EnGenius Cloud Access Points Integration with Purple WiFi

Executive summary

Relying on a shared pre-shared key for enterprise WiFi exposes venues to significant security risks and prevents the collection of valuable first-party data. This guide details the integration of EnGenius Cloud Access Points with Purple's Guest WiFi platform to deliver secure, segmented, and measurable wireless networks across hospitality , retail , and multi-tenant environments. By implementing IEEE 802.1X authentication for staff, dynamic VLAN assignment via EnGenius MyPSK for residents and tenants, and a cloud-hosted captive portal for guests, IT teams can enforce strict access controls while turning wireless infrastructure into a business intelligence asset.

Purple processes 440 million logins annually across 80,000+ live venues (Purple internal data, 2024). The platform is ISO 27001 certified, GDPR and CCPA compliant, and hardware-agnostic - which is precisely why it integrates cleanly with EnGenius alongside Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, and Ubiquiti UniFi. This guide covers the four configuration layers required to deploy Purple on EnGenius Cloud hardware: guest captive portal redirection, Walled Garden setup, secure Staff WiFi, and multi-tenant isolation using EnGenius MyPSK.

Technical deep-dive

Architecture overview

The integration between EnGenius Cloud and Purple relies on standard RADIUS protocols and HTTP redirection. When a guest connects to an EnGenius ECW access point on a captive portal-enabled SSID, the AP intercepts the first HTTP request and redirects the browser to Purple's cloud-hosted splash page. This redirection passes several parameters to the portal - including client_mac, ap_mac, and userurl - which Purple uses to track the session and return an authentication decision.

For staff and operational devices, the architecture shifts from captive portal redirection to IEEE 802.1X port-based network access control. The EnGenius access point acts as the authenticator, forwarding Extensible Authentication Protocol (EAP) messages to Purple's RADIUS server via UDP port 1812. Upon successful authentication, the RADIUS server returns an Access-Accept message containing VLAN assignment attributes, instructing the AP to place the device on the correct network segment.

EnGenius Cloud platform

EnGenius Cloud is a cloud-managed networking platform supporting the ECW series access points (including the ECW220, ECW230, and ECW520 WiFi 7 models) and ECS series managed switches. The platform provides a centralised dashboard for SSID management, RADIUS configuration, VLAN tagging, and captive portal settings across all devices in an organisation. EnGenius Cloud supports three RADIUS-based captive portal authentication types: EnGenius Authentication (using the built-in Cloud RADIUS), Custom RADIUS (pointing to an external server such as Purple), and Voucher Service.

For enterprise deployments, Custom RADIUS is the correct authentication type when integrating with Purple. This mode instructs the access point to proxy authentication requests to Purple's RADIUS endpoint, enabling Purple's portal, analytics, and data capture capabilities.

EnGenius MyPSK and multi-tenant isolation

In environments such as build-to-rent properties, student accommodation, serviced offices, or coworking spaces, broadcasting a separate SSID for every tenant degrades radio frequency performance. Each additional SSID generates beacon frames that consume airtime and reduce the capacity available for data traffic. EnGenius MyPSK (also referred to as PPSK, or Private Pre-Shared Key) resolves this by allowing up to 500 unique PSKs on a single SSID.

Each key is bound to a specific VLAN. When a resident connects using their unique key, the access point places them on their designated network segment automatically. The encryption is per-user: each key generates a unique Pairwise Master Key (PMK), so one tenant cannot decrypt another tenant's over-the-air traffic even though they share the same SSID. This is a fundamental security advantage over a single shared PSK, where any user who knows the password can decrypt all traffic on the network.

MyPSK keys support expiration dates, making them well-suited to time-limited access scenarios: a student's key expires at the end of the academic year, a contractor's key expires when their engagement ends, and a conference attendee's key expires at midnight on the final day of the event.

Implementation guide

Step 1: Define your VLAN architecture

Before configuring any SSID, define the VLAN structure on your ECS switches. A typical deployment uses three VLANs:

Configure the ECS switch port connecting to each ECW access point as a trunk port, allowing all three VLANs. The native VLAN on the trunk should be the management VLAN. If the trunk is not configured correctly, dynamic VLAN assignment will fail silently.

