RADIUS server details and portal URL are region-specific. Obtain the correct values from the Wiacom admin panel or the Wiacom team before starting.
Step 1 — Add the Device to Wiacom
Go to Inventory → Routers → Add New Router
Select Aruba from the vendor dropdown
Enter the required details and assign a location
Click Save
Aruba IAP / Instant
Aruba Controller
Aruba Instant On
Log in to your Aruba IAP (Master AP). Create the SSID Under Network at the top left, click New :
Name (SSID): your guest WiFi name
Primary usage: Guest
Click Next :
Client IP assignment: Virtual Controller managed
Client VLAN assignment: Default (or your guest VLAN)
Click Next and configure the splash page:
Splash page type: External
Captive portal profile: click the dropdown → New
Name: guestwifi
Type: Radius Authentication
IP or hostname: <PORTAL_HOSTNAME> — provided by Wiacom
URL: <PORTAL_PATH> — provided by Wiacom
Port: 443
Use HTTPS: Enabled
Redirect URL: <PORTAL_URL>?res=success
Auth server 1:
Type: RADIUS, Name: guestwifi1
IP address: <RADIUS_SERVER_1>
Auth port: 1812, Acct port: 1813
Shared key: <RADIUS_SHARED_SECRET>
Auth server 2:
Type: RADIUS, Name: guestwifi2
IP address: <RADIUS_SERVER_2>
Auth port: 1812, Acct port: 1813
Shared key: <RADIUS_SHARED_SECRET>
Additional settings:
Reauth interval: 24 hrs
Accounting: Enabled, Accounting mode: Authentication, Interval: 3 min
Click “Blacklist: 0 Whitelist: 0” and add domains one by one: *.wiacom.ai *.akamaitechnologies.com *.akamaiedge.net *.akamaized.net *.akamai.net *.amazonaws.com *.fastly.net *.zencdn.net fast.wistia.com player.vimeo.com *.facebook.com *.fbcdn.net *.akamaihd.net connect.facebook.net *.instagram.com *.twitter.com *.twimg.com *.linkedin.com *.licdn.net *.licdn.com *.google.com *.googleapis.com *.gstatic.com
Click Next → Access Rules: Role-based Under Roles, click New → name Preauth Under Access Rules for Preauth, click New for each walled garden domain:
Rule type: Access control
Service: Network - any
Action: Allow
Destination: To domain name
Domain name: *insert domain here*
Assign pre-authentication role: select Preauth Click Finish . Log in to your Aruba Controller web interface. Create the WLAN Click Configure → WLANs → + :
Name (SSID): your guest WiFi name
Primary Usage: Guest
Forwarding Mode: Tunnel
Click Next → VLAN: your guest VLAN Click Next :
Is this WLAN for internal or guest? Guest
Click Next :
Captive Portal Type: ClearPass or other external Captive Portal
Under Auth servers, click + → + to create new servers: Server 1:
Server type: RADIUS, Name: guestwifi1
IP Address: <RADIUS_SERVER_1>
Auth port: 1812, Accounting port: 1813
Shared key: <RADIUS_SHARED_SECRET>
Server 2:
Name: guestwifi2
IP Address: <RADIUS_SERVER_2>
Auth port: 1812, Accounting port: 1813
Shared key: <RADIUS_SHARED_SECRET>
Under Advanced Settings :
Called Station ID Type: MAC Address
Called Station ID Include SSID: Enabled
Accounting: Use authentication servers, Interval: 4 min
Under Allowlist, click + Add and add each domain from the list above. Click Next → Access rules: Role Based Click Add Role → name Preauth For each walled garden domain, add a rule:
Access Control / Network / Any / Allow / To a Domain Name: *domain*
Add a final deny rule:
Access Control / Network / Any / Deny / To All Destinations (must be last)
Configure:
Captive Portal Profile: your portal profile
Assign Pre-Authentication Role: Preauth
Click Finish . Log in to the Aruba Instant On portal at portal.arubainstanton.com . Aruba Instant On does not support RADIUS authentication. Wiacom analytics features (online users, network reports) and tiered bandwidth are unavailable.
Create the Network Click Networks → Add a new network :
Network Name: your guest WiFi name
Network type: Guest
Click Save . Click Customize guest portal :
Portal type: External
Server URL: <PORTAL_URL> — provided by Wiacom
Redirect URL: <PORTAL_URL>?res=success
Whitelisted domains: add all domains from the walled garden list above
Send RADIUS Accounting: Enabled
Primary RADIUS Server IP: <RADIUS_SERVER_1>
Primary RADIUS Server Secret: <RADIUS_SHARED_SECRET>
Secondary RADIUS Server: Enabled
Secondary RADIUS Server IP: <RADIUS_SERVER_2>
Secondary RADIUS Server Secret: <RADIUS_SHARED_SECRET>
Click Apply changes . Troubleshooting
Guests not redirected to portal
Confirm the SSID is set to Guest type and the splash page type is External. Check that HTTP (not HTTPS) pages trigger the redirect.
RADIUS authentication fails
Verify RADIUS server addresses and shared secret match values from Wiacom. Confirm UDP 1812 and 1813 are reachable.
Ensure the relevant social provider domains are in the walled garden.
