DEPLOYMENT GUIDE

Aruba Instant On
April 2021

ABOUT THIS GUIDE

The Aruba Instant On Deployment Guide is designed to enable customers to achieve optimal results when using
Aruba Instant On products. This document serves as a deployment guide and also provides product selection
recommendations, network design considerations per desired use cases, and best practices for each deployment.

INTENDED AUDIENCE AND SCOPE

This document is intended for small business owners and Aruba Partners, who are responsible for deploying and
configuring Aruba Instant On devices. It is expected that readers have a basic understanding of networking
concepts.

RELATED DOCUMENTS
In addition to this document, readers are advised to check the following product documentation for step-by-step
configuration details.

− Aruba Instant On User Guide

Acronyms Description
WLAN Wireless Local Area Networks
MU-MIMO Multi User Multiple-Input and Multiple-Output
TCP Transmission Control Protocol
UDP User Datagram Protocol
DHCP Dynamic Host Configuration Protocol
NAT Network Address Translation
ISP Internet Service Provider
PoE Power Over Ethernet
ARUBA INSTANT ON OVERVIEW
Aruba Instant On is a new family of access points (APs) and switches designed to address the current and future
needs of small businesses. The Instant On product family provides a reliable, high-speed and secure Wi-Fi
experience built on Aruba’s decades’ long heritage in enterprise networking. Instant On APs come with DHCP, NAT,
firewall and router capabilities that allow them to be directly connected to an ISP modem. This purpose-built access
point portfolio also supports Smart Mesh technology to satisfy the ever-growing coverage needs of small businesses.
The portfolio has 8, 24 and 48 port PoE switches to meets the needs of different use cases such as cameras, lighting
as well as wired phones and speakers as well as to power the APs via PoE.

PRODUCT PORTFOLIO
This product family includes indoor and outdoor access points to support multiple deployment scenarios. Refer to
the following table for details.

Name Device Type Deployment

Recommendations
AP11 Indoor, 2x2:2 MU-MIMO Boutiques, cafes

AP11D Desktop, Hospitality, 2x2:2 MU-MIMO SOHO, in-room for small hotels

AP12 Indoor, 3x3:3 (5GHz), 2X2:2 (2.4GHz) Medical offices, larger cafes,
MU-MIMO smaller offices, connected
homes, gaming use
AP15 Indoor, 4x4:4 (5GHz), 2X2:2 (2.4GHz) Larger offices, tech start-ups
MU-MIMO
AP17 Outdoor, 2x2:2 MU-MIMO Open-air restaurants and cafes,
poolside, receiving docks
AP22 Indoor, 2x2:2 Wi-Fi 6 Wi-Fi 6 access points for
locations where client density is
high
1930-8G-2SFP 8 (G) port 2SFP (fanless) Hotel, SOHO, small offices.
8 (G) port 2SFP Class 4 PoE 124W
1930-24G-4SFP/SFP+ 24 (G) port 4SFP/SFP+ (fanless) Medium/Larger offices. Choose
24 (G) port 4SFP/SFP+ Class 4 PoE model based on port count and
195W desired PoE budget
24 (G) port 4SFP/SFP+ Class 4 PoE
370W
1930-48G-4SFP/SFP+ 48 (G) port 4SFP/SFP+ (fanless) Larger offices. Choose model
48 (G) port 4SFP/SFP+ Class 4 PoE based on port count and desired
370W PoE budget.

The portfolio can be managed with a Cloud portal and a Phone App (iOS, Android) and provides an easy way to
onboard, setup and manage the Instant On portfolio of APs and Switches.

DESIGNING AN INSTANT ON NETWORK

Site design
Instant On is a simple, easy to deploy turnkey networking solution consisting of one or more Instant On APs or
Switches. A single site can include up to 25 Instant On Devices (mix of APs/Switches) supporting 8 wireless (SSID)
and 22 wired (VLAN) networks. The Instant On portfolio offers a number of ever-expanding list of features including
Smart Mesh, DHCP, NAT support, LAG, RSTP, client blocking, firewall rules that meets the needs of Small Business.

