Cisco Spaces OpenRoaming Runbook (Cisco Validated)

OVERVIEW

With the standard expectation of users to always be connected to the internet no matter where they are, it is paramount that users can be connected securely and seamlessly. Wi-Fi onboarding allows users a frictionless onboarding experience and a seamless handover when roaming between cellular and Wi-Fi.

OpenRoaming enables secure, seamless, and automatic network connectivity by eliminating tedious Wi-Fi guest onboarding processes and the risk of connecting to rogue SSIDs. This is especially helpful for a mobile device user trying to access the internet because OpenRoaming removes the need to choose between multiple SSIDs, or enter insecure, shared credentials on poorly designed captive portals.

This runbook will look at OpenRoaming to onboard customers. For information about integrating with Carrier Offload with Partner Apps (such as AT&T Auto-Attach), please refer to the Knowledge Article: Carrier Offload with a Partner App (AT&T Auto-Attach)

SUPPORT AND ONBOARDING

Please follow the link below to find out about the different ways to get support for Cisco Spaces.

Support Info Link

PREREQUISITES

Namely, OpenRoaming requires the following prerequisites met:

• An active Cisco Spaces account.

• A Cisco wireless network. Both controller-based (Cisco AireOS or Cisco Catalyst wireless controller) and cloud-based (Cisco Meraki) networks are supported.

• Add the wireless network to your Cisco Spaces account.

  • For controller-based architecture, the Cisco Spaces Connector must be used.

  • For Cisco Meraki networks, add the Cisco Meraki account to your Cisco Spaces account.

OpenRoaming Prerequisites

Network Components

¹ Embedded Wireless Controller (EWC) on Catalyst 9100 and the Embedded Wireless on Catalyst 9000 switches are NOT supported.

² Cannot be configured with HTTP/HTTPS proxy enabled.

• See WLC release notes for supported APs per release

OpenRoaming Client Matrix

OpenRoaming Firewall Rules

In addition to ports opened to allow basic functionality, OpenRoaming will require a security policy configured on the network firewall to allow inbound traffic. By default, all inbound traffic is disallowed.

Connector based deployments

Refer to the table below for all the required Firewall Rules for Open Roaming:

Source IP Address	Destination IP Address	Direction	Transport	Source Port	Destination Port	Protocol	Further Information
Cisco AireOS Wireless Controller IP address	Connector	Unidirectional	UDP and TCP	Any	1812, 1813	Remote Authentication Dial-In User Service (RADIUS)	Communication between Connector and Cisco AireOS Wireless Controller for OpenRoaming client’s RADIUS messages.
Connector	Any	Unidirectional	TCP	Any	2083	RADIUS over TLS (RADSEC)	Communication between Connector and OpenRoaming Identity Providers
Connector	Any	Unidirectional	TCP	Any	443		HTTPS for CSR signing - OpenRoaming Membership

IMPLEMENTATION

With the prerequisites covered, implementing OpenRoaming requires four main steps:

1. Create an OpenRoaming Profile

2. Enable Hotspot Connector

3. Configure Network Controller

4. Configure the OpenRoaming SSID

Each of the main steps will be discussed.

Create an OpenRoaming Profile

An OpenRoaming profile contains information about the network SSID and specifies which user identities are allowed to access the guest network. You can also configure carrier offload in the OpenRoaming profile.

To create an OpenRoaming profile, the following substeps need to be performed:

Substep 1: Set Access Policy

Substep 2: Configure an SSID

Substep 3 (Optional): Configure Carrier Offload

Substep 4: Review and Confirm Settings

Click here for a video guided demo

Set Access Policy

Set your policy on who can access your OpenRoaming network.

1. Go to OpenRoaming app within Cisco Spaces Dashboard.​
   

   

Or alternatively, through the side-menu by clicking the Dashboard drag-down.

2. Click on Setup.​ If this is the first time that you are setting up OpenRoaming, when you click Setup, a Terms and Conditions dialog box is displayed. Click I Agree to proceed.

3. In the OpenRoaming Profiles section, click Create OpenRoaming Profile.

The Create an OpenRoaming Profile configuration wizard is displayed.

4. Click Proceed.

5. Under Access Policy, specify who can access your OpenRoaming network. Select the types of identities that can access the OpenRoaming network as well as if real identities are required.

The options available are:

i) Accept all authenticated users: This is the default option.

ii) Accept only users who provide their identity: An example of an accepted identity is a real identity, such as an email ID.

iii) Accept users with specified identity types: Choose the desired identity types from the list that is displayed. Enable the Require real identity knob if you want users to enter their real identities. The identity types chosen here is displayed adjacent to their real or anonymous identity settings, in a table next to this list.

iv) Accept only your users: If you choose this option, you will need to be added as an identity provider.

