Becoming an OpenRoaming access network provider: a deployment guide

Become an OpenRoaming access network provider in eight steps on the access points you already own. You add a Passpoint (Hotspot 2.0) SSID secured with IEEE 802.1X, point it at Purple's cloud RADIUS and advertise the OpenRoaming consortium identifier. Purple, a certified WBA identity broker, connects your venue to the federation, free through the Connect license.

{"slot":"hero","alt":"A network manager reviews a wireless dashboard on a laptop in a hotel lobby while a cell phone in the foreground shows it has joined WiFi automatically","caption":"An OpenRoaming venue: visitors with a profile join encrypted WiFi with no sign-in screen.","prompt":"Photographic, natural light, modern hotel lobby. A network manager at a desk with a laptop showing an abstract wireless dashboard, no readable text or logos. In the foreground a cell phone shows a connected WiFi icon. Calm palette with soft purple accent lighting, nobody looking at the camera, no brand marks."}

What will your OpenRoaming venue look like when you finish?

Every site will broadcast one additional SSID with Passpoint switched on. Passpoint, also called Hotspot 2.0, is built on IEEE 802.11u. It lets a cell phone find and join a network without anyone choosing it from a list.

The SSID advertises the OpenRoaming roaming consortium organization identifier (RCOI), the federation's shared tag. Any cell phone holding a matching profile from an OpenRoaming identity provider joins on its own.

Sign-in uses IEEE 802.1X, the port-based authentication standard behind WPA2-Enterprise and WPA3-Enterprise. Traffic is encrypted from the first packet. There is no captive portal, the web page that asks for an email or voucher before granting access.

Authentication runs through Purple's cloud RADIUS. RADIUS (Remote Authentication Dial-In User Service) is the protocol your access points use to ask two questions: should this device get on, and on which VLAN?

At the end you will have:

• One Passpoint SSID per site, built from a template and pointed at Purple cloud RADIUS.
• An isolated visitor VLAN, kept apart from staff, point-of-sale and building systems.
• Your existing guest SSID and captive portal, unchanged, for visitors without a profile.
• Every OpenRoaming sign-in logged against its venue in Purple.
• Your venues listed among 5 million+ OpenRoaming hotspots worldwide.

What do you need before you join OpenRoaming?

Confirm every row below before you book a change window. Firmware is the item that delays most rollouts.

{"caption":"Prerequisites for an OpenRoaming venue","asOf":"2026-06-10","columns":[{"key":"item","label":"Prerequisite"},{"key":"why","label":"Why it matters"},{"key":"check","label":"How to confirm"}],"rows":[["Purple Connect license","OpenRoaming is included free with Connect","Check the plan on each venue in your Purple account"],["Passpoint-capable access points","APs must beacon the interworking element and answer ANQP queries","Vendor datasheet for each model"],["Hotspot 2.0 firmware","Support often arrives in firmware, not hardware","Running version against vendor release notes"],["WPA2- or WPA3-Enterprise","OpenRoaming authenticates with IEEE 802.1X","Enterprise appears in the SSID security options"],["Dashboard or controller admin rights","You add a RADIUS server and an SSID","Open SSID settings with your own account"],["Outbound RADIUS to Purple","APs or controllers must reach Purple cloud RADIUS","Firewall review against the values Purple supplies"],["Dedicated visitor VLAN","Keeps visitors off staff and payment networks","VLAN on switch trunks and a DHCP scope with headroom"],["Test handset with a profile","Proves the end-to-end join","Profile listed in the handset's WiFi settings"]],"footnote":"Hotspot 2.0 support varies by model and firmware release. Confirm it against your vendor's documentation before you schedule work.","download":{"filename":"openroaming-anp-prerequisites.csv"}}

The values you will enter

Purple supplies every federation value during onboarding. Do not copy RCOI or realm values from forum posts. A single wrong digit stops every profiled phone from matching your network.

