Aruba 專用的 Captive Portal

Executive Summary

For enterprise wireless engineers, network architects, and venue operations directors, deploying a robust guest wireless infrastructure is no longer just about providing basic internet access. Modern venues require a solution that balances strict network security, regulatory compliance, and a high-converting guest experience. While HPE Aruba's native captive portal capabilities are highly reliable, they lack the sophisticated marketing data capture, global multi-site scalability, and real-time location and demographic analytics required by enterprise venues in hospitality, retail, and public sectors.

By integrating Purple directly with Aruba Instant (IAP) or Aruba Central managed access points, organisations can replace basic local splash pages with a secure, highly-scalable, global guest portal. This integration leverages standard network protocols, including Remote Authentication Dial-In User Service (RADIUS) and Wireless Internet Service Provider roaming (WISPr), to deliver seamless, secure, and brand-consistent onboarding. This technical reference guide provides the exact configuration parameters, architectural diagrams, and troubleshooting workflows required to successfully deploy Purple on Aruba infrastructure.

Technical Deep-Dive

The integration of Purple with Aruba wireless infrastructure relies on a standard external captive portal redirect and RADIUS authentication flow. This architecture ensures that user authentication and traffic accounting are handled securely in the cloud, while local access points enforce access control and quality of service (QoS) policies.

The Captive Portal Redirect Flow

When an unauthenticated client associates with the guest Service Set Identifier (SSID), the Aruba access point intercepts the client's initial HTTP request (typically TCP port 80) and performs a HTTP 302 redirect to Purple's cloud-hosted splash page.

+--------------+             +-----------------+             +------------------+             +------------------+
| Guest Device |             |  Aruba AP / AP  |             |  Purple Captive  |             |  Purple RADIUS   |
|   (Client)   |             |  (Central/IAP)  |             |  Portal (Cloud)  |             |  Server (Cloud)  |
+--------------+             +-----------------+             +------------------+             +------------------+
       |                              |                               |                                |
       |-- 1. Associates to SSID ---->|                               |                                |
       |                              |                               |                                |
       |-- 2. HTTP Request (TCP 80) ->|                               |                                |
       |                              |-- 3. HTTP 302 Redirect ------>|                                |
       |<-- 4. Presents Splash Page ----------------------------------|                                |
       |                              |                               |                                |
       |-- 5. Submits Login Form ------------------------------------>|                                |
       |                              |                               |-- 6. RADIUS Access-Request --->|
       |                              |<-- 7. RADIUS Access-Accept ------------------------------------|
       |                              |      (with Session Timeout)   |                                |
       |<-- 8. Internet Granted ------|                               |                                |
       |                              |                               |                                |
       |                              |-- 9. RADIUS Accounting Start --------------------------------->|
       |                              |-- 10. RADIUS Accounting Interim (every 5 min) ---------------->|

RADIUS Authentication and Accounting Parameters

Once the guest submits their credentials or completes a social login on the Purple splash page, the Purple portal backend communicates with the local Aruba access point or controller to initiate RADIUS authentication. The Aruba AP acts as the Network Access Server (NAS) and sends a RADIUS Access-Request to Purple's cloud RADIUS servers on UDP port 1812.

To ensure accurate session tracking, policy enforcement, and reporting, the following RADIUS attributes must be exchanged:

The Walled Garden (Exception List) Architecture

Before a user is authenticated, the Aruba AP restricts all traffic except for destinations explicitly defined in the Walled Garden (or exception list). Because Purple's portal is cloud-hosted and relies on external identity providers (such as Google, Facebook, and Apple) for social authentication, the AP must allow unauthenticated clients to resolve DNS and communicate with these external domains.

If any required domain is omitted from the walled garden, the guest will experience a blank page, broken CSS, missing images, or a complete timeout during the login flow.

Implementation Guide

Deploying Purple on Aruba wireless infrastructure can be achieved via Aruba Instant (IAP) running ArubaOS 8.x (on-premises virtual-controller mode) or Aruba Central (cloud-managed AOS-8 or AOS-10).

