Network Guys

Share your knowledge!

Aruba Instant On how to setup 802.1x with Windows NPS

Hello guys,

today I will talk about how you can setup a WPA2/3 enterprise wifi with aruba Instant On Access Points.

Because I don’t have an AD integrated notebook in my private test environment, I limit myself to username / password and don’t do any authentication by computer account.

Settings in the Instant On Portal

Create a new SSID


I have named the SSID Wifi-Enterprise. Under NAS identifier I used the name of the SSID as the identifier. You can also enter something else, but it makes it easier to set up the policies for the individual SSIDs later.

As a last step, we need the IP addresses of the individual access points.




The NPS Settigns

First, we must create the Radius-Clients. (the two Instant On APs)

Next, the network policy must be created. I have it named like the SSID Wifi-Enterprise.

Under conditions, I specify the Windows group for the wifi users and the NAS identifier so that the policy for the correct SSID takes effect. With Instant On this is not a problem because I can specify the NAS identifier per SSID.

Under Restrictions, please configure the following:

And under settings just leave the default values as they are.

Check the Results:

I checked the wifi with my iPhone and my Windows notebook.

Under Networks you can see the devices per SSID.

And here I see my iPhone and my notebook :)


Anyone who wants great Wi-Fi for little money should take a closer look at Instant On World. For homes like mine or small businesses, the APs are just right. :D

If you are interested once the links

Aruba AP11

Aruba AP11D

Aruba AP12

Aruba AP15

Aruba AP17 (Outdoor)

Aruba AP22 (Wifi 6)

And 3 recommended Aruba PoE switches

1930 8P

1930 24P

1930 48P

Have a nice day!


2 Responses

  1. Hey Phillip,

    ist es mit Instant On möglich das VLAN als RADIUS Attribut (VSA) mitzugeben?
    Also eine SSID bei der das VLAN basierend auf dem authentifizierten Benutzer überschrieben wird?

    Wir suchen aktuell auch eine Lösung für ein Mehrfamilienhaus. Eine SSID für alle, aber jeder soll in seinem eigenen Netz landen.

    Unter Aruba würde das folgende Attribut genutzt werden:

    Aruba-Named-User-Vlan String 9 This VSA returns a VLAN name for a user. This vlan name on a controllercould be mapped to user-defined name or or multiple VLAN IDs.


  2. Hallo Moritz,

    ich habe es gerade mit meinen NPS Server getestet. Die VLAN ID wird vom Instant On nicht mit übernommen. Ich befürchte, dass du hier mit mehreren SSIDs arbeiten musst oder auf einen IAP-Cluster mit Aruba 505 oder 515 wechseln musst.

    Viele Grüße


Leave a Reply

Click on the button to load the content from

Load content

This site uses Akismet to reduce spam. Learn how your comment data is processed.


ekahau Certified Survey Engineer
Post Categories
Post Archives