Three SSIDs to rule them all: guest, Passpoint, and IoT WiFi setup guide

Welcome to the Purple technical briefing series. Today we are covering the three-SSID WiFi design - a network architecture that consolidates guest access, secure automated onboarding, and IoT device management under three purpose-built wireless networks. If you are running WiFi across a hotel, a retail estate, a stadium, or a conference centre, this is the design you should be deploying in 2025 and beyond. [medium pause] Let me set the context first. Most venues we encounter are still running two SSIDs at best - a guest network and something loosely called a staff network. The problem is that those two networks end up carrying everything. Card terminals sit on the same segment as guest smartphones. Contractors connect to the same SSID as your digital signage. IoT sensors share bandwidth with visitors streaming video. That is not a security posture. That is a liability. The three-SSID design solves this by giving every class of device and user its own dedicated network, its own VLAN, and its own authentication method. Three SSIDs. Three VLANs. One coherent security architecture. [medium pause] Let us walk through each one. SSID number one is your open Guest WiFi. This is the traditional captive portal network - the one your visitors see when they open their phone and connect. It is open, meaning no pre-shared key, because you want zero friction at the point of connection. The authentication happens at the portal layer. The visitor connects, gets redirected to a splash page, accepts your terms of service, and optionally provides an email address or phone number. That is your conscious-choice opt-in for GDPR compliance. Purple's platform handles this natively - the portal captures first-party data, logs the consent timestamp, and maps the session to VLAN 10, which is your guest segment. VLAN 10 gets internet access only. It cannot reach your POS systems, your back-office servers, or any other internal resource. Firewall rules enforce that at the edge. From a compliance standpoint, this SSID does the heavy lifting. GDPR requires that you record consent, the lawful basis for processing, and the timestamp. Purple logs all of that automatically. If you are in a venue that falls under PCI DSS - a hotel with in-room payment terminals, for example - the guest SSID must be completely isolated from any cardholder data environment. VLAN segmentation with an inter-VLAN firewall policy achieves that. [medium pause] SSID number two is your Passpoint network, also known as Hotspot 2.0. This is where the design gets genuinely interesting. Passpoint is an IEEE 802.11u standard that allows a device to automatically discover, authenticate, and connect to a WiFi network without any user interaction. No portal. No password prompt. The device negotiates authentication in the background using EAP - Extensible Authentication Protocol - and connects encrypted from the first packet. How does a device know to connect? It has a Passpoint profile installed. With Purple, that profile is delivered via the Purple app or via an SDK you embed in your own branded app. When a returning visitor walks into your venue, their device sees your Passpoint SSID broadcasting an ANQP response, matches it against the installed profile, and connects automatically. The whole process takes under two seconds. The user never touches their phone. The authentication flow uses EAP-TLS or EAP-TTLS with PEAP, depending on your configuration. The device presents a credential to your RADIUS server - Purple acts as that RADIUS server in the cloud - and the server returns a RADIUS Access-Accept with a VLAN assignment attribute. That attribute tells the access point which VLAN to place that session on. So a loyalty app user might land on VLAN 20, which has access to your loyalty platform and richer content. A staff member using the same Passpoint SSID with a different credential lands on VLAN 30, which has access to internal systems. One SSID. Dynamic VLAN assignment. Policy enforced per identity. [medium pause] SSID number three is your xPSK network. xPSK is an umbrella term covering iPSK, PPSK, DPSK, and MPSK - all variations on the same concept of per-device or per-group pre-shared keys. The idea is straightforward: instead of one shared password for your IoT devices and contractors, every device or group gets its own unique key. That key maps to a specific VLAN. When a card terminal connects with its key, it lands on VLAN 40, which is your PCI-scoped payment network. When a digital signage player connects with its key, it lands on VLAN 50, which has access to your content management server but nothing else. When a contractor connects with a temporary key, they land on VLAN 60, which has internet access and nothing internal. When you revoke that contractor's key, they are off the network immediately. No password change required across every device. The mechanism behind xPSK varies by vendor. On Cisco Meraki, it is called iPSK - Identity PSK - and it works via RADIUS. On HPE Aruba, the equivalent is MPSK, also RADIUS-driven. Ruckus calls it DPSK - Dynamic PSK. Juniper Mist uses PPSK with dynamic VLAN assignment through Mist's cloud dashboard. Ubiquiti UniFi supports Network Access Control with per-client VLAN assignment in