Aruba Central - OpenRoaming with RadSec

Configure RadSec (RADIUS over TLS) on Aruba Central to enable secure OpenRoaming authentication with IronWiFi. This guide covers certificate management, RadSec server configuration, and Hotspot 2.0 deployment for Aruba access points managed through Aruba Central cloud platform.

Prerequisites

In Aruba Central:

• Aruba Central account with managed access points
• Aruba access points with Hotspot 2.0 support
• Administrator access

In IronWiFi Console (complete these first):

1. Create a Network and enable OpenRoaming
2. Enable RadSec on the network
3. Download the certificate bundle containing:

   • iw-rsa-root-ca.cert.pem

     - Root CA

   • iw-rsa-radsec-signing-ca.cert.pem

     - Intermediate CA

   • client.cert.pem

     - Client certificate

   • client.key.pem

     - Private key

RadSec Server Details

Setting	Value
Server	radsec.ironwifi.com
Port	2083
Protocol	TLS

Quick Start

1. Upload certificates to Aruba Central (Global Settings → Security)
2. Create RadSec authentication server with

   radsec.ironwifi.com:2083

3. Create WLAN with WPA2-Enterprise and assign the RadSec server
4. Enable Hotspot 2.0 with OpenRoaming OIs:

   5A03BA0000

   ,

   5A03BA0200

   ,

   004096

5. Configure NAI realm:

   ironwifi.com

6. Deploy to access points

---

Aruba Central Configuration

Step 1: Prepare Certificates

Extract the zip file containing the 2 CA certificates, Client Certificate, and the Client Key.

Concatenate the Client Certificate and Client Key, either using the

cat

command in Linux or simply copying and pasting the key below the Client Certificate in a text editor. Save the resulting file as a new file with

.pem

extension.

Step 2: Upload Certificates

1. Log in to Aruba Central (central.arubanetworks.com)
2. Navigate to Global > Organization > Network Structure > Certificates
3. Click + to add a new entry
4. Add IW Root CA and IW RadSec Signing CA as CA Certificate

5. Add the concatenated Client Certificate + Key as Server Certificate

Step 3: Create RadSec Authentication Server

1. Go to Device > Access Point > Security
2. Click + to add Authentication Server
3. Add desired name, tick Radsec, enter the IP address from IronWiFi Console
4. Click Save

5. Scroll down to Certificate Usage and select the certificates you added previously

Step 4: Create WLAN with Passpoint

1. Go to the WLANs tab and add a new SSID
2. Give it a name and click Next

Step 5: Configure Security

1. Select appropriate VLAN in section 2
2. In section 3, set Security Level to Enterprise
3. Select the RadSec server you added previously as your Primary Server

4. Click on Advanced Settings and scroll down
5. Enable Called Station ID Include SSID
6. In the Accounting subsection, pick Use Authentication Servers and set interval to 10 minutes

Step 6: Configure Passpoint / Hotspot 2.0

1. Click on Manage Passpoint Services to add a Passpoint Profile
2. Give the profile a suitable name
3. In the Access Network section:
   • Add

     ironwifi.net

     as Domain Name
   • Enable Internet, Radius Location Data, and Radius Chargeable User Identity
   • Select Network Type as free-public
   • Select the suitable venue and network parameters to reflect your local setup

4. In the Identity Provider section:
   • Add

     ironwifi.net

     as the Realm Name
   • Enable Home Realm
   • Set EAP Method as eap-ttls
   • Add pap and mschapv2 as non-EAP inner auth

5. In Roaming Consortium, add

   aa146b0000

   and

   5a03ba0000

6. Click Save and close the Passpoint Profile pop-up

7. Select the profile you just created

Step 7: Finalize and Deploy

1. Click Next
2. Make sure Unrestricted is selected

3. Click Save

---

Group vs Site Configuration

Group-Level (Recommended)

Configure RadSec and Hotspot 2.0 at the group level for consistent deployment across all sites in the group.

Site-Level Override

For site-specific configurations:

1. Navigate to specific Site
2. Override group settings as needed
3. Upload site-specific certificates if required

---

Verification

Check WLAN Status

1. Go to Dashboard > Network Health
2. Verify WLAN is active on APs
3. Check for configuration errors

Monitor RadSec Connectivity

1. Navigate to Monitor > Security
2. Check RADIUS/RadSec connection status
3. Look for successful TLS handshakes

Test Client Connection

1. Connect Passpoint-enabled device
2. Verify automatic Passpoint connection
3. Check authentication in:
   • Aruba Central Client Monitor
   • IronWiFi Console Authentication Logs

---

Troubleshooting

Certificate Issues

1. Certificate Upload Failed

   • Verify certificate format (PEM)
   • Check certificate chain completeness
   • Ensure private key matches certificate

2. TLS Handshake Failure

   • Verify CA certificates are correctly installed
   • Check certificate expiration dates
   • Ensure server name matches certificate CN/SAN

RadSec Connection Problems

1. Connection Timeout

   • Verify port 2083 is open outbound
   • Check firewall rules
   • Test connectivity to radsec.ironwifi.com

2. Authentication Rejected

   • Verify client certificate is valid
   • Check NAI realm configuration
   • Review IronWiFi console logs

Hotspot 2.0 Issues

1. Network Not Discovered

   • Verify Hotspot 2.0 is enabled on WLAN
   • Check roaming consortium OIs
   • Ensure client device supports Passpoint

2. ANQP Query Failures

   • Review AP logs for GAS/ANQP errors
   • Verify domain and realm configuration
   • Check client Passpoint settings

Debug in Aruba Central

1. Go to Troubleshooting > Logs
2. Filter by AP or client
3. Look for RADIUS/RadSec events
4. Check authentication success/failure reasons

Common Errors

Error	Cause	Solution
TLS handshake failed	Certificate issue	Re-upload certificates
Connection refused	Port blocked	Open port 2083
Certificate expired	Outdated cert	Download new bundle
Unknown CA	Trust not configured	Install CA chain
Auth rejected	Wrong realm	Check NAI realm config

---

Best Practices

1. Group Configuration: Use group-level settings for consistency
2. Certificate Management: Track expiration dates, plan renewal
3. Monitoring: Set up alerts for RadSec failures
4. Testing: Verify with multiple device types
5. Documentation: Record all configuration settings
6. Backup: Export configuration before changes

Related Topics

Same vendor

• Aruba IAP RADIUS configuration
• Aruba Mobility Controller RADIUS configuration
• Aruba Passpoint (Hotspot 2.0)

Standards & reference

• Passpoint overview
• OpenRoaming overview
• RadSec fundamentals
• OpenRoaming troubleshooting