App – Open Roaming

Say goodbye to finding and typing Wi-Fi passwords, and to disruptive pop-up screens. With OpenRoaming, your mobile device can connect quickly, automatically, and securely to your trusted Wi-Fi network (All OpenRoaming use cases require to configure OpenRoaming app on Cisco Spaces).

Use Cases & Value

OpenRoaming supports multiple use cases across various industries. Here are some of the most common ways in which this app is delivering value to our customers.

Seamless, secure onboarding & improve user insights

Improve onboarding experience with a seamless and secure Wi-Fi connection access for customers, students, or guests, and generate better customer insights

Value Delivered: Enhanced Wi-Fi experience & improved customer insights

Useful to: IT teams, marketing, visitors

Drive loyalty customer value

Provide differentiated service for mobile app loyalty users by auto-onboarding mobile app users and engaging with them contextually

Value Delivered: Improved loyalty guest experience & drive targeted engagement

Useful to: IT, Guest services teams, Sales & Marketing

Carrier Indoor coverage

Provide enhanced indoor coverage for your customers, through seamless and secure Wi-Fi onboarding instead of expensive Distributed Antenna Systems (DAS) deployments

Value Delivered: enhanced indoor coverage & cost saving for DAS deployment

Useful to: IT teams, visitors

Monetize your network

Monetization through carrier offload of data onto the Wi-Fi network

Value Delivered: additional revenue stream

Useful to: IT teams, marketing

Address privacy MAC challenges

Recognize device & users based on OpenRoaming ID instead of MAC ID, which eliminates any impacts brought by MAC randomization

Value Delivered: keep all onboarding & analytics benefits without MAC randomization impact

Useful to: IT, Guest services teams, Sales & Marketing

< Back

AireOS/Catalyst

Please complete the following pre-requisites for access to OpenRoaming

Step 1: Complete Cisco Spaces Onboarding Process

Have an account provisioned on the Cisco Spaces platform. If you don’t have an active account, please email spaces@cisco.com
Create user account – Accept invitation from Cisco Spaces & setup password
Set up a Cisco Spaces Connector:
https://www.cisco.com/c/en/us/td/docs/wireless/cisco-dna-spaces/connector/b_connector.html
Setup your Location Hierarchy using the best practices guide:
https://spaces.cisco.com/setupguide/location-hierarchy/

Step 2: Complete OpenRoaming Hotspot configuration

Step 2a: Configure Cisco Spaces Connector and add Cisco AireOS WLC to Cisco Spaces

OpenRoaming leverages the Cisco Spaces Connector

Configure the Cisco Spaces Connector (As in Step 1).
Go to Cisco Spaces Dashboard and go into Setup > Wireless Networks.
Choose Wireless Setup and Connect via Spaces Connector.
The Cisco Spaces Connector will be listed under View Connector (Created as in Step 1).
Under Connect via Spaces Connector > Add Controller, click Add Controllers.
In the Add Connector Window, select the required Spaces Connector.
Enter the IP Address and name of the AireOS controller.
Set Controller Type to WLC (AireOS).
Select the required Controller SNMP Version and enter the necessary credentials.
Click Save & Close.
The added controller will be listed under View Controllers.

Step 2b: Configure and activate OpenRoaming

Go to OpenRoaming app within Cisco Spaces Dashboard.
Click on the Hamburger menu and go to Setup.
Click on Create OpenRoaming Profile to configure a new OpenRoaming Hotspot profile.
Click on Enable Hotspot for Connector(s) to enable OpenRoaming Hotspot Connector on the configured connector.
Select the connector where the Hotspot Connector needs to be activated.
Copy the token and paste it in the Cisco Spaces Connector running in the network.

Step 2c: Configure 802.11u on the SSID

The configuration can be done manually on the respective controllers OR the configuration provided in the Cisco Spaces Setup Page can be used.

Go to OpenRoaming app within Cisco Spaces Dashboard.
Click on the Hamburger menu and go to Setup.
Select the required Wireless LAN Controller.
Select the required OpenRoaming Hotspot profile and click Continue.
Provide the WLAN-Id based on the controller chosen.
Configuration is generated based on the input.
Copy the configuration and paste it in the CLI.

Step 2d: To do this manually, configure the connector as a AAA Authentication and Accounting target on the AireOS WLC

Procedure for AAA Authentication:

Log into the Wireless Lan Controller.
Go to the Security Menu and select AAA > RADIUS > Authentication. Click New.
In the Add a AAA server page:
- Set Network User to Enable.
- Set Management to Disable.
- Set the Server Address to the IP address of the Cisco Spaces Connector.
- Set the port to 1812.
- Set the Shared Secret to radsec.
- Set Auth Called Station ID Type to AP MAC Address SSID.

Procedure for AAA Accounting:

Go to the Security Menu and select AAA > RADIUS > Accounting. Click New.
In the Add a AAA server page:
1. Set Network User to Enable.
2. Set Tunnel Proxy to Disable.
3. Set the Server Address to the IP address of the Cisco Spaces Connector.
4. Set the port to 1813.
5. Set the Shared Secret to radsec.
6. Set Acct Called Station ID Type to AP MAC Address SSID.

