Aruba Instant On Captive Portal Setup: A Practical Guide

You bought Aruba Instant On because it is the sensible small-business choice: clean hardware, a phone app that does the setup for you, no controller box humming in a cupboard. Then a guest asks for the WiFi password, and you think, surely I can put a little branded sign-in screen in front of that. You open the app, find the guest network settings, and yes, there is a splash page. You add your logo, pick a colour, save. Done.

Except it is not done, not if your actual goal was to build a marketing list or earn more Google reviews. The built-in page will greet a guest and make them tick a box. It will not ask for their email, and even if it did, it has nowhere to put it. That gap is the whole point of this guide. We will walk through what Instant On's own portal genuinely does, where it stops, and how you bridge the gap with an external captive portal without ripping out a single access point.

For the record: CaptiFi is a guest-WiFi marketing platform, not a hardware vendor. We do not sell or ship Aruba kit. We layer a branded portal, consented email capture and review automation on top of the network you already run. Aruba is on our supported hardware list alongside UniFi, Omada, Meraki, MikroTik and others.

What Aruba Instant On actually is

First, a distinction that trips up half the setup guides on the internet. "Aruba Instant On" is not the same product as "Aruba Instant". They sound nearly identical and they behave very differently.

Instant On is the cloud-managed small-business line. It is built for places without a full-time IT person: a cafe, a salon, a two-room B and B. You manage it entirely through the Instant On mobile app or the web portal, with no on-site controller. According to HPE's own product material, a single Instant On site supports up to 25 access points and 150 users, with around 150 sites per account and a recommended ceiling of roughly 75 users per site. The setup is zero-touch: scan the AP, it provisions itself.

"Aruba Instant" (no "On") and Aruba Central are the enterprise ArubaOS lines, aimed at much larger, heavily managed networks with dedicated staff. They have features Instant On simply does not, including native social login on the captive portal. That difference matters later, so hold onto it. One more thing worth knowing: as of 2026 the Instant On product line is reportedly being divested under a US Department of Justice mandate, so its long-term ownership is uncertain. The hardware on your wall keeps working regardless.

What the built-in guest portal can do

Instant On's internal guest portal is genuinely useful for the basics. Per the official HPE "Configuring Guest Portal" documentation, it offers two internal page types:

• Internal - Authenticated: the guest enters credentials for an account you have already created in the user database. This suits a members-only or staff scenario, not walk-in guests.
• Internal - Acknowledged: the classic clickthrough screen. The guest accepts your terms and conditions, then gets online. No password, no account.

The internal splash page is customisable from the guest network settings. You can add a logo and adjust the design, so it looks like your venue rather than a generic Aruba screen. For a pub that just wants a tidy "tap here to accept and connect" page, this is perfectly fine. It is fast to set up and it costs nothing extra.

The built-in Instant On portal answers one question well: "will the guest accept my terms before going online?" It was never designed to answer "who is this guest, and how do I reach them again?"

Where the built-in portal stops

Here is the honest part. The Instant On internal portal has three hard limits that no amount of fiddling in the app will solve.

It does not capture email. The "Internal - Acknowledged" page is a terms screen, not a sign-up form. There is no field that collects a guest's email address, and crucially no database behind it to store one or any way to send a follow-up message. You get a connection, not a contact.

It has no native social login. This is the big one people get wrong. Instant On's built-in portal offers only the two internal types above. Facebook or Google sign-in is not a native Instant On feature. As Social WiFi's own integration guide puts it plainly, there is "no native social login capability within Instant On itself". Social login on captive portals belongs to the separate enterprise Aruba Instant and Aruba Central platforms, not to Instant On. If you read a guide claiming Instant On does Facebook login out of the box, it has confused the two products.

It does no marketing. No welcome email, no win-back, no review request, no birthday offer, no analytics on who came back. That is simply outside what a network splash page is for.

How an external captive portal adds email capture

This is where Instant On opens a door. The official documentation confirms it supports an external captive portal: "Select this splash page to use an external portal on the cloud or on a server outside the enterprise network for authentication." In the guest network config you pick "External - RADIUS Server" from the splash page drop-down. The Instant AP then sends connecting devices an HTTP redirect to that external page, and enforces captive-portal authentication against it.

In plain terms: instead of showing its own bare terms screen, Instant On hands the guest over to a portal you control. That portal can look like anything, ask for anything and store anything. When CaptiFi is the portal, the guest sees a branded splash page with your photo, your offer and a sign-in field. They enter an email, give a separate, unbundled marketing opt-in, and connect. From that single moment you get a consented contact that flows straight into automated email and review tools.

Two details from the Aruba docs that the setup section below depends on:

• It runs over RADIUS. External portals on Instant On require a RADIUS profile (server address, shared secret, auth and accounting ports). There are two authorisation modes: standard user authentication against the RADIUS server, or a "guest portal acknowledgment" mode where the external page returns the predefined string InstantOn.Acknowledge to grant access. CaptiFi handles the RADIUS side for you, so you are not standing up your own server.
• There is a walled garden. Instant On has an "Allowed Domains" list. Any domain a guest needs to reach before they have logged in, the portal itself, payment gateways like Stripe, social platforms, must be added there manually. Miss this and the sign-in page will not load.