Value	Where it comes from	Where it goes
RADIUS server hosts and ports	Your Purple onboarding pack	Controller or dashboard RADIUS settings
RADIUS shared secret	Your Purple onboarding pack	The same RADIUS settings
RCOI values	Purple, matching the WBA OpenRoaming specification	The SSID's Hotspot 2.0 settings
NAI realm	Your Purple onboarding pack	The SSID's Hotspot 2.0 settings
Venue name, group and type	You	Hotspot 2.0 venue information
Visitor VLAN ID	Your network team	SSID VLAN setting or RADIUS policy

How does an OpenRoaming access network provider work?

OpenRoaming is a federation run by the Wireless Broadband Alliance (WBA). It has two roles. An access network provider (ANP) runs the radios, and that is you. An identity provider (IDP) issues and checks the visitor's credential. Typical identity providers are cell carriers, device makers and app publishers.

A sign-in follows six stages:

1. Your access point beacons an interworking element that carries the OpenRoaming RCOI.
2. A phone with a matching profile sends an Access Network Query Protocol (ANQP) query. It reads your venue, realm and consortium details before it associates.
3. The cell phone associates and starts 802.1X. Its EAP (Extensible Authentication Protocol) method depends on the identity provider.
4. Your access point sends the request to Purple cloud RADIUS.
5. Purple forwards it across the federation over RadSec, which is RADIUS carried inside TLS (RFC 6614). OpenRoaming finds the right identity provider through DNS-based dynamic peer discovery (RFC 7585).
6. The identity provider accepts the credential. Purple applies your venue policy, including the VLAN, and the access point installs encryption keys.

Purple handles the federation leg. The WBA certificates, RadSec sessions and realm routing sit in Purple's cloud RADIUS, not on your controller. The visitor's credential is checked by their identity provider inside the EAP exchange, so your venue never stores it. The identity provider guide explains how that trust is established.

{"kind":"flow","direction":"lr","caption":"How an OpenRoaming sign-in crosses your network","alt":"Flow from a visitor device through your access point and Purple cloud RADIUS to the OpenRoaming federation and the visitor's identity provider, ending with the device online on the visitor VLAN.","nodes":[{"id":"a","label":"Visitor device","sub":"Holds an OpenRoaming profile","tone":"neutral"},{"id":"b","label":"Your access point","sub":"Beacons the RCOI and answers ANQP","tone":"brand"},{"id":"c","label":"Purple cloud RADIUS","sub":"Receives 802.1X and applies venue policy","tone":"brand"},{"id":"d","label":"OpenRoaming federation","sub":"RadSec over TLS with WBA certificates","tone":"neutral"},{"id":"e","label":"Identity provider","sub":"Checks the visitor credential","tone":"neutral"},{"id":"f","label":"Online on visitor VLAN","sub":"Encrypted, no captive portal","tone":"success"}],"edges":[{"from":"a","to":"b","label":"ANQP query","style":"solid"},{"from":"b","to":"c","label":"802.1X via RADIUS","style":"solid"},{"from":"c","to":"d","label":"Realm lookup","style":"solid"},{"from":"d","to":"e","label":"RadSec","style":"solid"},{"from":"e","to":"c","label":"Access-Accept","style":"dashed"},{"from":"c","to":"f","label":"VLAN assigned","style":"solid"}]}

How do you set up OpenRoaming, step by step?

Work through the steps in order with your dashboard open. Each step has a check, and you should not move on until it passes. Vendor differences are covered in the next section but one.

