Core technical requirements
Managed enterprise Wi-Fi
Central policy, supported authentication, change control, logging, and repeatable configuration are usually essential.
Passpoint capability
The proposed hardware and software must support the required discovery, ANQP, credential, and roaming configuration.
Segmentation
Dedicated SSID/service profile, VLAN, firewall, client-isolation, and management policy may be needed to protect business systems.
Internet capacity
Circuits need enough measured headroom for offload while preserving POS, operations, staff, and guest service.
Authentication may involve RADIUS and, where applicable, RadSec. The design also needs DNS, DHCP, certificate, redundancy, monitoring, and support ownership. A secure architecture is validated end to end; it is not created merely by adding a new network name.
Common enterprise Wi-Fi manufacturers
Cisco, Aruba, Ruckus, Ubiquiti, and Juniper Mist all have commercial product families used in managed Wi-Fi environments. Their products differ significantly across generation, controller mode, firmware, license, radio capability, cloud management, and Passpoint feature set.
| Environment | Questions to validate | Do not assume |
|---|---|---|
| Cisco / Meraki | Controller or dashboard model, software train, Hotspot 2.0 profile support, RADIUS behavior, licensing, and template scope | Every Cisco-branded AP supports the same configuration |
| HPE Aruba | Central/controller architecture, OS version, Passpoint/ANQP configuration, role policies, and certificate/AAA integration | Instant, Central, and controller deployments are interchangeable |
| Ruckus | SmartZone/Cloud/Unleashed mode, firmware, Hotspot 2.0 support, policy, and AAA compatibility | All management modes expose identical features |
| Ubiquiti UniFi | Exact network application and AP version, supported Passpoint profile, VLAN, RADIUS, and operator test results | A forum configuration proves production program acceptance |
| Juniper Mist | AP generation, cloud configuration, WLAN/authentication template, segmentation, assurance metrics, and program profile | Cloud management alone confirms commercial eligibility |
Practical qualification checklist
- Export model, serial, location, controller/cloud, firmware, license, and lifecycle status for every AP.
- Document current SSIDs, VLANs, address plans, firewalls, authentication, captive portals, and QoS.
- Measure current and peak circuit utilization, latency, loss, DNS/DHCP capacity, and redundancy.
- Confirm the proposed Passpoint profile and supported device/authentication methods with the program.
- Review security ownership, vendor access, least privilege, logging, privacy, retention, and incident response.
- Test in a limited RF area with approved devices, noneligible devices, roaming, failure, and load scenarios.
- Record a rollback plan and baseline performance before production activation.
Multi-site deployment considerations
A portfolio may contain different generations, MSPs, circuits, ownership structures, and security standards. Group sites into technical archetypes instead of pushing one configuration everywhere. Start with a representative pilot, document exceptions, and use change windows appropriate to each business.
Central reporting should distinguish authentication health, offload data, general Wi-Fi performance, and commercial settlement. A revenue dashboard does not replace network monitoring.
Frequently asked questions
Can Cisco access points support carrier offload?
Some Cisco enterprise platforms can support relevant Passpoint and enterprise-authentication features, but support varies by access point, controller, software release, licensing, and design. Validate the exact bill of materials.
Can Ubiquiti UniFi support Passpoint carrier offload?
Capability varies by product, controller release, profile requirements, and operator integration. Do not assume compatibility from the brand alone; test the exact environment against the chosen program.
Do I need a separate SSID and VLAN?
Many designs use a separate service profile and segmented network path to protect business systems and apply policy. The exact architecture should be approved by the venue’s network and security teams.
How much internet capacity is required?
There is no universal number. Capacity planning should use peak concurrency, expected eligible traffic, current utilization, QoS policy, circuit headroom, redundancy, and service-level requirements.
Can consumer Wi-Fi routers participate?
Most consumer routers lack the controller, Passpoint, enterprise authentication, segmentation, monitoring, and change-control capabilities expected for commercial offload. Program-specific exceptions should be verified.