> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wiacom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding

> Configure Aruba for Wiacom Portal — IAP, Controller, and Instant On

<Warning>
  RADIUS server details and portal URL are region-specific. Obtain the correct values from the Wiacom admin panel or the Wiacom team before starting.
</Warning>

## Step 1 — Add the Device to Wiacom

1. Go to **Inventory → Routers → Add New Router**
2. Select **Aruba** from the vendor dropdown
3. Enter the required details and assign a location
4. Click **Save**

<Tabs>
  <Tab title="Aruba IAP / Instant">
    Log in to your Aruba IAP (Master AP).

    ## Create the SSID

    Under **Network** at the top left, click **New**:

    * Name (SSID): your guest WiFi name
    * Primary usage: **Guest**

    Click **Next**:

    * Client IP assignment: Virtual Controller managed
    * Client VLAN assignment: Default (or your guest VLAN)

    Click **Next** and configure the splash page:

    * Splash page type: **External**
    * Captive portal profile: click the dropdown → **New**
      * Name: `guestwifi`
      * Type: **Radius Authentication**
      * IP or hostname: `<PORTAL_HOSTNAME>` — provided by Wiacom
      * URL: `<PORTAL_PATH>` — provided by Wiacom
      * Port: `443`
      * Use HTTPS: Enabled
      * Redirect URL: `<PORTAL_URL>?res=success`

    ## Configure RADIUS Auth Servers

    Auth server 1:

    * Type: RADIUS, Name: `guestwifi1`
    * IP address: `<RADIUS_SERVER_1>`
    * Auth port: `1812`, Acct port: `1813`
    * Shared key: `<RADIUS_SHARED_SECRET>`

    Auth server 2:

    * Type: RADIUS, Name: `guestwifi2`
    * IP address: `<RADIUS_SERVER_2>`
    * Auth port: `1812`, Acct port: `1813`
    * Shared key: `<RADIUS_SHARED_SECRET>`

    Additional settings:

    * Reauth interval: `24 hrs`
    * Accounting: Enabled, Accounting mode: Authentication, Interval: `3 min`

    ## Configure Walled Garden

    Click **"Blacklist: 0 Whitelist: 0"** and add domains one by one:

    ```
    *.wiacom.ai
    *.akamaitechnologies.com
    *.akamaiedge.net
    *.akamaized.net
    *.akamai.net
    *.amazonaws.com
    *.fastly.net
    *.zencdn.net
    fast.wistia.com
    player.vimeo.com
    *.facebook.com
    *.fbcdn.net
    *.akamaihd.net
    connect.facebook.net
    *.instagram.com
    *.twitter.com
    *.twimg.com
    *.linkedin.com
    *.licdn.net
    *.licdn.com
    *.google.com
    *.googleapis.com
    *.gstatic.com
    ```

    ## Configure Access Rules

    Click **Next** → Access Rules: **Role-based**

    Under Roles, click **New** → name `Preauth`

    Under Access Rules for Preauth, click **New** for each walled garden domain:

    * Rule type: Access control
    * Service: Network - any
    * Action: Allow
    * Destination: To domain name
    * Domain name: `*insert domain here*`

    Assign pre-authentication role: select **Preauth**

    Click **Finish**.
  </Tab>

  <Tab title="Aruba Controller">
    Log in to your Aruba Controller web interface.

    ## Create the WLAN

    Click **Configure → WLANs → +**:

    * Name (SSID): your guest WiFi name
    * Primary Usage: **Guest**
    * Forwarding Mode: Tunnel

    Click **Next** → VLAN: your guest VLAN

    Click **Next**:

    * Is this WLAN for internal or guest? **Guest**

    Click **Next**:

    * Captive Portal Type: **ClearPass or other external Captive Portal**

    ## Configure RADIUS

    Under Auth servers, click **+ → +** to create new servers:

    Server 1:

    * Server type: RADIUS, Name: `guestwifi1`
    * IP Address: `<RADIUS_SERVER_1>`
    * Auth port: `1812`, Accounting port: `1813`
    * Shared key: `<RADIUS_SHARED_SECRET>`

    Server 2:

    * Name: `guestwifi2`
    * IP Address: `<RADIUS_SERVER_2>`
    * Auth port: `1812`, Accounting port: `1813`
    * Shared key: `<RADIUS_SHARED_SECRET>`

    Under **Advanced Settings**:

    * Called Station ID Type: MAC Address
    * Called Station ID Include SSID: Enabled
    * Accounting: Use authentication servers, Interval: `4 min`

    ## Configure Walled Garden (Allowlist)

    Under Allowlist, click **+ Add** and add each domain from the list above.

    ## Configure Access Rules

    Click **Next** → Access rules: **Role Based**

    Click **Add Role** → name `Preauth`

    For each walled garden domain, add a rule:

    * Access Control / Network / Any / Allow / To a Domain Name: `*domain*`

    Add a final deny rule:

    * Access Control / Network / Any / Deny / To All Destinations (must be last)

    Configure:

    * Captive Portal Profile: your portal profile
    * Assign Pre-Authentication Role: `Preauth`

    Click **Finish**.
  </Tab>

  <Tab title="Aruba Instant On">
    Log in to the Aruba Instant On portal at [portal.arubainstanton.com](https://portal.arubainstanton.com).

    <Warning>
      Aruba Instant On does not support RADIUS authentication. Wiacom analytics features (online users, network reports) and tiered bandwidth are unavailable.
    </Warning>

    ## Create the Network

    Click **Networks → Add a new network**:

    * Network Name: your guest WiFi name
    * Network type: **Guest**

    Click **Save**.

    ## Configure the Guest Portal

    Click **Customize guest portal**:

    * Portal type: **External**
    * Server URL: `<PORTAL_URL>` — provided by Wiacom
    * Redirect URL: `<PORTAL_URL>?res=success`
    * Whitelisted domains: add all domains from the walled garden list above
    * Send RADIUS Accounting: Enabled
    * Primary RADIUS Server IP: `<RADIUS_SERVER_1>`
    * Primary RADIUS Server Secret: `<RADIUS_SHARED_SECRET>`
    * Secondary RADIUS Server: Enabled
    * Secondary RADIUS Server IP: `<RADIUS_SERVER_2>`
    * Secondary RADIUS Server Secret: `<RADIUS_SHARED_SECRET>`

    Click **Apply changes**.
  </Tab>
</Tabs>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Guests not redirected to portal">
    Confirm the SSID is set to Guest type and the splash page type is External. Check that HTTP (not HTTPS) pages trigger the redirect.
  </Accordion>

  <Accordion title="RADIUS authentication fails">
    Verify RADIUS server addresses and shared secret match values from Wiacom. Confirm UDP 1812 and 1813 are reachable.
  </Accordion>

  <Accordion title="Social login fails">
    Ensure the relevant social provider domains are in the walled garden.
  </Accordion>
</AccordionGroup>