{"title":"Become an OpenRoaming access network provider","steps":[{"title":"Enable OpenRoaming in Purple","body":"Confirm your Connect license covers every venue in scope and accept the OpenRoaming terms. Purple, a certified WBA identity broker, completes federation onboarding.","check":"Purple shows OpenRoaming enabled for each venue in scope."},{"title":"Audit access point firmware","body":"List every model and its running firmware. Check vendor release notes for Hotspot 2.0 support and close any gaps first.","check":"Every model on your inventory sheet is marked Passpoint-ready."},{"title":"Add Purple cloud RADIUS","body":"Add the RADIUS hosts, ports and shared secret from your Purple onboarding pack. Allow them outbound on your firewall.","check":"A test authentication gets a reply, not a timeout."},{"title":"Create the OpenRoaming SSID","body":"Create a new SSID with WPA2- or WPA3-Enterprise (802.1X) security, pointed at Purple RADIUS. Do not attach a splash page.","check":"A scan shows the SSID as an Enterprise network."},{"title":"Turn on Passpoint","body":"Enable Hotspot 2.0 on the SSID. Enter the RCOI and NAI realm values Purple supplies, then venue name, venue type and internet access.","check":"A WiFi analyzer shows the interworking element and RCOI in the beacon."},{"title":"Set the VLAN and isolation","body":"Map the SSID to the visitor VLAN, or accept the VLAN Purple returns. Turn on client isolation and a per-device rate limit.","check":"A test device gets an address from the visitor DHCP scope."},{"title":"Pilot one site","body":"Bring a cell phone with an OpenRoaming profile into range. It should join with no prompt and no portal.","check":"Purple logs the authentication against the pilot venue."},{"title":"Roll out by template","body":"Push the SSID through site templates or network groups, one region at a time. Repeat the pilot checks on a sample of sites.","check":"Each site records OpenRoaming authentications in Purple."}]}

Separate SSID or an existing one?

Build a new SSID for OpenRoaming. Your staff network trusts your own identity provider. OpenRoaming trusts every identity provider in the federation. Mixing the two on one SSID mixes their default policies.

{"tone":"warning","title":"Never add Passpoint to your staff SSID","text":"An OpenRoaming visitor can authenticate through any identity provider in the federation. On a staff SSID without a separate VLAN policy, that visitor lands on your staff network."}

WPA2 or WPA3-Enterprise?

Choose WPA3-Enterprise where every client and access point model supports it. Otherwise use the WPA2 and WPA3 mixed mode your vendor offers. Do not fall back to WPA2-Personal, because Passpoint requires 802.1X.

{"tone":"tip","text":"Give the Passpoint SSID a name your staff recognise in a scan, then leave it alone. Profiled devices match the RCOI and realm, not the SSID name, so a later rename does not break sign-in."}

The output should list your venue name, the RCOI values and the NAI realm Purple supplied. If the roaming consortium field is empty, go back to step 5.

Authentication comes next. Bring a profiled handset into range with its WiFi on. It should join with no prompt. Purple should then log an accepted authentication for that venue. A handset without a profile should not join the Passpoint SSID. That is correct behavior, not a fault.

Policy comes last. Check the address, the isolation and the reach of a joined device.

{"title":"OpenRoaming go-live checks","groups":[{"heading":"Radio","items":[{"text":"SSID visible on every access point at the site"},{"text":"Interworking element and RCOI present in the beacon"},{"text":"ANQP returns venue name, roaming consortium and NAI realm"}]},{"heading":"Authentication","items":[{"text":"Profiled handset joins with no prompt"},{"text":"Purple logs an accepted authentication for the venue"},{"text":"Handset without a profile stays on the guest SSID","why":"Confirms the two networks are independent"}]},{"heading":"Policy","items":[{"text":"Device address sits in the visitor DHCP scope"},{"text":"Device cannot reach another client on the SSID"},{"text":"Device cannot reach staff or payment subnets","why":"Evidence for PCI-DSS segmentation"}]}],"download":{"filename":"openroaming-go-live-checks.csv"}}

How do the steps differ on Meraki, Aruba, Ruckus, Mist and UniFi?

The eight steps are the same on every platform. What changes is where Hotspot 2.0 lives in each console. Follow your vendor's documentation for your firmware release, and enter the values Purple supplies.