6. Under Preferred Credentials, choose the desired option from those listed below by clicking the corresponding radio button. This option will set your policy on who can access your OpenRoaming network:

i) I do not have preferred credentials

ii) I have preferred credentials, which I want to use: If you choose this option, you must select a domain from the list of domains that are displayed or click Add a Custom Domain.

7. Click Continue.

The SSID Details window is displayed.

Configure an SSID

Enter the SSID details for this OpenRoaming Profile - this is a secure SSID different from your guest SSID.

1. In the SSID Details section, enter the SSID name in the corresponding field. This is the SSID that will be broadcast for OpenRoaming.

2. (Optional) In the Advanced section, you can choose among the following options by clicking the corresponding radio button:

i) Default Status: Choose between Enable or Disable by clicking the corresponding radio button. The default option is Enable.

ii) Fast Transition (802.11r): Choose between Adaptive, Enable or Disable by clicking the corresponding radio button. The default option is Adaptive.

The Create an OpenRoaming Profile configuration wizard is displayed.

3. Click Next.

The Carrier Offload window is displayed.

Configure Carrier Offload (Optional)

Configure Carrier Offload (Optional)

You can leverage your Wi-Fi network to provide voice and data services to mobile carrier subscribers on your Wi-Fi network. This configuration is optional.

Ensure that the Settlement Provider is already configured previously. See below.

Before you configure carrier offload, ensure that the following prerequisites are in place:

• You must have an existing relationship with a mobile carrier or service provider.

• You must have configured the settlement provider with the mobile carrier or service provider.

1. Use the Allow Carrier Offload knob to enable the Carrier Offload settings.

A table listing the various carriers, along with their corresponding details such as the Offloading Partner, Static Routing, Realms, and MNC/MCC settings, is displayed.

2. Based on your existing relationships with various carriers, you can either select from the carriers that are available in the table or click Add Custom Carrier to add carriers of your choice.

If you have not configured a carrier, or if you click Add Custom Carrier, you must visit the Cisco Spaces Partner App Center to first activate the offloading partner. Contact your carrier offloading partner for specific information that has to be entered in the custom fields. As an example, refer to Knowledge Article: Carrier Offload with a Partner App (AT&T Auto-Attach).

If AT&T is selected as the carrier for Carrier Offload, the dashboard will alert that you must activate this option explicitly through the AT&T Auto-Attach Partner app. This alert has been added since AT&T has mandated that all customers must activate their partner app before they began accepting AT&T users at the venue.

Refer to Knowledge Article: Carrier Offload with a Partner App (AT&T Auto-Attach) for more information about activation.

3. Click Next.

The Review Your Configuration window is displayed.

Review and Confirm Settings

Review and confirm the OpenRoaming profile configuration.

After you have configured the access policy, SSID, and the optional carrier offload, you can review your OpenRoaming profile configuration and modify it if required before saving these settings.

1. In the Review Your Configuration window, verify the settings and do one of the following:

i) If you are satisfied with the configuration, proceed with the next step by clicking Done.

ii) If you have to make changes, click the Edit link next to the section whose configuration has to be modified and make changes. Continue to click Next until you arrive at the Review Your Configuration window. On successful modification of the OpenRoaming Profile configuration, proceed with the next step by clicking Done.

2. Click Done to complete the creation of the OpenRoaming profile.

A success message appears briefly, and a confirmation window is displayed.

Enable Hotspot Connector

Enable a Hotspot on the Cisco Spaces Connector (Cisco AireOS or Cisco Catalyst Network)

Enable a Hotspot on the Cisco Spaces Connector (Cisco AireOS or Cisco Catalyst Network)

This step will allow you to enable a Hotspot on the Cisco Spaces Connector for Cisco AireOS or Cisco Catalyst Network. This is needed to add OpenRoaming functionality.

When you add a hotspot on the Cisco Spaces Connector, it leads to the installation of a new docker. You can enable a hotspot on the Cisco Spaces Connector either during the initial configuration of the connector or later using the procedure outlined here.

A Cisco Spaces Connector should already have been configured by following the prerequisite Spaces OS runbook. In which case, you can see it listed in the Hotspot-enabled Connectors section on the OpenRoaming Setup window.

Enable Hotspot on Cisco Spaces Connector 3.x

1. In section 2, if you do not already have a connector that is hotpot enabled, you will see the following. If you already have enabled your connector for hotspot, you can move onto Configure Network. Ensure the connector you want to use has hotspot enabled.