The first device to connect to the ISP equipment can either be an AP or a Switch. Instant On APs have the option of
acting as a router (and can handle PPPoE configuration) and can also act as a DHCP server providing IP addresses
to the wireless network. The first device at a site can be configured either using DHCP or static IP using PPPoE.

Using DHCP: (applies to APs and Switches)

Connect the access point to power and connect the ethernet cable to the ISP modem/gateway. It will automatically
obtain an IP address from DHCP and connect to the Internet and be ready to be onboarded to the site.

Using PPPoE (applies only to APs):

• If you need to connect to the ISP’s server and get authenticated, then follow these simple steps. After the
AP boots, it will broadcast an SSID InstantOn-AB:CD:EF
• Connect to this SSID and use the web browser and enter the URL https://connect.arubainstanton.com. Enter
the authentication credentials and you are done.

Please make sure the following ports (TCP 80, TCP 443, and UDP 123) are not blocked by the ISP modem/gateway,
so that the Instant On device has connectivity to the Internet.

It is required that all Instant On APs that need to be part of the same network are connected to the same Layer 2
wired network. Instant On APs can act as a DHCP server for wireless clients only (i.e., it cannot hand out IP
addresses to wired clients and other Instant On APs connected to the wired network).

RF Settings and Coverage

Users have the ability to tweak the AP settings to control the RF environment. With this comes the ability to:

1. Control network band of operation. There are 3 options:

a. 2.4GHz and 5Ghz
b. 2.4 GHz only
c. 5GHz only
2. Select channels
3. Select channel width

It is important to recall that Radio Frequency signals with higher frequency cover short distance compared to the
low-frequency signals. Most wireless client devices are available to communicate over the 2.4 GHz (low freq.) and
5 GHz (high freq.) bands and by default Instant On APs are available to negotiate with those clients over both
bands. It is highly recommended for the clients to connect over the 5GH band for higher throughput and
performance but there can be scenarios where a larger coverage area may be desired.

Instant On provides the option for clients to still be connected over long ranges with the tradeoff of the lower
speeds offered by the 2.4 GHz band. This can also be useful if the environment has a lot of obstructions (metal
structure, walls, etc.) and coverage over lower speed is preferred over no coverage over higher speeds.
Switch Port traffic authentication, control, and aggregation
Users have the ability to tweak the switch settings to control port traffic. With this comes the ability to:

1. Port access control (802.1X)

2. Only allow traffic from a defined network at the port level. (Default: all networks)
3. Link Aggregation (LAG) for Increased bandwidth/resilience. Instant On and LACP versions.

Features:
1. Application Visibility – Instant On provides detailed visibility into the applications used in your network. It
also shows a quick summary consisting of the top 5 apps. Users also have the ability to turn off application
visibility which may improve performance. In this case, they will be able to view the traffic usage per client.
2. Multiple Networks and Bandwidth control – Control the amount of bandwidth each user/network can
access. Users can set up multiple networks for different use cases. For example, in a Work From Home
scenario, there can be one network for work related activities with no bandwidth control, another network
for kids and yet another one for guests with limited bandwidth and site restrictions.
3. Two Factor Authentication – Ensure that your account is secure by using your mobile phone and a
second token to access your account.
4. Client Blocking – Easily block clients if they interfere with network operations and unblock them after they
start behaving again. This is useful to prevent attacks from endpoints that are compromised.
5. Installation Wizard – Follow the simple guided steps to setup your network according to your unique
requirements in minutes. The AP placement wizard provides suggestions on where to place your meshed
APs.
6. RADIUS proxy – For authentication with an external RADIUS, simplify your configuration by using a proxy
IP address.
7. IP Reservation – For legacy and IoT devices that always should get the same IP address across reboots,
The DHCP server on the AP allows for reservation of IP addresses.
8. PoE Scheduling – This feature not only saves energy but also improves the security posture for Small
Businesses. Use PoE scheduling to automatically turn off (PoE powered) APs after a certain time (say 10
pm) to not only save energy but also prevent unwanted access to the network overnight.
9. LED quiet mode – Turn off the LEDs easily on the app to ensure the AP blends into its surroundings
10. Editable Client Name – Gives an ability to change client names for wired as well as wireless clients.
Maximum supported length up to 32 characters, special characters are not supported though. This feature
will be useful to identity personal devices such as cell phones and shared resources like printers.
11. Shared Services – Instant On supports Apple Bonjour, and Google Cast to discover devices and services
on same L2 network without requiring any configuration. Instant on supports four types of shared services
 namely, print remote management, sharing, streaming. These services are available only on Employee
type network.
12. Built-in Customizable Captive Portal – Use the capabilities of the built-in captive portal partners to
customize the logo, welcome message and the terms and conditions for the Guest users in your network.
13. External Captive Portal – For capabilities such as analytics and to improve marketing capabilities for
Guest networks, Instant On offers support for following providers:
1. Aislelabs
2. Purple
3. Skyfii
4. Wavespot
5. Zoox

The customer benefits are summarized below

• Free features on Captive portal with Instant On
• Easy integration with captive portal
• High ROI, customer loyalty, advanced analytics and marketing capabilities to improve business
• For Partner managed service, Partner can buy a pool of licenses and have the ability to manage
all their customers
14. Firewall Rules - New network access control page will allow the site administrator to configure network
access. User can set network to be either Restricted or Unrestricted to their subnet. User can also set
restricted access with a list of accessible IPs from other subnets. Only supported for wireless
clients/networks.
15. Nord VPN Partnership – Aruba Instant On supports multiple VPN vendors such as OpenVPN, KeepSolid
VPN, ProtonVPN and has a partnership with NordVPN with discounted pricing.
For Instant On customers discounted pricing is available when ordering via the Instant On app. The joint
solution offers many unique added-value capabilities as mentioned below
• Works with any sized Aruba Instant On deployment, anywhere in the world, from a single access
point in a home to a medium sized business.
• Discounted pricing when ordered via the Instant On app.
• 256-bit AES encryption, no tracking of visited sites, and high throughput for streaming
• Optional ad blocking

Site management
Instant On APs and Switches support two options for hassle-free remote network management at the tip of your
fingers. You may manage your Aruba Instant On deployments either using a Mobile App that is supported on iOS
and Android or via a cloud portal that is accessible via a web browser. Administrative rights can be delegated to
another user so that two users can manage and administer the same Instant On site.

For convenience, AP and Switch software updates are automatically performed to ensure you always have the latest
and greatest software with the ever-expanding set of features and functionality. An administrator can schedule the
default time that updates are performed to ensure consistency of updates.

The Instant On Mobile App offers multi-lingual support for a variety of regional languages, such as Simplified
Chinese, Japanese, French, German, Italian, Spanish and Portuguese to ensure global usability. When the mobile
app is opened, it detects the locale of the phone and sets the language accordingly. This configuration is saved and
used every time the app launches. If the phone's locale changes the next time the app starts, it will set this new
language as the default and save it. Mobile app trouble-shooting push notifications use the same local language.

Please make sure the onboarding device (laptop or mobile phone with Instant On app) is in-sync with the local time
zone as Instant On APs will be configured per the time zone of the onboarding device. It is important to note that the
web portal, as well as the mobile app, support feature parity between both options.
Wi-Fi security recommendations
Aruba Instant On supports employee as well as guest networks that include multiple security options. For instance,
the latest wireless authentication security standard called WPA3 (aka Wi-Fi Protected Access 3) and the latest
version of WPA2 are supported. For the employee network, more robust security options are available via an External
Radius server. For the guest network, there is also an ability to have open guest network which requires no
steps/authentication procedures to be followed to connect to the network. This simplifies user experience but is not
recommended.

Guest users should be isolated from employee and business devices for security protection by creating a dedicated
network for guest usage. A customizable internal captive portal for guest access is provided to make sure that the
guest users agree to use Wi-Fi per your specified terms and conditions. You can also choose to turn on advanced
features like Time-of-Day based network scheduling to restrict Wi-Fi availability outside of business hours. You also
have the ability to hide the guest SSID although that is not part of the best practice recommendation.

Instant On APs can assign a dedicated VLAN each to one or more employee networks so that each employee
network and its resources can be isolated from other employee networks. Instant On APs also offer a client blocking
option to protect the network from malicious users.

LAN security recommendations

Aruba Instant On switches support employee and guest networks (as stated above) including include multiple
security options support of time of day features as well. Network management supports IGMP v1, v2, Loop
protection, Flow Control and 802.3x Storm Control. Ingress Rate limiting also supported via 802.1Q and 802.1p /
DSCP support 4 queues for effective traffic mapping.

Loop control supported and option to enable RSTP (rapid spanning tree protocol) for efficient convergence times
once a loop is detected. RADIUS supported for wired clients on a per port basic. with 4 readily available services
and option to utilize own private server if required.

By default, the switch is in DHCP mode and provisioned using untagged VLAN 1. It is possible to configure the
Static IP, Netmask, Gateway IP and DNS. A different management VLAN can be specified if required. In case
the uplink port of the switch requires tagging, the tagged VLAN will be set on one port of the switch (Ethernet or
SFP). All other ports will remain untagged.

AP placement recommendations
Where you place APs plays a crucial role in RF coverage. Here are placement recommendations for Instant On
APs.

1. AP coverage: APs can cover up to 2500 square feet under ideal conditions, but the real coverage is dependent
on the location of placement and the type of construction materials used in the location surrounding it.
2. Cable types: Always use Cat5(e) or Cat6 Ethernet cables to connect APs to the switch and Internet gateway.
3. Mounting APs: Mount the APs below the ceiling with the wires running above. APs that are mounted below the
ceiling perform better because their signals are not affected by any surrounding ducting, power cables, and
other construction elements. For the AP11D, mount the AP directly to the wall using a single-gang wall-box, or
use the supplied desk mount.
4. AP location: identify the areas where Wi-Fi coverage is required, then place the APs accordingly. For example,
place the APs inside of offices or hotel rooms rather than in hallways. This provides more efficient coverage
with minimal interference. Also, avoid placing APs in the closet or behind solid metal objects. For more
guidance, refer to the installation guide available in the Instant On online community.
 5. Automatic channel selection: Instant On APs are dual-band access points (i.e., supports 2.4 GHz as well as 5
GHz frequencies). Selection of the optimal channels and transmission power is critical for optimal Wi-Fi
performance and experience. Instant On APs support automatic selection of the best channels, transmission
power and channel width to ensure that each AP offers the optimum experience to the users at any given point
in time. When choosing an operating channel, the Instant On AP factors in how busy the surrounding wireless
medium is, as well as if there is any Wi-Fi interference generated by other W-Fi and non-Wi-Fi sources like
microwaves, in order to select the least crowded channel. Given that the interference and noise levels in
wireless medium can change frequently, APs regularly scan the air to optimize the channel selection and power.
If the operating channel becomes too busy due to surrounding Wi-Fi or non-Wi-Fi interference, then Instant On
APs will change the channel automatically without any user intervention.
6. Outdoor APs: When using an outdoor AP, you should place it where coverage is desired. If the outdoor AP is
connected using mesh from a wired Instant On AP, the outdoor AP should be placed in the line of sight of the
wired AP, if possible. The maximum distance between the wired Instant On AP and mesh outdoor AP should
not be more than 100 meters. For the better client connectivity AP17 has a range of 50 meters considering
there are no apparent obstacles such as thick concrete walls. Outdoor APs should be installed within 3 meters
minimum, 15 meters maximum height from the ground.

Smart Mesh design

The Aruba APs support Mesh Wi-Fi to provide the ability to extend the network to hard-to-wire areas. Instant On
APs offer simple to configure Smart Mesh that you can set up in minutes. After the first Instant On AP (wired AP)
has been added to the site, you can configure additional APs to connect over the air, if desired.

Although a single Instant On AP may support up to 8 Mesh APs, we recommend no more than 2 or 3 mesh APs
connected to a single AP for enhanced performance. Instant On APs automatically determine the best node to
connect based on signal quality and performance. For optimal performance, we recommend 1-hop mesh
deployments.