{"title":"Passpoint by access point platform","tabs":[{"label":"Cisco Meraki","body":"Meraki exposes Hotspot 2.0 as a per-SSID setting on supported models and firmware.","bullets":["Set Enterprise security with Purple RADIUS on the SSID","Tag the visitor VLAN on the SSID or accept a RADIUS-assigned VLAN","Use configuration templates for multi-site rollout","Detail: [Passpoint on Cisco Meraki](guide:passpoint-configuration-meraki)"]},{"label":"HPE Aruba","body":"Aruba assembles Passpoint from Hotspot 2.0 and ANQP settings bound to the WLAN, next to the 802.1X server settings.","bullets":["Confirm whether sites run under Aruba Central or controllers, as the path differs","Bind the RCOI and realm values to the WLAN's Hotspot 2.0 settings","Map the visitor VLAN on the WLAN"]},{"label":"Ruckus","body":"On SmartZone, Passpoint uses a Hotspot 2.0 operator profile linked to an identity provider profile and the WLAN.","bullets":["Enter the RCOI and realm in the identity provider profile","Attach Purple RADIUS as the authentication service","Apply through zone templates for multi-site"]},{"label":"Juniper Mist","body":"Mist sets Hotspot 2.0 on the WLAN alongside Enterprise security.","bullets":["Build the WLAN in a WLAN template so every site inherits it","Enter the RCOI, realm and venue values Purple supplies","Set the visitor VLAN on the WLAN"]},{"label":"Ubiquiti UniFi","body":"Hotspot 2.0 support depends on your UniFi Network application and access point firmware.","bullets":["Confirm Hotspot 2.0 settings are present before you plan dates","Point the WLAN at Purple RADIUS with Enterprise security","Assign the visitor VLAN on the WLAN"]}]}

What goes wrong most often, and how do you fix it?

Most failures trace back to one of seven causes. Find the symptom, then fix the cause before you retest.

Symptom	Likely cause	Fix
SSID visible, profiled phones never join	RCOI missing or mistyped	Re-enter the RCOI values from Purple, then recheck the beacon
No interworking element in the beacon	Model or firmware lacks Hotspot 2.0	Upgrade firmware or exclude that model from the SSID
Phone tries, then fails	Shared secret mismatch or RADIUS blocked	Re-enter the secret and open the outbound firewall rule
Phone joins but gets no address	VLAN not trunked or DHCP scope full	Trunk the VLAN to AP switch ports and widen the scope
Visitors can see each other's devices	Client isolation off	Enable isolation on the SSID
Pilot works, some sites fail	Template not applied or older firmware	Compare the failing site against the template and firmware list
Test phone without a profile cannot join	Expected behavior	Install a profile or use the guest SSID

The RCOI fault is the most common, because nothing looks broken. The SSID broadcasts and the radios look healthy, but no phone ever matches. Always run the ANQP check before you blame the handset.

Firewall faults show as timeouts rather than rejections in Purple. A rejection means the request arrived and the credential failed. A timeout means the request never arrived, so check the network path first.

If a step still fails after these fixes, work through Passpoint configuration on Cisco Meraki for the detailed check sequence. The same order of checks applies on every vendor.

Where OpenRoaming sits in your secure network

Purple Access runs three networks on the access points you own. The open network carries captive portal sign-in and BYOD onboarding. The secure network carries EAP-TLS, identity providers, Passpoint and cloud RADIUS. The xPSK network gives each device or resident its own key. On all three, identity sets the VLAN.

OpenRoaming belongs on the secure network. Staff on the same platform use EAP-TLS with certificates tied to Microsoft Entra ID, Okta or Google Workspace. Both groups authenticate through Purple cloud RADIUS, on separate SSIDs and separate VLANs. The secure network pillar covers certificates, identity and Passpoint together. The secure network overview shows how the three networks fit.

Two add-ons sit next to this work. Guest marketing from your captive portal runs on Engage, covered in the guest WiFi guide. DNS filtering for visitor traffic runs on Shield.

Worked scenario: a city-wide network in Newcastle

The situation: students moved between campus, the city center and trams. Each place meant a different network and a different sign-in.