Aruba Instant (IAP) Configuration (ArubaOS 8.x)

Step 1: Configure RADIUS Servers

1. Log in to the Aruba Instant AP virtual controller web interface.
2. Navigate to Security > Authentication Server and click New.
3. Configure the Primary RADIUS Server with the following parameters:
   • Name: Purple_Primary
   • IP Address: 34.94.146.135
   • Auth Port: 1812
   • Acct Port: 1813
   • Shared Key: [Provided in your Purple Venue Dashboard]
4. Click OK to save.
5. Click New again to configure the Secondary RADIUS Server:
   • Name: Purple_Secondary
   • IP Address: 34.94.183.201
   • Auth Port: 1812
   • Acct Port: 1813
   • Shared Key: [Provided in your Purple Venue Dashboard]
6. Click OK to save.

Step 2: Create the Captive Portal Profile

1. Navigate to Security > Captive Portal and click New.
2. Configure the profile with the following settings:
   • Name: Purple_Portal
   • Type: External
   • IP or Hostname: portal.venuewifi.com
   • URL: /
   • Port: 443
   • Use HTTPS: Enabled
   • Redirect URL: https://portal.venuewifi.com
   • WISPr: Enabled (Crucial for auto-triggering the portal on iOS and Android devices)
3. Click OK to save.

Step 3: Configure the Walled Garden Whitelist

1. In the Security > Captive Portal menu, select your newly created Purple_Portal profile.
2. Under the Walled Garden section, click the link to open the whitelist configuration.
3. Add the following core Purple domains:
   • *.purple.ai
   • *.cloudfront.net
   • *.venuewifi.com
4. If social login is enabled, add the respective domains (e.g., *.google.com, *.facebook.com, *.apple.com).
5. Click Save.

Step 4: Create and Configure the Guest SSID

1. Navigate to Network > New to start the WLAN wizard.
2. On the WLAN Settings tab:
   • Name (SSID): Guest-WiFi
   • Primary Usage: Guest
   • Click Next.
3. On the VLAN tab, configure IP and VLAN assignment according to your network architecture (typically Client IP assignment: Network Assigned on a dedicated guest VLAN). Click Next.
4. On the Security tab:
   • Splash Page Type: External
   • Captive Portal Profile: Select Purple_Portal
   • Auth Server 1: Select Purple_Primary
   • Auth Server 2: Select Purple_Secondary
   • Reauth Interval: 1440 (24 hours, or as per venue policy)
   • Accounting: Enabled
   • Accounting Interval: 5 minutes
5. Click Next to proceed to the Access tab. Ensure the default guest rule allows DHCP and DNS pre-authentication, then click Finish.

Aruba Central Configuration (AOS-8 and AOS-10)

Aruba Central AOS-8

1. Navigate to Devices under the Manage section of your group in Aruba Central.
2. Click Config (gear icon) on the top right, then go to the WLANs tab and click + Add SSID.
3. In Step 1: General, enter the SSID name (e.g., Guest-WiFi) and click Next.
4. In Step 2: VLANs, configure your guest VLAN mapping and click Next.
5. In Step 3: Security:
   • Set Security Level to Visitors.
   • Set Type to External Captive Portal.
   • Ensure Key Management is set to Open (do not use Enhanced Open/OWE for standard guest portals as it can cause client compatibility issues).
   • Click the + icon next to Captive Portal Profile to add a new profile:
     • Name: Purple_Central_Portal
     • IP or Hostname: portal.venuewifi.com
     • URL: /
     • Port: 443
     • Redirect URL: https://portal.venuewifi.com
     • Use HTTPS: True
     • Captive Portal Failure: Deny Internet (Recommended for security compliance)
   • Click Save.
   • Click the + icon next to Primary Server and Secondary Server to add the Purple RADIUS servers using the IPs 34.94.146.135 and 34.94.183.201 respectively, with ports 1812 (Auth) and 1813 (Acct).
   • Expand Advanced Settings, scroll to Accounting, select Use authentication servers, and set Accounting Interval to 5 minutes.
6. Scroll down to the Walled Garden section, click + Add, and input the required Purple and social login domains.
7. Click Save Settings.

Aruba Central AOS-10

In AOS-10, the walled garden configuration moves from the WLAN Security tab to Access Rules.

