Cloud RADIUS and Guest WiFi for HPE Aruba
Add 802.1X authentication and guest splash pages to your Aruba SSIDs without running a RADIUS server. IronWiFi hosts the RADIUS and the external captive portal in the cloud, and plugs into Aruba Instant APs and Mobility Controllers as a standard authentication server. No appliance, no VM, no on-prem infrastructure.
What You Can Do with Aruba and IronWiFi
One cloud service behind every SSID on your Aruba network
802.1X and WPA2-Enterprise SSIDs
Point an Aruba SSID at IronWiFi as its authentication server and we handle the 802.1X exchange. EAP-TLS, PEAP, and EAP-TTLS are supported, so staff join with their existing credentials or a certificate instead of a shared passphrase.
Guest WiFi with an External Portal
Create an external captive portal profile that points at an IronWiFi splash page and guests get a branded sign-on screen. Email, SMS, social, voucher, and self-registration flows are built in, and every session is logged for reporting.
Your Existing Identity Provider
Aruba forwards the RADIUS request to IronWiFi, and IronWiFi checks it against Microsoft Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, or any LDAP and Active Directory you connect. No separate WiFi password list to maintain.
Pre-Auth and Authenticated Roles
Aruba keeps clients in a restricted initial role that only permits DNS, DHCP, and the portal itself until IronWiFi returns an Access-Accept, then moves them to your authenticated role. Guests and staff can share hardware without sharing access.
Four Steps on Your Aruba Gear
Everything is configuration — there is nothing to install on your network
Create your network in IronWiFi
Create a network in the IronWiFi console and note the primary and backup RADIUS server addresses, the authentication port, the accounting port, and the shared secret. For guest WiFi, also create a captive portal with the vendor set to Aruba and copy its splash page URL.
Add IronWiFi as an authentication server
On an Instant AP go to Security → Authentication Server and add the primary and backup IronWiFi servers with those ports and the shared key. On a Mobility Controller the same values go under Configuration → Security → Authentication → Servers, then collect both into a server group.
Pick guest portal or 802.1X
For guest WiFi, create an external captive portal profile with the IronWiFi splash page URL, attach it to your guest WLAN, and whitelist the IronWiFi server address in the walled garden or pre-authentication ACL so unauthenticated clients can load the portal. For employee WiFi, create a WPA2-Enterprise SSID that uses the IronWiFi auth server and skip the portal entirely.
Test it
Connect a device, browse to any HTTP page, and confirm you land on the IronWiFi splash page. Then check that the authentication appears under Reports → Authentications in the IronWiFi console.
Running AOS-10 under HPE Aruba Networking Central? IronWiFi is still a standard RADIUS and external-portal endpoint, but the walled garden moves to Access Rules and the portal settings are managed centrally rather than per AP, so follow Aruba Central’s own guest-portal documentation for where each field lives.
Read the full Aruba Instant AP setup guide → Mobility Controller guide →
Have Questions? Get Answers
- Start a free trial and connect an Aruba SSID today
- Follow the step-by-step Aruba setup guides in the help center
- Ask us anything by email — we answer setup questions directly
Prefer a deep dive? Read the Aruba cloud RADIUS setup guide, browse all compatible hardware, or subscribe through AWS Marketplace and pay on your AWS bill.