Skip to main content
Skip to main content

Aruba Mobility Controller

Integrate Aruba Mobility Controller with IronWifi's RADIUS authentication and external captive portal services. This comprehensive guide covers AAA server groups, captive portal profiles, pre-authentication ACLs, user roles, WLAN configuration, and WPA-Enterprise setup for enterprise-grade guest and employee WiFi networks.

Prerequisites​

In Aruba Mobility Controller:

  • Aruba Mobility Controller running ArubaOS 8.x or later
  • Access to the controller web interface or CLI
  • Administrator credentials

In IronWifi Console (complete these first):

  1. Create a Network and note the RADIUS details:
    • Primary and backup server IP addresses
    • Customer authentication and accounting ports (displayed in Network Settings)
    • Shared secret
  2. Create a Captive Portal with vendor set to Aruba and note the Splash Page URL

Controller Configuration​

Step 1: Configure RADIUS Server​

  1. Navigate to Configuration → Security → Authentication → Servers
  2. Click Add
  3. Configure primary server:
FieldValue
NameIronWifi-Primary
IP Address
{Primary IP from IronWifi}
Auth Port
{Customer Authentication Port}
Acct Port
{Customer Accounting Port}
Shared Key
{Shared secret from IronWifi}
  1. Add backup server with the same settings using the backup IP

Step 2: Create Server Group​

  1. Navigate to Authentication → Server Group
  2. Click Add
  3. Configure:
FieldValue
NameIronWifi
ServersAdd both IronWifi-Primary and IronWifi-Backup

Step 3: Create AAA Profile​

  1. Navigate to Authentication → L3 Authentication → Captive Portal Authentication
  2. Create new profile:
FieldValue
NameIronWifi-CaptivePortal
Login pageExternal
Redirect URL
{Splash Page URL from IronWifi}
Server GroupIronWifi

Step 4: Configure Captive Portal Profile​

  1. Navigate to Security → Captive Portal
  2. Create new profile:
FieldValue
NameIronWifi-Portal
TypeExternal
Auth textWelcome to Guest WiFi
Server
107.178.250.42

Step 5: Create Pre-Authentication ACL​

Create a whitelist for access before authentication.

Required Entry​

Always allow the IronWifi server:

Additional Entries by Authentication Provider​

Only add entries for authentication methods you've enabled in IronWifi:

ProviderACL Entries to Add
Google
any host accounts.google.com any permit
, 
any network 142.250.0.0/16 any permit
Facebook
any host facebook.com any permit
, 
any network 157.240.0.0/16 any permit
LinkedIn
any host linkedin.com any permit
Twitter/X
any host twitter.com any permit
, 
any host x.com any permit
Apple
any host appleid.apple.com any permit
Microsoft
any host login.microsoftonline.com any permit
tip

For wildcard domain support, consider using destination-based ACLs with DNS snooping or use IP ranges for the authentication providers.

Step 6: Create User Role​

  1. Navigate to Roles → Add
  2. Create authenticated role:
FieldValue
NameIronWifi-Authenticated
Access PoliciesConfigure appropriate internet access

Step 7: Configure WLAN​

  1. Navigate to WLANs → Add
  2. Configure:
FieldValue
NameGuest-WiFi
SSIDGuest-WiFi
AAA ProfileIronWifi-CaptivePortal
Captive Portal ProfileIronWifi-Portal
Initial Role(role using ironwifi-preauth ACL)
Authenticated RoleIronWifi-Authenticated

CLI Configuration​

For administrators who prefer CLI configuration:

Alternative: WPA-Enterprise (No Captive Portal)​

For 802.1X authentication where users enter credentials in their device WiFi settings:

Testing and Verification​

After completing the configuration, verify everything works correctly.

Test Captive Portal Flow​

  1. Connect a device to the Guest-WiFi SSID
  2. Open a browser and navigate to 
    http://example.com
  3. Verify redirect to IronWifi splash page
  4. Complete authentication
  5. Verify internet access is granted

Verification Commands​

Troubleshooting​

If testing reveals issues, use this section to diagnose common problems.

Captive Portal Not Redirecting​

SymptomCauseSolution
No redirectCaptive portal not appliedVerify WLAN has captive portal profile
Wrong pageIncorrect redirect URLCheck external portal URL configuration
Blank pageWhitelist missingAdd 
107.178.250.42
to pre-auth ACL

RADIUS Failures​

SymptomCauseSolution
TimeoutServer unreachableVerify IP and check firewall
RejectWrong secretConfirm shared secret matches
No accountingServer not configuredAdd accounting server to group

Debug commands:

Authentication Issues​

SymptomCauseSolution
Stuck in initial roleAuth not completingCheck captive portal profile
Wrong role assignedRole mapping issueVerify authenticated role configuration
Can't reach internetACL blockingCheck authenticated role policies

Debug commands: