Aruba Instant On Captive Portal Setup: A Practical Guide

Instant On is built for small businesses: a phone app does the setup and there's no controller box humming in a cupboard. Then a guest asks for the WiFi password, and you think, surely I can put a little branded sign-in screen in front of that. You open the app, find the guest network settings, and yes, there is a splash page. You add your logo, pick a colour, save. Done.

That's fine for a terms screen. If your actual goal was to build a marketing list or earn more Google reviews, though, you need Instant On's other portal type, External, which hands the guest to a portal that asks for an email, records consent and follows up afterwards. We'll walk through what Instant On's own portal does, what the External option adds, and how to set it up without ripping out a single access point.

For the record: CaptiFi doesn't sell Aruba kit. Its captive portal software layers a branded portal, consented email capture and review automation on top of the network you already run, and for a venue without suitable access points it has its own device, on a refundable deposit. Aruba is on our supported hardware list alongside UniFi, Omada, Meraki, MikroTik and others.

What Aruba Instant On actually is

First, a distinction that trips up a lot of setup guides. "Aruba Instant On" is not the same product as "Aruba Instant". They sound nearly identical and they behave very differently.

Instant On is the cloud-managed small-business line. It is built for places without a full-time IT person: a cafe, a salon, a two-room B and B. You manage it entirely through the Instant On mobile app or the web portal, with no on-site controller. HPE's documentation says "Instant On allows you to add up to 125 devices to a site", counting access points and switches together, and you manage it "with no additional licensing or subscription fees required". The setup is zero-touch: scan the AP, it provisions itself. Since release 3.1.0 the product has been called HPE Networking Instant On.

"Aruba Instant" (no "On") and Aruba Central are the enterprise ArubaOS lines, aimed at much larger, heavily managed networks with dedicated staff. Their documentation is separate from Instant On's, which is worth knowing when a guide's menu names don't match your app. One more thing: on 28 June 2025, in its settlement with the US Department of Justice over the Juniper Networks deal, HPE said it "has agreed to divest its global Instant On campus and branch business", subject to court approval.

What the built-in guest portal can do

HPE's Instant On guide to customising the captive portal gives you two types to choose from:

• Internal: a page Instant On hosts for you, with your branding and your terms. The guest accepts and gets online.
• External: the guest is sent to a portal server outside Instant On, which HPE says works "by configuring RADIUS authentication and accounting parameters".

The internal splash page is customisable from the guest network settings. You can add a logo and adjust the design, so it looks like your venue rather than a generic Aruba screen. For a pub that just wants a tidy "tap here to accept and connect" page, this does the job. It's quick to set up and it costs nothing extra.

The Internal page gets guests to accept your terms before they go online. Knowing who they are and reaching them again is what the External option is for.

What the Internal page doesn't cover

Three things are worth knowing before you settle on the Internal page.

Start with email addresses. HPE describes the Internal page as your branding and terms. It doesn't list any fields for a guest's details, so collecting an email address means using the External type.

Social login has changed over time. Instant On added Facebook Wi-Fi to the guest portal in release 1.3.0, and release 2.9.0 removed it ("Facebook Wi-Fi captive portal is no longer supported"). So a guide that mentions Facebook login on Instant On may simply predate 2.9.0. HPE's current guide lists the Internal and External types.

Then there's marketing. Instant On's documentation doesn't describe welcome emails, win-back offers, review requests or reports on who came back. Those come from WiFi marketing software on the other side of the External option.

How an external captive portal adds email capture

HPE's guide lists External as one of the two captive portal types, set up through RADIUS authentication and accounting. In the guest network's captive portal settings you pick External. The access point then redirects connecting devices to that external page and checks the sign-in against it.

In plain terms: instead of showing its own terms page, Instant On hands the guest over to a portal you control. That portal can look like anything, ask for anything and store anything. When CaptiFi is the portal, the guest sees a branded splash page with your photo, your offer and a sign-in field. They enter an email, give a separate, unbundled marketing opt-in, and connect. From that single moment you get a consented contact that flows straight into automated email and review tools.

Two details from the Aruba docs that the setup section below depends on:

• It runs over RADIUS. External portals on Instant On require a RADIUS profile (server address, shared secret, auth and accounting ports). There are two authorisation modes: standard user authentication against the RADIUS server, or a "guest portal acknowledgment" mode where the external page returns the predefined string InstantOn.Acknowledge to grant access. CaptiFi handles the RADIUS side for you, so you are not standing up your own server.
• There is a walled garden. Instant On has an "Allowed Domains" list. Any domain a guest needs to reach before they have logged in, the portal itself, payment gateways like Stripe, social platforms, must be added there manually. Miss this and the sign-in page will not load.

