Skip to main content

Aruba Instant AP

Set up Aruba Instant Access Points with IronWifi for controller-less WiFi management. This guide covers RADIUS server configuration, external captive portal profiles, walled garden whitelist setup, and WPA-Enterprise deployment for both guest and secure employee networks running ArubaOS Instant.

Prerequisites​

In Aruba IAP:

  • Aruba Instant AP running ArubaOS Instant 8.x or later
  • Access to the IAP web interface or CLI
  • Administrator credentials

In IronWifi Console (complete these first):

  1. Create a Network and note the RADIUS details:
    • Primary and backup server IP addresses
    • Authentication port (1812) and Accounting port (1813)
    • Shared secret
  2. Create a Captive Portal with vendor set to Aruba and note the Splash Page URL

IAP Configuration​

Access Web Interface​

  1. Connect to the Instant AP network
  2. Navigate to the management IP (e.g., https://instant.arubanetworks.com or the AP's IP)
  3. Log in as administrator

Step 1: Configure RADIUS Server​

  1. Navigate to Security → External Servers
  2. Click New
  3. Configure primary server:
FieldValue
NameIronWifi
IP Address{Primary IP from IronWifi}
Auth Port1812
Acct Port1813
Shared Key{Shared secret from IronWifi}
  1. Add backup server with the same settings using the backup IP

Step 2: Create Captive Portal Profile​

  1. Navigate to Security → Captive Portal
  2. Click New
  3. Configure:
FieldValue
NameIronWifi-Portal
TypeExternal
Splash page URL{Splash URL from IronWifi}
Auth serverIronWifi

Step 3: Configure Walled Garden​

In the captive portal profile, add whitelist entries.

Required Entry​

Always add the IronWifi server:

107.178.250.42

Additional Entries by Authentication Provider​

Only add entries for authentication methods you've enabled in IronWifi:

ProviderRequired Whitelist Entries
Google*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
LinkedIn*.linkedin.com, *.licdn.com, linkedin.com
Twitter/X*.twitter.com, *.twimg.com, twitter.com, *.x.com, x.com
Apple*.apple.com, *.icloud.com, appleid.apple.com
Microsoft/Azure AD*.microsoft.com, *.microsoftonline.com, *.msftauth.net, login.microsoftonline.com
Stripe*.stripe.com, js.stripe.com
PayPal*.paypal.com, *.paypalobjects.com
Twilio (SMS)*.twilio.com

Step 4: Create Guest WLAN​

  1. Navigate to Network → New
  2. Configure Basic settings:
FieldValue
NameGuest-WiFi
Primary UsageGuest
  1. Configure Security settings:
FieldValue
Splash Page TypeExternal
Captive Portal ProfileIronWifi-Portal
Auth Server 1IronWifi
  1. Save the configuration

Step 5: Configure Access Rules​

Set the initial role with restricted access until authenticated. The default guest role typically allows DNS and DHCP before authentication.

CLI Configuration​

For administrators who prefer CLI configuration:

# Configure RADIUS server
wlan auth-server IronWifi
  ip {PRIMARY_IP}
  port 1812
  acctport 1813
  key {SHARED_SECRET}

# Configure captive portal
wlan captive-portal IronWifi-Portal
  type external
  server 107.178.250.42
  url "{SPLASH_URL}"
  auth-server IronWifi
  white-list 107.178.250.42

# Create guest SSID
wlan ssid-profile Guest-WiFi
  type guest
  captive-portal IronWifi-Portal
  auth-server IronWifi

# Configure access rules
wlan access-rule Guest-WiFi
  rule any any match any any any permit

Alternative: WPA-Enterprise (No Captive Portal)​

For 802.1X authentication where users enter credentials in their device WiFi settings:

wlan ssid-profile Secure-WiFi
  type employee
  opmode wpa2-aes
  auth-server IronWifi

Testing and Verification​

After completing the configuration, verify everything works correctly.

Test Captive Portal Flow​

  1. Connect a device to the Guest-WiFi SSID
  2. Open a browser and navigate to http://example.com
  3. Verify redirect to IronWifi splash page
  4. Complete authentication
  5. Verify internet access is granted

Verification Commands​

show network
show captive-portal
show auth-server
show clients

Troubleshooting​

If testing reveals issues, use this section to diagnose common problems.

External Portal Not Loading​

SymptomCauseSolution
Blank pageMissing whitelist entryAdd 107.178.250.42 to whitelist
Wrong pageIncorrect splash URLVerify URL matches IronWifi Console
TimeoutDNS issuesEnsure DNS is allowed in pre-auth ACL

Authentication Failures​

SymptomCauseSolution
TimeoutRADIUS unreachableVerify server IP and firewall rules
RejectWrong secretCheck shared secret matches exactly
No responsePort blockedEnsure UDP 1812/1813 are open

Clients Not Getting IP​

SymptomCauseSolution
No IP addressDHCP issueCheck DHCP server configuration
Wrong subnetVLAN mismatchVerify VLAN settings
Stuck in initial roleRole assignmentCheck access rule configuration