Step 2: Configure the guest captive portal (EnGenius captive portal setup)

This is the primary configuration for deploying the EnGenius splash page with Purple.

1. Log into your EnGenius Cloud dashboard at cloud.engenius.ai .
2. Navigate to Configure > SSID and select your guest network (e.g., "VenueGuest").
3. Under the Wireless tab, set Security Type to Open. This is standard for guest WiFi; guests are identified and authenticated at the portal layer, not the association layer.
4. Switch to the Captive Portal tab and enable the portal.
5. Set Authentication Type to Custom RADIUS.
6. Enter the Purple RADIUS server details:

1. Switch to the Splash Page tab.
2. Select External Splash Page URL.
3. Enter the Purple portal URL for your venue (format: https://portal.purple.ai/[venue-id]).
4. Click Apply.

Step 3: Configure the Walled Garden

The Walled Garden (EnGenius guest WiFi whitelist) must be configured to allow pre-authentication access to the domains required for the portal to load. Navigate to Captive Portal > Advanced Settings > Walled Garden and add the following entries:

Purple infrastructure:

• *.purple.ai
• *.purpleportal.net

OS captive portal probes (mandatory):

• captive.apple.com (iOS and macOS)
• connectivitycheck.gstatic.com (Android)
• msftconnecttest.com (Windows)

Social login (if enabled):

• Google: accounts.google.com, oauth2.googleapis.com, apis.google.com, *.gstatic.com
• Facebook: www.facebook.com, graph.facebook.com, connect.facebook.net, *.fbcdn.net
• Microsoft Entra ID: login.microsoftonline.com, login.live.com

Always use domain names rather than static IP addresses. Social login providers use dynamic IP ranges and anycast routing; a static IP whitelist will degrade over time as CDN addresses change.

Step 4: Configure secure staff WiFi (802.1X)

The EnGenius RADIUS setup for staff WiFi uses WPA2 Enterprise to provide certificate-backed, passwordless authentication.

1. Create a new SSID (e.g., "VenueStaff").
2. Under the Wireless tab, set Security Type to WPA2 Enterprise.
3. Select Custom RADIUS and enter the RADIUS server IP, port 1812, and the shared secret.
4. No captive portal is required. Staff devices authenticate silently via 802.1X.
5. Configure your RADIUS server to return the following attributes on Access-Accept:

For EAP method selection: PEAP-MSCHAPv2 is the practical choice for environments using Microsoft Entra ID or Active Directory. EAP-TLS provides stronger security by eliminating passwords entirely, but requires a Public Key Infrastructure and MDM solution to deploy client certificates. Enforce strict server certificate validation on all client devices via Group Policy (Windows) or MDM profiles (macOS, iOS, Android) to prevent credential theft from rogue access points.

Step 5: Configure EnGenius MyPSK for multi-tenant isolation

EnGenius MyPSK setup for a multi-tenant environment:

1. Create a new SSID (e.g., "VenueResident").
2. Under the Wireless tab, set Security Type to WPA2 PSK or WPA3 Personal.
3. Enable MyPSK (Private PSK).
4. Click Add PSK to create individual keys, or use Auto-Generate to create batches of up to 50 at a time.
5. For each PSK, assign a VLAN ID and optionally set a Start Date and Expiration Date.
6. Distribute each unique PSK to the corresponding tenant or resident.

When a tenant's lease ends, delete or expire their PSK. Access is revoked immediately without affecting any other tenant on the network.

Best practices

Enforce strict certificate validation on 802.1X clients. PEAP-MSCHAPv2 is only secure when clients are configured to validate the RADIUS server's certificate against a trusted CA. Without this, a rogue access point can present a fraudulent certificate and harvest credentials. Deploy validation settings via Group Policy Objects for Windows and MDM configuration profiles for all other platforms. This is non-negotiable for any deployment in a regulated environment.

Use dynamic DNS resolution in the Walled Garden. Google, Apple, and Meta use dynamic IP ranges for their OAuth and CDN endpoints. Configure Walled Garden entries as domain names and ensure your EnGenius Cloud controller resolves them dynamically. A static IP whitelist will cause authentication failures as CDN IPs rotate.