Once that contact is captured, the marketing layer does the work. Automated welcome emails, win-back campaigns and Google review requests run without you touching them. In CaptiFi's venue data, 55% of the new devices that joined CaptiFi guest WiFi in September 2026 signed in, and a typical venue gained around 50 new guest emails a month (350 or more at the busiest one in ten). The same pattern applies whether you run Aruba, UniFi or anything else, which is why the approach mirrors our UniFi captive portal setup guide almost step for step.

Setting up the built-in guest network

If you only want the clickthrough terms screen, this is all you need. Everything happens in the Instant On app or at the web portal (portal.arubainstanton.com).

1. Open the Instant On app and go to your site. Tap Networks, then add a new network.
2. Set the network type to Guest and give it an SSID, for example "The Crown Guest".
3. Under the guest network's security or portal settings, choose the captive portal option and select Internal for a simple accept-the-terms page.
4. Customise the splash: upload your logo, set your colours, and add your terms and conditions text.
5. Save and apply. Connect a phone to the new SSID and confirm the page appears before internet access is granted.

That gives you a clean, on-brand acceptance screen, and a reasonable starting point if marketing isn't on your radar yet.

Pointing Instant On at an external portal

This is the configuration that actually builds your list. The exact label wording can shift between firmware versions, so treat these as the steps rather than gospel UI text, and check against the live app as you go.

1. Create or edit your guest network. In the Instant On app, add a Guest network or open the existing one.
2. Choose the external portal. In the captive portal type options, select External. This tells the AP to redirect guests to your portal rather than show an internal page.
3. Add the RADIUS profile. Enter the RADIUS server address, shared secret, and the authentication and accounting ports your portal provider supplies. With CaptiFi these values come straight from your dashboard.
4. Set the redirect URL. Point it at your portal's sign-in URL so the AP knows where to send unauthenticated guests.
5. Build the walled garden. Add every pre-login domain to Allowed Domains: the portal domain, any asset or analytics domains it uses, and payment or social domains if your flow needs them. This step is the single most common reason a portal "does not load", so do not skip it.
6. Save, then test on a real device. Forget the network on your phone, reconnect, and confirm you are redirected to the branded portal, that sign-in completes, and that you then reach the wider internet.

If you are choosing kit for a brand-new fit-out rather than retrofitting, it is worth reading our note on how to choose an access point for guest WiFi before you commit, because external-portal support is not universal across budget brands.

Instant On built-in vs Instant On plus CaptiFi

Same access points, different jobs. Here's how the two line up, going by HPE's Instant On documentation.

If you only need a terms screen, the Internal portal does the job. For a guest list you can email, you need the external-portal layer, with the consent handled properly. CaptiFi keeps the marketing opt-in separate from WiFi access, which is what UK GDPR and PECR ask for. Our GDPR-compliant WiFi guide covers why an unbundled tick box matters.

Which Instant On access points work

The external-portal capability is a function of the Instant On platform, not a specific AP, so it works across the range. The confirmed cloud-managed models include:

• Wi-Fi 5 (802.11ac): AP11, AP11D, AP12, AP15, AP17 (outdoor).
• Wi-Fi 6 (802.11ax): AP21, AP22, AP22D, AP25, plus the AP27 (outdoor).
• Wi-Fi 6E: AP32.

If you are already running any of these, you do not need new hardware to add a marketing portal. HPE's limit is 125 devices per site, access points and switches together. For thinking on which generation to buy, our piece on choosing an access point is the better read than a spec table.

Getting started

The path is short. Keep your Aruba network exactly as it is. Set the guest network's captive portal type to External, drop in the RADIUS details and redirect URL from CaptiFi, build the Allowed Domains walled garden, and test on a phone. That is the whole job. From there the branded portal and the automated email and review tools do the ongoing work.

If you want to see what the captured side looks like before touching any settings, the analytics dashboard and guest data capture pages show the end result. Essentials starts at $69/mo, and there is a 30-day trial (you add a card to start). If you only want guest capture and CSV export on the kit you already run, Lite is $24.99/mo for one site. Aruba-specific notes also live on our Aruba setup page, and if you run more than one venue, the multi-location management guide covers running it all from one dashboard.

Sources: HPE Networking Instant On, Customising the captive portal, Inventory and release notes; HPE, Instant On management; HPE newsroom, HPE and Juniper Networks reach settlement with US Department of Justice (28 June 2025); all read on 28 October 2026. IronWiFi also publishes an Aruba Instant On guide for its own platform. Aruba, HPE, Instant On, IronWiFi and the other product names here are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them. Verify exact UI labels against the live Instant On app before configuring.