1. Follow the same SSID and RADIUS configuration steps as AOS-8 above.
2. In the SSID wizard, navigate to the Access tab.
3. Click + Add Role and create a pre-authentication role named Purple_Pre_Auth.
4. In the rules editor for this role, configure explicit Allow rules for DNS, DHCP, and the required walled garden domains (e.g., *.purple.ai, *.venuewifi.com).
5. Scroll down to Assign Pre-Authentication Role, enable the option, and select Purple_Pre_Auth from the dropdown.
6. The post-authorisation role (typically matching the SSID name) should remain configured with Allow any to all destinations or your specific corporate access policies.
7. Click Save Settings.

Best Practices

To ensure maximum performance, security, and compliance, network architects must adhere to the following industry standards and vendor-neutral best practices when deploying captive portals on Aruba and Purple.

1. Secure Certificate Management

Aruba access points must present a valid, trusted SSL/TLS certificate during the captive portal redirect flow.

• Avoid Self-Signed Certificates: If the AP presents a self-signed certificate, modern browsers will display a highly visible "Your connection is not private" warning, severely damaging guest trust and reducing conversion rates.
• Deploy a Trusted CA Certificate: Upload a wildcard certificate from a globally recognised Certificate Authority (CA) to your Aruba Central global settings or Instant virtual controllers. Ensure that the intermediate and root certificates are combined into a single file to complete the trust chain.

2. Network Segmentation and Compliance

Guest traffic must be kept entirely separate from corporate and administrative traffic to mitigate security risks and ensure compliance with industry standards.

• VLAN Isolation: Map the guest SSID to a dedicated, non-routable VLAN. Use Access Control Lists (ACLs) on the upstream core switch or firewall to prevent any routing between the guest VLAN and internal corporate subnets.
• PCI DSS Compliance: If your venue processes card payments (e.g., retail point-of-sale), network segmentation is a mandatory requirement under PCI DSS Requirement 1.2 [3]. Guest WiFi must be physically or logically isolated from the Cardholder Data Environment (CDE).
• GDPR and Data Privacy: Ensure that the Purple portal is configured to display explicit, un-ticked consent checkboxes for marketing opt-ins, meeting the strict requirements of the General Data Protection Regulation (GDPR) [4].

3. Optimising WISPr and Captive Portal Detection

Modern mobile operating systems use active probing to detect captive portals immediately upon association.

• Enable WISPr: Always ensure that WISPr support is enabled in your Aruba captive portal profile. This protocol passes XML-formatted metadata to the client operating system, allowing iOS (Captive Network Assistant) and Android (Captive Portal Login) to gracefully launch the login screen in a dedicated browser window.
• Prevent "Enhanced Open" (OWE) Issues: While Opportunistic Wireless Encryption (OWE) provides encryption on open networks, many legacy client devices do not support it. For public guest networks, stick to standard Open key management to maximise device compatibility.

Troubleshooting & Risk Mitigation

Even with meticulous planning, captive portal deployments can encounter common failure modes. The following troubleshooting matrix provides immediate, actionable steps for wireless engineers.

Captive Portal Troubleshooting Matrix

ROI & Business Impact

Transitioning from a basic, local captive portal to an enterprise-grade WiFi intelligence platform like Purple delivers measurable business outcomes across operations, marketing, and network management.

Operational Efficiency and Scalability

Managing individual local captive portals across hundreds of retail stores, hotels, or public venues is an administrative bottleneck. Purple provides a centralised, cloud-managed console that allows IT teams to deploy, update, and audit captive portal configurations globally with a single click. This reduces configuration drift, ensures consistent branding, and slashes administrative overhead by up to 60%.

Data Monetisation and Marketing ROI

For industries like Retail and Hospitality, guest WiFi is a powerful channel for customer acquisition and engagement. Purple replaces anonymous connections with rich demographic profiles.

• Direct Integration: Purple integrates with CRM and marketing automation platforms to trigger real-time, context-aware campaigns. For example, a retail venue can trigger a personalised discount SMS the moment a loyalty customer connects to the guest WiFi.
• Measurable Footfall Analytics: By analysing RADIUS accounting data and BSSID associations, Purple provides highly accurate dwell-time, return-rate, and path-analysis reporting. This data enables venue operations directors to optimise staffing levels, evaluate window display effectiveness, and measure the direct ROI of marketing campaigns.

Cost-Benefit Analysis: Native Aruba vs. Purple Integration