Aerohive (Extreme) - Passpoint Configuration

Configure Passpoint (Hotspot 2.0) on Aerohive/Extreme Networks access points to enable automatic WiFi authentication through IronWiFi's cloud RADIUS service. This eliminates manual network selection and provides WPA2/WPA3-Enterprise security without splash pages.

Overview

Aerohive Networks (now part of Extreme Networks) supports Hotspot 2.0/Passpoint through:

• ExtremeCloud IQ - Cloud-managed platform
• HiveManager NG - On-premises management
• ExtremeCloud IQ - Site Engine - Enterprise management

Prerequisites

In Aerohive/Extreme:

• Aerohive/Extreme access points with Hotspot 2.0 support
• HiveOS 10.x or later
• ExtremeCloud IQ account or HiveManager NG

In IronWiFi Console (complete these first):

1. Log in to IronWiFi Management Console
2. Navigate to Networks > select your network
3. Enable Passpoint from dropdown
4. Note configuration details:
   • RADIUS Server IP
   • RADIUS Secret
   • Authentication Port: Customer Authentication Port
   • Accounting Port: Customer Accounting Port
   • NAI Realm:

     ironwifi.com

---

ExtremeCloud IQ Configuration

Step 1: Log in to ExtremeCloud

Log in to the ExtremeCloud console as admin. For existing environments with additional users, log in as a user with administrative privileges. The ExtremeCloud Dashboard appears with your access points displayed.

note

There are a number of options you can set. Only the options that require your input are shown. Default values are used for options that don't need changes.

Step 2: Create a Network Policy

1. Click Configure in the menu bar on the left of the Dashboard
2. Select Network Policies

3. Click Add Network Policy
4. On the Policy Details tab:
   • Under What type of policy are you creating?, leave the box checked next to Wireless. Uncheck the boxes next to other options.
   • Enter a Policy Name, such as

     IronWiFi_network_policy

5. Click Next on the bottom right

Step 3: Create an SSID

The Wireless Networks page appears.

1. Click Configure in the menu bar on the left
2. Select Network Policies > Wireless Networks at the top
3. Click + to create an SSID
4. Select All other Networks (standard)

5. Enter a Name for internal purposes and a Broadcast Name that your clients will see (the names can be the same)
6. Under Security, select WPA2-Enterprise (the default is Private Pre-Shared Key)
7. In the Key Management field, select 802.1X and set Encryption Method to AES-CCMP

Step 4: Add RADIUS Authentication Servers

It is important to set up a secure RADIUS connection between the wireless LAN controller and IronWiFi.

1. Still on the Wireless Networks page, scroll down to Authentication Settings
2. Under Authenticate via RADIUS Server, click + to add a RADIUS server group
3. The Configure RADIUS Servers dialog box appears
4. Enter a RADIUS Server Group Name
5. Click + to the right of the server group to add a server
6. The Select RADIUS Settings dialog box appears

7. In the New External RADIUS Server section, enter a Name such as

   Primary_radius

8. Click + next to IP/Host Name
9. Select IP Address. The New IP Address or Host Name dialog box appears.

10. Enter the IronWiFi RADIUS Server IP address and click Save
11. You return to the New External RADIUS Server section with the IP/Host Name field populated

12. Enter the Shared Secret from your IronWiFi console
13. Configure Authentication Port and Accounting Port with the values from your IronWiFi console
14. Click Save

Step 5: Verify RADIUS Configuration

The Authenticate via RADIUS Server section of the Wireless Networks page now shows the RADIUS server group and server you created.

Step 6: Assign the SSID to the Network Policy

Still on the Wireless Networks page:

1. Select the SSID by clicking the checkbox next to the SSID
2. Click Save

Step 7: Configure VIQ Management

The VIQ Management page appears for additional configuration options.

Step 8: Verify the Network Policy

Navigate back to the Network Policies page. You see the network policy you created (e.g.,

IronWiFi_network_policy

).

Step 9: Configure Hotspot 2.0 / Passpoint

Click the name of the SSID you created. The Wireless Network page appears.