Segment IoT devices with MAC Authentication Bypass. Headless devices such as printers, displays, and IoT sensors cannot authenticate via 802.1X. Use MAC Authentication Bypass (MAB) to identify them and place them on a restricted VLAN with firewall rules preventing lateral movement. MAB is not a security control - it is a device identification mechanism. Treat MAB-authenticated devices as untrusted.

Implement RADIUS accounting. Enable the accounting server in EnGenius Cloud's RADIUS configuration, pointing to Purple's accounting endpoint on UDP 1813. This feeds session duration, data volume, and device information into Purple's WiFi Analytics platform, providing the venue utilisation data that justifies the infrastructure investment.

Review the Walled Garden quarterly. OAuth providers and CDNs change their domain structures. Apple updated its Sign In domains twice in 2023. Build a quarterly review of the Walled Garden into your operational calendar. For further guidance on enterprise WiFi security practices, see our Enterprise WiFi Security guide .

Troubleshooting and risk mitigation

Symptom: Captive portal fails to load on iOS devices. Cause: captive.apple.com is not in the Walled Garden. iOS uses this endpoint to detect the presence of a captive portal and trigger the Captive Network Assistant. Without it, the device reports "No Internet Connection" and never opens the portal browser. Fix: Add captive.apple.com to the Walled Garden in EnGenius Cloud under Captive Portal > Advanced Settings.

Symptom: Authentication fails silently - RADIUS returns no response. Cause: Shared secret mismatch between EnGenius Cloud and the Purple RADIUS server configuration. A single character difference causes every authentication request to be discarded. Fix: Re-enter the shared secret in both systems. Copy-paste from a plain text source to avoid invisible character substitution.

Symptom: 802.1X client authenticates but receives no IP address. Cause: The ECS switch uplink port is not configured as a trunk, or the VLAN returned by the RADIUS server is not permitted on the trunk. Fix: Verify the switch port configuration. The port must be a trunk carrying all VLANs referenced in RADIUS responses.

Symptom: MyPSK client connects but can reach other tenants' devices. Cause: Client isolation is not enabled on the SSID, or the VLAN configuration on the switch is not correctly isolating the segments. Fix: Enable client isolation on the SSID in EnGenius Cloud. Verify that each VLAN is configured with appropriate inter-VLAN routing rules on the upstream router or firewall.

Symptom: Social login button loads but authentication fails. Cause: One or more OAuth provider subdomains are missing from the Walled Garden. Google and Meta use multiple subdomains for their authentication flows. Fix: Capture browser console output from an unauthenticated device to identify which domain is being blocked. Add the missing domain to the Walled Garden. Refer to Purple's Walled Garden Domain Whitelist documentation for the current list.

ROI and business impact

Deploying Purple with EnGenius Cloud transforms wireless infrastructure from a cost centre into a data asset. Venue operators capture fully compliant, first-party demographic data from guests through conscious-choice opt-ins, enabling targeted marketing campaigns and measurable engagement. For IT teams, the shift to 802.1X and MyPSK eliminates the operational overhead of managing shared passwords, reduces support tickets related to access issues, and provides granular visibility into network utilisation.

For hospitality operators, Premier Inn - a named Purple customer - uses guest WiFi data to drive loyalty programme engagement and personalise post-visit communications. For retail environments, the combination of footfall analytics from Purple's WiFi Analytics platform and dwell-time data provides merchandising insights that justify the infrastructure investment independently of the security benefits.

In multi-tenant environments, MyPSK eliminates the need for separate physical network infrastructure per tenant. A single EnGenius ECW access point can serve 500 isolated tenants on one SSID, reducing hardware costs and simplifying ongoing management. When a tenant moves out, their PSK is deleted in seconds - no password change required, no impact on other residents.

Purple's platform is hardware-agnostic, meaning the same Purple configuration, analytics, and data capture layer works across Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet hardware. If your estate includes a mix of EnGenius and other vendors, Purple provides a single pane of glass for guest WiFi management across all of them. For related deployment guidance, see our DrayTek Vigor integration guide .