What was done: Purple built Newcastle into the world's first city-wide OpenRoaming network. Purple acted as identity broker across the federation.

The outcome: more than 53,000 students now roam between campus, city and trams without signing in again.

{"tone":"proof","title":"Newcastle","text":"Purple runs Newcastle, the world's first city-wide OpenRoaming network. More than 53,000 students roam between campus, city and trams on it."}

Worked scenario: an illustrative 40-site hotel group on Cisco Meraki

The situation: guests met a captive portal at every hotel, and repeated it on every stay. IT wanted encrypted sign-in without buying hardware.

What was done: the team ran the step 2 firmware audit across all 40 hotels. They built one Passpoint SSID in a Meraki configuration template. The visitor VLAN was kept apart from property management and payment systems. The existing guest SSID and portal stayed in place for guests without a profile.

The outcome: 40 hotels run on one template, with one new SSID per hotel and zero new access points. Guests with an OpenRoaming profile join encrypted with no portal.

For managed corporate devices, push profiles through your MDM; see deploying a Passpoint profile with Intune. Licensing and feature detail are on the Passpoint and OpenRoaming product page.

Frequently asked questions

How much does it cost to become an OpenRoaming access network provider?

OpenRoaming is included free with the Purple Connect license. If your access points already support Hotspot 2.0 in firmware, you buy no new hardware either. Your main cost is staff time: the firmware audit, one SSID per site and a pilot at one venue. Security add-ons such as SecurePass, Verify and Shield are separate choices. Add them only if your risk assessment calls for them.

Will OpenRoaming work on the access points we already own?

Yes, if your models and firmware support Passpoint. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Hotspot 2.0 support depends on model and firmware release. Run the step 2 audit before you commit to dates. Older models without support keep serving your other SSIDs.

Do we still need a captive portal?

Yes, keep it. OpenRoaming only serves devices that already hold a profile from a federation identity provider. Every other visitor still needs your open guest SSID with a captive portal or BYOD onboarding flow. Run both side by side on the same access points. The Passpoint vs captive portal guide covers when each sign-in is the right choice.

Do we need our own WBA membership to join OpenRoaming?

No. Purple is a certified WBA identity broker, so your venues join the federation through your Purple account. You accept the OpenRoaming terms when you enable it in step 1. Purple's cloud RADIUS then holds the federation certificates and handles RadSec routing. Your controllers and dashboards never store WBA certificates, so there is nothing extra to renew on your side.

How does OpenRoaming affect our CCPA/CPRA and PCI DSS audits?

It gives you evidence for both, rather than a compliance certificate. Visitor credentials are checked by their identity provider inside the EAP exchange, so your venue does not store them. Isolating OpenRoaming on its own VLAN, outside the cardholder data environment, is evidence for PCI DSS scoping. Purple holds ISO 27001 and Cyber Essentials certification, which supports your supplier due diligence.

Can OpenRoaming run alongside our staff 802.1X network?

Yes, on a separate SSID. Staff keep EAP-TLS with certificates tied to Microsoft Entra ID, Okta or Google Workspace, and identity sets their VLAN. OpenRoaming visitors join the Passpoint SSID and land on the visitor VLAN. Both authenticate through Purple cloud RADIUS, so you monitor them in one place. Never merge the two SSIDs to save airtime.

How long does an OpenRoaming rollout take across a multi-site estate?

The firmware audit sets the pace, not the configuration. Building the SSID and Passpoint settings at one pilot site fits in a single change window. Once the pilot passes every check, templates or network groups push the same settings to the remaining sites. Estates with mixed firmware should schedule upgrades region by region first, then add the SSID.

Which devices can join an OpenRoaming venue?

Any device that supports Passpoint and holds an OpenRoaming profile from a federation identity provider can join. Current iOS and Android releases support Passpoint, so most modern cell phones qualify once a profile is installed. For managed corporate devices, push the profile through your MDM. Devices without a profile use your guest SSID instead, with no change to their experience.