   

2. In the Cisco Spaces dashboard left navigation pane, click Setup and choose Wireless Networks.

3. In the Connect your wireless network window that is displayed, go to the Step 2 area and click View Connectors.
   

   

4. Click the name of the connector you want to enable, then in the window that is displayed, click Add Services.
   

   

5. In the Add Service window that is displayed, choose hotspot and click Add.

In Services, Service Manager is added by default.

In the Connector Details window, you can see that the number of services enabled has increased.

Validate Meraki API integration

Validate Meraki API Integration

In this section we should ensure the Meraki API integration is valid and active before proceeding to configure network.

1. Under 2.Hotspot-enabled Connectors, open the Meraki API tab.

2. Ensure you see a green tick as validation the API connection is active.

   

   
   

3. If you see a Set Up button, that means the Meraki Integration is not active. You should follow the Set Up link, and configure your Meraki Integration before proceeding. See https://runbooks.ciscospaces.io/docs/cisco-spaces-os-runbook-cisco-validated#Meraki-Wireless for more details.
   

It is reccomended to use the Meraki Integration over the Meraki API method

Configure Network

Depending on your wireless network, follow the corresponding procedure to associate an OpenRoaming profile with the controller and configure the network:

Configure Cisco AireOS or Cisco Catalyst Network

Configure Cisco AireOS or Cisco Catalyst Network

Before you configure the Cisco AireOS or Cisco Catalyst wireless network, you must configure the SSID and AAA policy.

1. In the OpenRoaming app, click Set Up OpenRoaming or choose > Setup.

The OpenRoaming Setup page is displayed.

If you have completed the OpenRoaming Profile configuration, click Continue OR Setup in the configuration wizard to proceed.

In the Network configuration section, under the AireOS/Catalyst controllers tab, a list of all the Cisco AireOS and Cisco Catalyst series controllers appears with details such as the Controller status and associated Connectors.

2. Under 3. Network configuration > Cisco Wireless, in the Action column, click the 3 dots, click Configure Controller corresponding to the controller you want to configure.

   The Configure Controller window is displayed.

3. Choose the required OpenRoaming Profile for this controller, then click Continue.

   

4. Choose the controller type between AireOS and Catalyst 9800.
   

   

5. In the Connector IP Address field, enter the IP Address of the connector if not automatically filled.

6. The WLAN Name will be automatically filled as per the SSID Name configured in the chosen OpenRoaming Profile. To edit this, you must edit the OpenRoaming Profile.

7. Click Show Configuration.

8. Select the either Catalyst: (17.2.1/17.3.1) (for IOS XE versions 17.2.1 or later) or Catalyst: (16.12.1/17.1.1) (for IOS XE versions earlier than 17.2.1)​

9. The generated CLI configuration is for the Hotspot OpenRoaming ANQP server. Copy the configuration.
   

It is always important to review generated configuration, and make sure you are comfortable and understand the configuration.

The generated configuration assumes the default Wireless Policy Profile and Policy Tag will be used. In deployments with the defaults being used, the entire configuration can be used.
Otherwise, if using a different Wireless Policy Profile and Policy Tag, copy only the OpenRoaming HotSpot ANQP server settings as highlighted below.

10. Paste the selected OpenRoaming profile configuration in the Cisco AireOS or Catalyst controller CLI.

11. Click Close.

    The OpenRoaming Setup window is displayed.

To configure the ANQP server manually on the 9800 Controller or to use non-default Wireless Policy profile and Policy Tag, refer to this video: https://www.youtube.com/watch?v=XsD6e6F6u4k

Configure Cisco Meraki Network

Configure Cisco Meraki Network

Configuration of Cisco Meraki networks that use templates is not supported.

1. In the OpenRoaming window, click Set Up OpenRoaming or choose > Setup.

The OpenRoaming Setup page is displayed.

2. In the 3. Network configuration section, click the Meraki Networks tab.

3. Click Configure meraki network(s) for openroaming profile.
   

   

The Configure OpenRoaming for Meraki window is displayed.

For information on configuring a Cisco Meraki network, go to the Cisco Spaces Configuration Guide.

4. Choose an Organization from the drop-down list.

5. Choose the Cisco Meraki networks for which you want to enable OpenRoaming. This step is not service affecting for the existing SSID(s).

   

You can select multiple networks from the list.

7. Click Next.

8. From the drop-down list, select the OpenRoaming profile that needs to be applied on the Cisco Meraki network.

   

9. Click Configure.

The Configure button will configure the chosen Meraki Networks, with a new SSID, as created in the OpenRoaming Profile.

10. To validate this, go to https://meraki.cisco.com

11. Log in to the application using the login credentials of your Cisco Meraki account.

12. Click the required Cisco Meraki Organization, and choose the required network.

13. Choose Wireless > Configure > SSID and verify, the SSID you created in the OpenRoaming Profile, was created successfully and is enabled.