Step 2e: OpenRoaming SSID on the AireOS WLC

Log into the Wireless Lan Controller and go to WLANs menu.
Select WLANs and click create New.
In WLAN-Edit General Tab, set the status to Enabled.
In the Security/Layer2 tab:
1. Configure the required Layer 2 security and encryption.
2. Set Authentication Key Management to 802.1x.
In the Security/AAA servers tab, select the IP address of the OpenRoaming Hotspot Connector for both authentication and accounting.

Step 3: Carrier offload or Cisco Spaces SDK integration

Contact carrier-offload-or@cisco.com to setup carrier offload
To set up Cisco Spaces SDK, visit our setup guide for step-by-step instructions: https://spaces.cisco.com/setupguide/feature-spaces-sdk/#prerequisites

Please complete the following pre-requisites for access to OpenRoaming

Step 1: Complete Cisco Spaces Onboarding Process

Have an account provisioned on the Cisco Spaces platform. If you don’t have an active account, please email spaces@cisco.com
Create user account – Accept invitation from Cisco Spaces & setup password
Set up a Cisco Spaces Connector:
https://www.cisco.com/c/en/us/td/docs/wireless/cisco-dna-spaces/connector/b_connector.html
Setup your Location Hierarchy using the best practices guide:
https://spaces.cisco.com/setupguide/location-hierarchy/

Step 2: Complete OpenRoaming Hotspot configuration

Step 2a: Configure Cisco Spaces Connector and add Cisco Catalyst 9800 to Cisco Spaces

OpenRoaming leverages the Cisco Spaces Connector

Configure the Cisco Spaces Connector (As in Step 1).
Go to Cisco Spaces Dashboard and go into Setup > Wireless Networks.
Choose Wireless Setup and Connect via Spaces Connector.
The Cisco Spaces Connector will be listed under View Connector (Created as in Step 1).
Under Connect via Spaces Connector > Add Controller, click Add Controllers.
In the Add Connector Window, select the required Spaces Connector.
Enter the IP Address and name of the Catalyst 9800.
Set Controller Type to Catalyst WLC / Catalyst 9800.
Enter the credentials for the controller.
Click Save & Close.
The added controller will be listed under View Controllers.

Step 2b: Configure and activate OpenRoaming

Go to OpenRoaming app within Cisco Spaces Dashboard.
Click on the Hamburger menu and go to Setup.
Click on Create OpenRoaming Profile to configure a new OpenRoaming Hotspot profile.
Click on Enable Hotspot for Connector(s) to enable OpenRoaming Hotspot Connector on the configured connector.
Select the connector where the Hotspot Connector needs to be activated.
Copy the token and paste it in the Cisco Spaces Connector running in the network.

Step 2c: Configure the OpenRoaming Hotspot ANQP Server on the Controller

The configuration can be done manually on the 9800 or the configuration provided in the Cisco Spaces Setup Page can be used.

Configuration via Cisco Spaces

Go to OpenRoaming app within Cisco Spaces Dashboard.
Click on the Hamburger menu and go to Setup.
Select the required Wireless LAN Controller.
Select the required OpenRoaming Hotspot profile and click Continue.
Provide the WLAN name based on the controller chosen.
Select the either Catalyst: (17.2.1/17.3.1) (for IOS XE versions 17.2.1 or later) or Catalyst: (16.12.1/17.1.1) (for IOS XE versions earlier than 17.2.1)
Configuration is generated based on the input.
Copy the configuration and paste it in the CLI.

Note: The generated configuration assumes the default Wireless Policy Profile and Policy Tag will be used. If using a different Wireless Policy Profile and Policy Tag, copy only the OpenRoaming HotSpot ANQP server.

Manual Configuration via 9800 WebUI

Log into the 9800 WebUI.
Go to Configuration > Wireless > Hotspot/OpenRoaming.
In the ANQP Servers tab, click Add.
Enter a name for the server and check the box OpenRoaming. This will auto populate the settings with internet access enabled, network type as Chargeable Public, and the NAI Realms.
Edit the Network Type, NAI Realms, and Domains if necessary.
Select the required OpenRoaming Organization Identifier (OI) by clicking the blue arrow to move them to the Assigned ROI box. Enable the beacons by checking the box next to each Roaming OI.
Click Apply to Device.

Step 2d: Enable OpenRoaming for the SSID

This step can be skipped if using the generated configuration from Cisco Spaces as well as the default Wireless Policy Profile and Policy Tag.

1. Apply the OpenRoaming Hotspot ANQP Server to the Wireless Policy Profile

Go to the WebUI of the Catalyst 9800.
Go to Configuration > Tags & Profiles > Policy.
Select the required Wireless Policy Profile.
In the Advanced tab, select the created Hotspot Server.
Click Update & Apply to Device.