1. Ensure Hotspot 2.0 is set to ON (enable it if not)
2. Enter a Name, such as

   Hotspot

3. Paste the Passpoint CLI commands into the CLI Commands box:

Step 10: Deploy Configuration to Access Points

1. Click Next
2. The Apply the network policy to selected devices page appears
3. Click Eligible to display your access points
4. Select the target access points and apply the configuration

---

Hotspot 2.0 Settings Reference

When configuring the Hotspot 2.0 / Passpoint profile, use these settings:

Domain Names:

Operator Information:

• Friendly Name: IronWiFi
• Language Code: eng

Roaming Consortium OIs:

OI	Description
5A03BA0000	OpenRoaming Settlement-free
004096	Cisco OpenRoaming
AA146B0000	Cityroam (if applicable)

NAI Realm:

• Realm:

  ironwifi.com

• EAP Method: EAP-TTLS
• Inner Authentication: PAP, MSCHAPv2
• Credential Type: Username/Password

---

HiveManager NG Configuration

Configure RADIUS

1. Log in to HiveManager NG
2. Go to Configuration > Authentication > RADIUS Servers
3. Click Add
4. Configure:
   • Name: IronWiFi
   • IP Address: IronWiFi RADIUS IP
   • Auth Port: Customer Authentication Port
   • Accounting Port: Customer Accounting Port
   • Shared Secret: Your secret

Configure Hotspot 2.0

1. Go to Configuration > Wireless > Hotspot 2.0
2. Click Add Profile
3. Configure all Hotspot 2.0 settings as described in the settings reference above

Create SSID Profile

1. Go to Configuration > Wireless > SSIDs
2. Create new SSID with:
   • WPA2-Enterprise security
   • RADIUS authentication
   • Hotspot 2.0 profile assigned

---

CLI Configuration (Advanced)

For advanced users, use HiveOS CLI:

RADIUS Configuration

RADIUS Group

AAA Profile

Hotspot 2.0 Profile

SSID Profile

Apply to Interface

---

Verification

ExtremeCloud IQ

1. Go to Monitor > Devices
2. Select access point
3. Check Wireless status
4. Verify SSID is broadcasting
5. Check client connections

Check Hotspot 2.0 Status

1. Go to Monitor > Clients
2. Filter by SSID
3. Verify Passpoint client connections

CLI Verification

---

Test Connection

Device Requirements

• Passpoint-capable device (iOS 7+, Android 6+, Windows 10+)
• Passpoint profile installed or OpenRoaming profile

Connection Process

1. Ensure device Passpoint is enabled
2. Device discovers Passpoint network via ANQP
3. Automatic connection based on credentials
4. Verify in IronWiFi Console > Logs

---

Troubleshooting

Network Not Discovered

1. Verify Hotspot 2.0 enabled on SSID
2. Check ANQP responses:

   show hotspot20-anqp-stats

3. Verify beacon frames include Interworking IE
4. Test with different client devices

Authentication Failures

1. Test RADIUS connectivity:

   test radius server IronWiFi username testuser

2. Check RADIUS server status:

   show radius-server-status

3. Review authentication logs in ExtremeCloud IQ

4. Verify NAI realm matches IronWiFi configuration

Connection Drops

1. Check signal strength - Ensure adequate coverage
2. Review AP logs for disconnection reasons
3. Verify VLAN configuration - Ensure proper network access
4. Check session timeout settings

Common Errors

Error	Cause	Solution
RADIUS timeout	Network issue	Check firewall, verify IP
Auth rejected	Wrong credentials	Verify realm, check user
No ANQP response	HS2.0 disabled	Enable Hotspot 2.0 on SSID
Certificate error	TLS mismatch	Update AP firmware

---

Best Practices

1. Firmware Updates: Keep HiveOS updated for best Passpoint support
2. Testing: Verify with multiple device types before production
3. Monitoring: Use ExtremeCloud IQ dashboards for visibility
4. Redundancy: Configure backup RADIUS servers
5. Documentation: Record all configuration settings
6. Security: Use strong RADIUS secrets, enable accounting

Related Topics

Same vendor

• Aerohive RADIUS configuration

Standards & reference

• Passpoint overview
• OpenRoaming overview
• RadSec fundamentals
• Passpoint troubleshooting