Connect WPA2/WPA3-Enterprise (802.1X)

Before you start

• The location is on an Enterprise Wi-Fi package and has a Company users directory (users you add, a CSV import, or Microsoft 365 / Google Workspace).
• Access points that do WPA2-Enterprise or WPA3-Enterprise with an external RADIUS server, such as UniFi, Omada, Aruba, Ruckus, Cisco or MikroTik.
• Decide where the access points send RADIUS: the Hotspot Server on site (staff still join while the line is down) or the location’s RADIUS in the cloud (no Hotspot Server needed).

On the Perpetual License? Set 802.1X up on the machine’s admin pages under 802.1X instead (see below); no Console needed.

1. Set up the directory

1. Go to Identity and open the directory.
2. Under Groups, set devices per person and speed. To put each group on its own network, give it a VLAN (802.1X).
3. Under Company Wi-Fi (WPA2/WPA3-Enterprise), enter the Company Wi-Fi name (SSID) exactly as you will set it on the access points. The Server name (EAP) can stay as given. Click Save.
4. At each location that should use it, click Use here.

2. Turn on 802.1X at the location

Open the location’s Who can get on tab and switch on Company Wi-Fi (802.1X). The Console shows what to enter on the access points:

• Hotspot Server: the access points must be on a network the Hotspot Server serves (its LAN side); it takes RADIUS only from there. Set accounting too, so access ends as soon as a device leaves.
• Cloud RADIUS: wait until the Console says this organisation’s own RADIUS is running. Until then codes and user accounts still sign in on the sign-in page, but WPA2/WPA3-Enterprise does not. The access points must reach the Internet on UDP 1812.
• New secret stops the old secret at once: enter the new one on every access point.
• Group VLANs must be carried by your switches. For the Hotspot Server to hand out addresses on them, install it with --vlan and the same numbers.

3. Set up staff devices

The easiest way is to send staff the Staff setup page link (on the directory page). They sign in with their username or company Microsoft / Google account, pick their device and download a settings file; the device then joins the company Wi-Fi with a certificate (EAP-TLS) on its own. The page works once the Wi-Fi name is set and 802.1X is on at one location or more.

• iPhone, iPad, Mac: download the profile, then open Settings › Profile Downloaded › Install.
• Android: download the certificate file and note its password; install it under Settings › Security › Encryption & credentials › Install a certificate › Wi-Fi certificate, then join with EAP method TLS and the domain the page shows.
• Windows: double-click the file › Current User › enter the file password, then pick the company Wi-Fi › connect using a certificate.
• Certificates last a year. See them and Revoke a lost device’s or a leaver’s certificate on the directory page; that device can’t join again.

To use a username and password (PEAP) instead, pick the company Wi-Fi and set EAP method PEAP, Phase 2 MSCHAPv2, the username and password from the directory, and the domain from Server name (EAP). If the Console says the server certificate is publicly trusted, Android uses “Use system certificates” and iPhone, Mac and Windows ask once to trust it; otherwise install the CA certificate from the Console first.

Perpetual License: 802.1X on your machine

1. On the machine’s admin pages, open 802.1X and click Turn on 802.1X. The machine makes its own CA, server certificate and RADIUS secret; users on the machine and Active Directory work at once.
2. Enter the Wi-Fi name (SSID), check the Server name, and save.
3. On the access points, set the SSID to WPA2/WPA3-Enterprise with the machine’s address on the access points’ network as RADIUS server, and the ports and secret shown under Access point settings.
4. Set up staff devices: download the CA or the iPhone/Mac profile (name and password) from the same page, or Issue a device certificate (EAP-TLS) and hand the file and its password to the device’s owner safely.

• PEAP-MSCHAPv2 works for users made on the machine; users made before PEAP was on change their password once. Active Directory users use EAP-TTLS or a certificate instead.
• Device certificates last 2 years, at most 5 per person (more revokes the oldest), and can be revoked under Device certificates.
• If your company already has a CA its devices trust (such as AD CS), upload the server certificate and private key as PEM instead of the machine’s own.

Never accept a certificate whose name differs from the Server name (EAP), and never choose “Do not validate” on Android: it may be a fake Wi-Fi collecting staff passwords.