OpenRoaming integration with Cisco Spaces

Introduction 

Mobile device users across the globe wish to stay constantly connected to the Internet across locations and geographies. Be it when entering an airport, coffee shop, a retail store, hotel, workspaces, or any other location, users wish to be connected to the Internet all the time, quickly, and without tedious onboarding processes. Today this is difficult due to the availability of multiple SSIDs that display poorly designed captive portals, the risks of connecting to a rogue SSID, or entering an insecure shared username and password combination to access the Internet. These annoyances often force users to stay on cellular networks and use up precious data and sometimes having no coverage at all. OpenRoaming provides a solution to these issues. 

OpenRoaming provides mobile users with a hassle-free, friction-less, guest Wi-Fi onboarding experience by linking together Access Providers (such as public venues, retailers, airports, and large enterprises) with Identity Providers (such as service provider carriers, devices, and cloud providers). OpenRoaming enables users to get connected online automatically and seamlessly after signing in just once using a trusted identity provider. The service is completely secure and fast, and mobile users need not have to guess which Wi-Fi network to use or use tedious captive portal onboarding processes repeatedly. Mobile users will automatically and seamlessly get connected to the Internet wherever they go, thereby allowing them to download, stream, video chat, play online games, and access the Internet whenever and wherever they are. 

By leveraging the power of the Hotspot 2.0 technology and the global, unprecedented reach of Cisco’s network, OpenRoaming will allow any on-premise visitor/ customer to seamlessly and securely get connected to the Internet and roam freely across 4G/5G and Wi-Fi 6 networks. The OpenRoaming Federation consists of Identity Providers such as Service Providers (leveraging your SIM card), device and cloud providers (such as Google and Apple ID), and Internet Wi-Fi providers. Access Providers such as retailers, hotels, and large venues to enable customers to automatically and seamlessly get connected to the Internet. This Wi-Fi connection is secured using industry-standard Wi-Fi Protected Access 2 (WPA2) protocols and encrypted authentication. Every network that users connect to will provide a seamless and secure experience, with a verified quality of experience, to help ensure that they are receiving the best and the most trusted Internet connectivity possible. 

For example: If you run a retail or other public-access location, you will have the ability to accelerate your guest Wi-Fi attach rate at the click of a button. The amount of data you can gather about how people use your physical spaces can be leveraged with Cisco Spaces to help you better understand and identify your consumers’ behavior patterns, thereby creating an improved experience at your store and at the same time driving your business outcomes. Your customers will appreciate the better experience and you will be able to better engage with them. 

Key Benefits 

There are several benefits that businesses can gain from leveraging OpenRoaming.

• Simplify Wi-Fi guest access for your customers on-site

• Significantly increase your Wi-Fi attach rate on site

• Increased security for Wi-Fi guest access

• Provide a better user experience in your venue, by providing seamless connectivity to Wi-Fi and seamless roaming between Wi-Fi and LTE / 5G

• Take back ownership of your customers’ data through Wi-Fi, and get more valuable analytics

• Better engage with your customers through Wi-Fi, Cisco Spaces, and your loyalty app

• Offload traffic from cellular to Wi-Fi, reducing operational expenses. 

Common Deployment Scenarios 

Architecture for OpenRoaming - New!

We are introducing a significantly enhanced architecture for OpenRoaming on Cisco Meraki MR access points. Moving away from the previous proxy-based implementation, this new approach leverages RADSec (RADIUS over TLS) for a more direct, secure, and scalable connection. 

Instead of relying on a central cloud-to-cloud proxy, each Meraki MR Access Point now establishes a dedicated, encrypted RADSec tunnel directly to the RADIUS server endpoint integrated with Cisco Spaces. This per-device tunnel architecture provides the following advantages: 

• Easier Configuration from Spaces Dashboard 

• Improved Performance & Security: RADSec tunnels replace cloud proxy - reduces the number of hoops for authentication, reducing time to connect significantly, allowing: 

• Scalability 

• Seamless inter AP roaming  

• Secure accounting packets from APs 

• Visibility: Troubleshooting and visibility will be enhanced as we have less hops before reaching to Spaces connector 

• Serviceability: Improved tools for troubleshooting/support available with Spaces/Meraki support teams enabled via APIs 

• Reporting: Enables accounting packets for OpenRoaming Statistics: No' of onboarded devices – New/Repeat, Avg. Visit Duration, Devices by IDP, Data consumed per user etc 

This new architecture streamlines configuration, improves troubleshooting visibility, and delivers a more robust foundation for seamless OpenRoaming deployments. 

Pre-requisites for Configuring Meraki OpenRoaming

1. Ensure you have an active Cisco Spaces account. 

2. Complete your Wireless Network Setup in the Cisco Spaces Dashboard. This should be done by initiating the Meraki Spaces integration from the Cisco Spaces. 

3. Meraki APs should have the right firmware version installed. The following minimum versions are required based on AP models:

Client Examples 

Basic Troubleshooting