    
    

14. Choose edit settings and ensure the following details are configured

    1. SSID: Enabled

    2. Security: Enterprise with my RADIUS server

    3. Encryption: WPA2 or WPA3

    4. Splash Page: None (direct access)

    5. Radius Servers are configured

Some clients might refuse to connect to SSIDs using OpenRoaming when configured with weak encryption methods (e.g., WPA1 or 'WPA1 and WPA2'). Please ensure the SSIDs are configured with strong encryption, such as 'WPA2 Only' or 'WPA3', under Wireless > Configure > Access Control, in the 'WPA encryption' section.

17. Optionally configure VLAN tagging in the Client IP and VLAN settings if required on your network

9. Navigate to Wireless > Hotspot 2.0 to ensure Hotspot 2.0 is enabled.

10. This completes the Meraki Dashboard OpenRoaming configuration. Continue with OpenRoaming configuration on Cisco Spaces: https://runbooks.ciscospaces.io/docs/cisco-spaces-openroaming-runbook-cisco-validated#CiscoSpacesOpenRoamingRunbook(CiscoValidated)-CreateanOpenRoamingProfile

Check Activation

Check the OpenRoaming activation status on Cisco Spaces dashboard:

If using Meraki, you can check client connection by navigating to Network-wide > Clients. Check the device is connected.

You can also validate the API calls were made from Space to Meraki to complete the activation in Organization > Monitor > Change Log

Test Your OpenRoaming Network

You can test your OpenRoaming network configuration through the following methods:

• Cloud/Social: To use this method, download the OpenRoaming mobile app from the iOS App Store or Google Play Store to your mobile device.

• Device Manufacturer: Use this method to test your OpenRoaming network natively on a Samsung or Google mobile device.

• Other Methods: In addition to the above two methods, you can also test your OpenRoaming network using the following two options:

  • Carrier Offload: If you have set up a Carrier Offload solution, a mobile phone from the supported carrier will automatically get attached to your OpenRoaming network.

  • Cisco Spaces SDK: If you have integrated your brand’s mobile app with Cisco Spaces SDK, a mobile phone with your mobile app will automatically get attached to your OpenRoaming network.

  For more information about Cisco Spaces SDK, see Knowledge Article: https://runbooks.ciscospaces.io/docs/openroaming-cisco-spaces-sdk-integration & Developer Docs: https://developer.cisco.com/docs/dna-spaces-sdk/. Log in using your Cisco credentials, if prompted.

View OpenRoaming Reports

To view your OpenRoaming reports, click > Home.

The following reports are available in the OpenRoaming dashboard:

• Unique Devices

• Devices by IDP

• Devices by Manufacturer

• Data Usage

• Average Visit Duration

• Data Consumed per User

• Connections per Day

• Connections per Hour

APPENDIX

Enable Hotspot on Cisco Spaces Connector 2.x

Click here for a video guided demo [From 2:35min]

1. In the OpenRoaming window, click Set Up OpenRoaming or choose > Setup.

The OpenRoaming Setup window is displayed.

A list of all the Cisco Spaces Connectors, along with their status is displayed in the Hotspot-enabled Connectors section.

2. Under the AireOS/Catalyst tab, click the Enable Hotspot for Connector(s) link.

   The OpenRoaming - Add Hotspot window is displayed.

3. Select the Cisco Spaces Connector for which you want to enable the hotspot and click Continue.

4. A token is generated, and a Hotspot created successfully message is displayed. This token is used by the Cisco Spaces Connector to download the hotspot connector container.

5. Under Token Generated, click Copy.

6. Go to the web interface for the Cisco Spaces Connector

7. Click the Gear Icon and select Configure Token

8. Paste this token in the Configure Token window of the Cisco Spaces Connector GUI.

9. Click Save.

The Connector will then download and install the Hotspot Connector image.

10. Refresh the OpenRoaming Setup window.

The new hotspot-enabled connector is now displayed in the listing in the Hotspot-enabled Connectors section. In the Hotspot tab, verify the status of the hotspot-enabled Connector. If the status is Running , it indicates that the OpenRoaming hotspot has been successfully enabled for the Cisco Spaces Connector.

REFERENCE

For more information about OpenRoaming in a Cisco Spaces setup, see the following documents:

• Cisco Spaces OpenRoaming Setup Guide

• Cisco Spaces Connector Configuration Guide

• Cisco Spaces Configuration Guide

For all Cisco Spaces documentation, see:

https://www.cisco.com/c/en/us/support/wireless/dna-spaces/series.html