recent firmware versions. Purple integrates with all five of these platforms as a cloud RADIUS provider. [medium pause] Now let us talk about implementation sequence. The order matters. Start with your VLAN design before you touch the wireless configuration. Define your VLANs at the switch layer first. Configure your inter-VLAN routing policy and lock it down at the firewall before any device connects. This is the most common mistake we see: teams configure the wireless first, then try to retrofit the VLAN segmentation. Do it the other way around. Second, configure your RADIUS server. In Purple's platform, you navigate to the RADIUS configuration section, generate your server credentials, and note the primary and secondary IP addresses, the authentication port - typically 1812 - and the shared secret. Third, build your SSIDs. For the guest SSID, set security to open, enable captive portal redirect, and point the redirect URL at your Purple portal. For the Passpoint SSID, enable 802.11u and configure your ANQP elements - your NAI Realm, your Roaming Consortium OI if you are participating in OpenRoaming, and your venue information. Set WPA2-Enterprise or WPA3-Enterprise as the security type. For the xPSK SSID, configure the vendor-specific MPSK or DPSK settings and point authentication at your Purple RADIUS endpoint. Fourth, configure your walled garden for the guest SSID. Include Purple's portal domains, your DNS resolver, and the captive portal detection endpoints that iOS and Android use - Apple's captivedetect.apple.com and Google's connectivitycheck.gstatic.com. [medium pause] Two real-world examples. A 350-room hotel in central London deployed this architecture across 28 access points running HPE Aruba hardware. Before the deployment, card terminals shared a network segment with guest devices - a PCI compliance failure. The three-SSID redesign moved card terminals to a dedicated VLAN with firewall rules permitting only outbound HTTPS to the payment processor. The PCI audit passed on the next cycle. Guest data capture increased by 34% in the first three months because the portal experience was faster and the opt-in flow was cleaner. A retail chain with 80 stores across the UK reduced their per-store SSID count from an average of 4.2 to three. EPOS terminals and signage moved to the xPSK SSID with per-device keys managed centrally through Purple. Staff moved to a Passpoint SSID using their Microsoft Entra ID credentials via EAP-TTLS. The IT team reported a 60% reduction in WiFi-related support tickets in the first quarter after rollout. [medium pause] A few implementation pitfalls to watch for. RADIUS timeout configuration: if your access points cannot reach the Purple RADIUS server within the configured timeout, they will deny the connection. Always configure both primary and secondary RADIUS server addresses. VLAN tagging on trunk ports: every access point uplink port must be configured as a trunk carrying all the VLANs your SSIDs use. A common mistake is configuring the VLAN at the controller but forgetting to add it to the trunk on the switch port. Passpoint ANQP configuration: the NAI Realm list must match exactly what is in the Passpoint profile installed on the device. A mismatch will cause devices to skip your network during discovery. Test with a known-good device before rolling out to production. xPSK key rotation: contractor keys should have an expiry date set at provisioning. Purple's dashboard lets you revoke individual keys without affecting any other device on the network. [medium pause] Rapid-fire questions. Can I run all three SSIDs on the same access point? Yes. Keep the total SSID count per access point to six or fewer to minimise beacon overhead. Does Passpoint require a specific app? With Purple, it requires either the Purple app or an SDK integrated into your own branded app. The SDK handles profile provisioning silently in the background. Is xPSK PCI compliant for card terminals? Yes, provided the VLAN carrying payment device traffic is properly segmented and firewall rules restrict traffic to only what the payment processor requires. What happens if a guest SSID portal goes down? Configure a fallback redirect or a local splash page on the access point controller. Purple's platform runs at 99.999% uptime, but belt-and-braces configuration is always good practice. [medium pause] To summarise. The three-SSID design gives you a guest network with a compliant captive portal for data capture, a Passpoint network for automated secure onboarding via the Purple app or SDK with dynamic VLAN assignment, and an xPSK network that consolidates IoT devices, card terminals, digital signage, contractors, and BYOD under per-device keys mapped to specific VLANs. The result is a cleaner security posture, a better visitor experience, and a network that is genuinely manageable at scale. Start with your VLAN design, configure RADIUS, build your SSIDs, and set your walled garden. Purple's onboarding team can walk you through the configuration for your specific hardware platform. The full written guide is available at purple.ai. Search for "three SSIDs to rule them all" for the step-by-step configuration reference with vendor-specific details for Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, and Ubiquiti UniFi. Thanks for listening.