2. Map the OpenRoaming WLAN Profile and Wireless Policy Profile in the Policy Tag

Go to Configuration > Tags & Profiles > Tags.
In the Policy tab, click Add.
Under WLAN-POLICY Maps, click Add.
Select the OpenRoaming WLAN Profile and Wireless Policy Profile and click the checkbox to save the mapping.
Click Apply to Device.

Step 2e: To do this manually, configure the connector as a AAA target on the Catalyst 9800

1. Log into the 9800 WebUI and go to Configuration > Security > AAA.

2. Under Servers / Groups, create a RADIUS Server and Server Group.

Procedure for AAA Authentication

Click on Add to create the RADIUS Server.
Provide a name to server.
Set the Server Address to the IP Address of the Cisco Spaces Connector and the Key to radsec.
Click Apply to Device.
Select Server Groups tab and click Add.
Provide a name to server group.
Set MAC-Delimiter to hyphen and add the created RADIUS server to the group.
Click Apply to Device.

3. Now create a AAA Method List for Authentication, Authorization and Accounting

a. Select Authentication option and click Add.

Provide a method list name.
Set Type to dot1x.
Set Group Type to group.
Select the server group created in previous step.

b. Now select Authorization option and click Add.

Provide a method list name.
Set Type to exec.
Set Group Type to group.
Select the server group created in previous step.

c. Now select Accounting option and click Add.

Provide a method list name.
Set Type to identity.
Select the server group created in previous step.

4. Under AAA Advanced Tab

Go to Global Config > Show Advanced Settings.
For Called-Station-id, select ap-macaddress-ssid for both Accounting and Authentication.
Click Apply.

Step 2f: Configure the OpenRoaming WLAN Profile and Wireless Policy Profile

Configure the WLAN Profile

Log into the 9800 WebUI and go to Configuration > Tags & Profiles > WLANs.
Click Add to create a new WLAN.
In the General tab:
- Set a name for the WLAN
- Set the status to Enabled.
In the Security/Layer2 tab:
- Select the required Layer 2 security mode and encryption.
- Set Authentication Key Management to 802.1x.
In the Security/AAA tab, set the Authentication List to the AAA Authentication Method List containing the Hotspot Connector.
Click Apply to Device.

Configure the Wireless Policy Profile

Go to Configuration > Tags & Profiles > Policy.
Select the required Wireless Policy Profile or click Add to create a new one.
In the Advanced tab, set the Accounting List to the AAA Accounting Method List containing the Hotspot Connector.
Apply the new settings to the device.

Step 3: Carrier offload or Cisco Spaces SDK integration

Contact carrier-offload-or@cisco.com to setup carrier offload
To set up Cisco Spaces SDK, visit our setup guide for step-by-step instructions: https://spaces.cisco.com/setupguide/feature-spaces-sdk/#prerequisites

Please complete the following pre-requisites for Configuring Meraki OpenRoaming

Step 1: Ensure you have an active Cisco Spaces account

Have an account provisioned on the Cisco Spaces platform. If you don’t have an active account, please email spaces@cisco.com
Create user account – Accept invitation from Cisco Spaces & setup password
It is recommended that you create a Spaces services account for the connection to Spaces via API

Step 2: Configure Cisco Spaces Wireless Network Setup

To configure the Wireless Setup in Cisco Spaces Dashboard, follow the below steps:
- Login to Cisco Spaces Dashboard https://dnaspaces.io/
- Go to Setup > Wireless Networks
- On Connect your wireless network, click “Connect” under Connect your Meraki
- Click Import Organization Using API
  - a. Login to your Meraki dashboard, click on the logged-in account name (top-right), and click My profile. Scroll down to the API Access section. Click Generate to generate an API Key.
- Back in Cisco Spaces Dashboard enter your Meraki API key in the API Key textbox.
- Click Connect
- Select your Organization and click on Add to import it in Cisco Spaces
- On the Location Hierarchy page, expand the More Actions menu
- Click Add Network to view the Add Network window
- Select your Network and click Add to import it into Cisco Spaces

Step 3: Configure OpenRoaming SSID in the Cisco Spaces Dashboard

To configure OpenRoaming in Cisco Meraki, follow the below steps:
- Click on the OpenRoaming tile in Cisco Spaces UI
- Create an OpenRoaming profile with the required configuration
- Follow the steps shown by the Cisco Spaces UI to create an OpenRoaming profile
- Select the SSID which needs to be configured for OpenRoaming. If you want to create a new SSID then enter the name of the SSID and Cisco Spaces will create and configure the SSID for OpenRoaming
- After following all the steps an OpenRoaming profile will be created by DNAS Spaces. Activate this profile on the required Dashboard network

If all the steps are followed correctly the status of OpenRoaming will change to Active and Cisco Meraki APs will start broadcasting the configured SSID for OpenRoaming.

For a detailed step by step process of configuring refer to Cisco Spaces OpenRoaming configuration document at https://www.cisco.com/c/en/us/td/docs/wireless/cisco-dna-spaces/open-roaming/b-dnas-or-cg/m-config-or.html

Please take a moment to check if you’re able to successfully setup the app. Click on ‘yes’ to indicate it’s working. And on ‘Not yet’ if you need any assistance.