming, one must first dissect the underlying protocols that govern their operation. At the core of Passpoint is IEEE 802.11u, an amendment to the 802.11 standard that enables wireless devices to discover network services before establishing an association.

Historically, a client device had to associate with an Access Point (AP) and obtain an IP address before it could query the network's capabilities. With 802.11u, this discovery occurs in the pre-association state using Access Network Query Protocol (ANQP) queries.

The 802.11u Discovery Process

When a Passpoint-enabled device scans the airwaves, it detects a beacon containing an Interworking element. This element signals that the AP supports 802.11u and advertises its network type (e.g., private, free public, chargeable public). The client device then sends an ANQP query to request specific parameters, such as:

• Roaming Consortium Organization Identifiers (OIs): Globally unique identifiers assigned by the IEEE that represent specific roaming partners or federations.
• Venue Name and Venue Group: Metadata describing the physical location (e.g., "Terminal 2" or "Stadium").
• IP Address Type Availability: Information on whether IPv4 or IPv6 is available, and if NAT is applied.

If the client device possesses a profile containing a matching Roaming Consortium OI, it initiates the authentication process without prompting the user.

OpenRoaming Federation Architecture

OpenRoaming acts as a global federation layer on top of Passpoint. It establishes a secure Public Key Infrastructure (PKI) managed by the Wireless Broadband Alliance (WBA). This federation allows identity providers (IDPs) - such as mobile network operators, device manufacturers (Apple, Google), and enterprise identity systems - to peer securely with network providers.

Authentication is executed using WPA3-Enterprise (or WPA2-Enterprise for legacy compatibility) with Protected Extensible Authentication Protocol (PEAP) or Extensible Authentication Protocol-Transport Layer Security (EAP-TLS). The AP acts as an authenticator, encapsulating the EAP packets into RADIUS (Remote Authentication Dial-In User Service) or RadSec (RADIUS over TLS) packets and forwarding them to the identity provider.

RadSec is mandatory in OpenRoaming to secure the communication between the local network's RADIUS proxy and the global IDPs over the public internet. RadSec uses TCP port 2083 and TLS encryption, ensuring that user credentials and authentication attributes remain confidential during transit across intermediate transit providers.

Implementation Guide

Deploying Passpoint and OpenRoaming requires a systematic approach across the wireless controller (WLC), RADIUS infrastructure, and DNS/firewall configurations.

Step 1: Network Infrastructure Audit

Ensure your APs and WLCs support 802.11u and Passpoint Release 2 or 3. Verify that your RADIUS server supports RadSec (RFC 6614). If your legacy RADIUS server does not support RadSec, you must deploy a RadSec proxy (such as FreeRADIUS or a dedicated gateway) in your DMZ.

Step 2: Firewall Configuration

Open outbound TCP port 2083 to the OpenRoaming RadSec proxy servers. Ensure DNS resolution is configured correctly on your RADIUS servers, as RadSec relies on Dynamic Delegation Discovery System (DDDS) and NAPTR records to locate the appropriate IDP.

Step 3: Certificate Acquisition

Obtain a WBA-approved RadSec certificate from an authorized Certificate Authority (CA). This certificate is critical for mutual TLS (mTLS) authentication between your local RadSec proxy and the OpenRoaming federation brokers.

Step 4: Wireless Controller Configuration

1. Create a Secure SSID: Configure a new SSID or modify an existing one to use WPA3-Enterprise (or WPA2/WPA3 transition mode).
2. Enable 802.11u (Interworking): Enable the Interworking feature on the SSID.
3. Configure the HESSID: Set the Homogeneous ESSID, typically the MAC address of one of the AP radios, to uniquely identify the network group.
4. Add Roaming Consortium OIs: Add the OpenRoaming Roaming Consortium OIs. The standard OIs are:
   • 5A-03-BE-00-00 (Settlement-Free, identities verified by Google, Apple, or mobile operators)
   • 5A-03-BE-00-01 (Settled, for commercial roaming agreements)
5. Configure ANQP Parameters: Define the Venue Name, Venue Group, and Network Type.

Step 5: RADIUS/RadSec Proxy Setup

Configure your local RADIUS server to act as a RadSec proxy. Define routing rules that forward authentication requests containing the OpenRoaming OIs or specific realm patterns to the OpenRoaming RadSec gateway.

Best Practices

To ensure a stable and high-performing deployment, adhere to the following industry-standard recommendations:

• SSID Consolidation: Do not create a dedicated SSID for Passpoint or OpenRoaming. Instead, combine them onto a single, secure enterprise SSID. This minimizes beacon overhead and conserves valuable airtime.
• Certificate Management: Implement automated certificate renewal processes for your RadSec certificates. An expired certificate will immediately halt all OpenRoaming authentications.
• Channel Planning: Because Passpoint relies on pre-association ANQP exchanges, client devices spend more time scanning and querying. Optimize your 5 GHz and 6 GHz channel planning to reduce contention and ensure rapid probe responses.
• Realm Filtering: Implement strict realm filtering on your RadSec proxy to prevent unnecessary authentication traffic from flooding the federation network. Only forward requests that match valid OpenRoaming patterns.
• User Experience Alignment: Ensure that your physical venue signage and digital marketing materials inform users that they can connect automatically via OpenRoaming, reducing reliance on unencrypted open SSIDs.

Troubleshooting & Risk Mitigation

Common Failure Modes and Resolutions

Issue: Client devices fail to connect automatically

• Root Cause: Missing or misconfigured Roaming Consortium OIs on the WLC, or the client device does not have the correct profile installed.
• Mitigation: Use a packet analyzer to capture the beacon and probe response frames. Verify that the 802.11u Interworking element contains the correct OIs. Ensure the client profile is provisioned correctly via an MDM or a provisioning portal.

Issue: RadSec connection failures

• Root Cause: Firewall blocking TCP port 2083, or invalid/expired RadSec certificates.
• Mitigation: Perform a packet capture on the WAN interface of the RADIUS proxy. Verify that the TLS handshake completes successfully. Check the certificate revocation list (CRL) status.

Issue: High latency during authentication

• Root Cause: Geographically distant IDPs or slow DNS resolution for NAPTR records.
• Mitigation: Implement local caching of DNS records and ensure your RADIUS proxy has low-latency paths to the regional OpenRoaming hubs.

ROI & Business Impact

Transitioning to Passpoint and OpenRoaming delivers measurable business value across three primary vectors: operational efficiency, security posture, and data intelligence.

Operational Efficiency

By automating the connection process, venues experience a significant reduction in guest-WiFi-related support tickets. Front-desk staff and IT help desks spend less time troubleshooting captive portal failures and password issues.

Security Posture

Traditional open guest networks expose users to eavesdropping and man-in-the-middle attacks. Passpoint mandates enterprise-grade encryption (WPA2/WPA3-Enterprise), securing all over-the-air traffic. This protects both the user and the venue from liability associated with data breaches.

Data Intelligence

When integrated with platforms like Purple, Passpoint allows venues to identify returning visitors seamlessly. Because the device connects automatically, the venue captures accurate dwell time and visit frequency metrics without requiring the user to open a browser and log in repeatedly. This continuous data stream enables highly targeted, real-time engagement strategies.