Once that contact is captured, the marketing layer does the work. Automated welcome emails, win-back campaigns and Google review requests run without you touching them. Venues using CaptiFi typically capture 40 to 60% of connecting guests as subscribers, around 300 to 500 plus emails per location each month, and see 3 to 5x more Google reviews within 60 days. The same pattern applies whether you run Aruba, UniFi or anything else, which is why the approach mirrors our UniFi captive portal setup guide almost step for step.

Setting up the built-in guest network

If you only want the clickthrough terms screen, this is all you need. Everything happens in the Instant On app or at the web portal (portal.arubainstanton.com).

1. Open the Instant On app and go to your site. Tap Networks, then add a new network.
2. Set the network type to Guest and give it an SSID, for example "The Crown Guest".
3. Under the guest network's security or portal settings, choose the captive portal option. Select Internal - Acknowledged for a simple accept-the-terms page (use Internal - Authenticated only if you genuinely want per-guest accounts).
4. Customise the splash: upload your logo, set your colours, and add your terms and conditions text.
5. Save and apply. Connect a phone to the new SSID and confirm the page appears before internet access is granted.

That gives you a clean, on-brand acceptance screen. It will not collect a single email, but it is a perfectly respectable starting point if marketing is not yet on your radar.

Pointing Instant On at an external portal

This is the configuration that actually builds your list. The exact label wording can shift between firmware versions, so treat these as the steps rather than gospel UI text, and check against the live app as you go.

1. Create or edit your guest network. In the Instant On app, add a Guest network or open the existing one.
2. Choose the external portal. In the splash page type drop-down, select External - RADIUS Server. This tells the AP to redirect guests to your portal rather than show an internal page.
3. Add the RADIUS profile. Enter the RADIUS server address, shared secret, and the authentication and accounting ports your portal provider supplies. With CaptiFi these values come straight from your dashboard.
4. Set the redirect URL. Point it at your portal's sign-in URL so the AP knows where to send unauthenticated guests.
5. Build the walled garden. Add every pre-login domain to Allowed Domains: the portal domain, any asset or analytics domains it uses, and payment or social domains if your flow needs them. This step is the single most common reason a portal "does not load", so do not skip it.
6. Save, then test on a real device. Forget the network on your phone, reconnect, and confirm you are redirected to the branded portal, that sign-in completes, and that you then reach the wider internet.

If you are choosing kit for a brand-new fit-out rather than retrofitting, it is worth reading our note on how to choose an access point for guest WiFi before you commit, because external-portal support is not universal across budget brands.

Instant On built-in vs Instant On plus CaptiFi

Same access points, very different outcomes. The built-in portal lets people online. The external portal turns that moment into a marketing asset.

The honest summary: if you only need a terms screen, the built-in portal is the right tool and you should use it. If you want the WiFi to actually grow your business, you need the external-portal layer. The consent piece is not optional either. CaptiFi keeps the marketing opt-in separate from WiFi access, which is exactly what UK GDPR and PECR require. Our GDPR-compliant WiFi guide covers why an unbundled tick box matters.

Which Instant On access points work

The external-portal capability is a function of the Instant On platform, not a specific AP, so it works across the range. The confirmed cloud-managed models include:

• Wi-Fi 5 (802.11ac): AP11, AP11D, AP12, AP15, AP17 (outdoor).
• Wi-Fi 6 (802.11ax): AP21, AP22, AP22D, AP25, plus the AP27 (IP67 outdoor, dual-band, PoE, up to around 75 users).
• Wi-Fi 6E: AP32.

If you are already running any of these, you do not need new hardware to add a marketing portal. Note one upgrade caveat from Aruba's own positioning: an Instant On deployment cannot be "upsized" into the enterprise Aruba Instant line. Moving up tiers means new hardware. For most cafes, salons and small venues that is academic, since Instant On's 25-AP, 150-user site ceiling is generous. For thinking on which generation to buy, our piece on choosing an access point is the better read than a spec table.

Getting started

The path is short. Keep your Aruba network exactly as it is. Set the guest network's splash type to External - RADIUS Server, drop in the RADIUS details and redirect URL from CaptiFi, build the Allowed Domains walled garden, and test on a phone. That is the whole job. From there the branded portal and the automated email and review tools do the ongoing work.

If you want to see what the captured side looks like before touching any settings, the analytics dashboard and guest data capture pages show the end result. Pricing starts at $69/mo, and there is a 30-day free trial with no card required. Aruba-specific notes also live on our Aruba setup page, and if you run more than one venue, the multi-location management guide covers running it all from one dashboard.

Sources: HPE Aruba Instant On official documentation (Configuring Guest Portal, External Captive Portal), HPE product material, and independent integration guides from IronWiFi, Social WiFi and Splash Networks. Aruba and Instant On are trademarks of their respective owners. Product details, including the reported divestiture of the Instant On line, were correct at the time of writing, June 2026; verify exact UI labels against the live Instant On app before configuring.