For Mesh AP placement, we recommend a minimum of 16 feet (5 meters) and a maximum of 60 feet (18.25 meters)
from the parent AP (the one that is wired to the switch or modem). Distance between the APs also depends on
obstacles, such as thick walls, metal structures or glass. Mesh APs use the 5GHz band for backhaul connection
while serving the clients on both radio bands (2.4 GHz, 5 GHz).

Another way to extend Wi-Fi coverage is by adding more Instant On APs to the same L2 switch using a network
cable. As mentioned earlier, a single Instant On site may contain up to 25 access points (including those in a mesh).
When available, wiring up the AP is recommended for better performance.
Partner-managed Instant On services
Instant On also offers remote multi-site management via the mobile app and cloud to support partner-managed IT
services. IT partners can securely manage multiple customer sites (i.e., different customer networks) using a single
instance of the Instant On Mobile App, without jeopardizing customer info, for convenient network administration.
The Instant On app also supports real-time alerts regarding network health via email in order to initiate user
intervention, if needed. This helps to eliminate dependence on on-site staffing for the end customer.

USE CASES
Let’s look at a few representative use cases for deployment of Instant On APs. We will discuss how to design and
deploy Wi-Fi for each of these use-cases. We will also review the features that may be relevant to enable for each
of the scenarios.

Although Instant On devices may be deployed for a number of different Small Business use cases, there’s a good
chance that your needs align with one or more of the use cases discussed below.
USE CASE #1: Small Clinic
• Customer Requirements
• Simple to deploy and easy to manage Wi-Fi solution for a small clinic with a reception and 2 rooms
• Separation of traffic for employees and guests
• Connectivity for wired devices including printer and desk phone
• Client Density: 10-20 active client devices at a time

• Hardware Guidelines
• Total of 3 APs – 2 units of AP11 (2x2:2) for the 2 rooms and 1 unit of AP11D (2x2:2, Desk Mount) for
the reception

o Topology

AP11 AP11
Mesh
Link
ISP

Clinic Room 1 Clinic Room 2

Modem

AP11D Reception

Employee SSID Guest SSID

• Configuration Guidelines
• Step 1: AP Onboarding and Site Creation
• We recommend the desk mounted AP11D to help in connecting desk phones and wired printers in
the reception
• When creating a new wireless network, by default the network will be assigned to the wired
management network or a new wired management network will be created if one has not been
created.
• If the AP is connected directly to the ISP modem, ISP should provide the management IP address
Instant On AP. If ISP only offers a single IP address, then an external gateway or router is required
to hand out IP address for the AP.
• Choose Router mode for the Instant On AP. It also has a built in NAT and firewall for security.
• The first Instant On AP will act as a DHCP, NAT server for wireless clients (picture below)
 • Step 2: Extend the network using one-touch Mesh
• Add an AP11 by wiring it to the AP11D in the reception
• Extend the coverage to the second room by creating a mesh link between the two AP11 in the
clinic rooms

• Recommended Feature Set

Instant On Feature/Offerings Benefits

Separate networks for different Separate network for Employees and Guests to
users keep traffic isolated
Enhanced Wi-Fi security for Employee as well
WPA3 as Guests. WPA3 Enterprise for Employee
network and WPA3 Personal for Guest network
Smart Mesh Aruba Instant On APs offer One click mesh
easy way extend the Wi-Fi coverage at hard to
wire areas and ensure better coverage. For
e.g., patios and multiple floors and larger
rooms.
Automatically turn off PoE controlled APs after
PoE Scheduling business hours and automatically turn on PoE
cameras during nights
Customize your Guest logon portal with the logo
Internal Captive Portal
and name of your clinic
Router mode If no switch is needed for wired connections
(cameras, cash register, etc.), Instant On AP
can be connected directly to the modem

USE CASE #2: Medium/Large Coffee Shop

• Customer Requirements
• Hassle-free, reliable Wi-Fi experience for customers indoors (large open hall) and outdoors (patio)
• Simple to deploy and easy to manage Wi-Fi solution
• Secured Wi-Fi access for employees and guests with the ability to scale during peak times
• Client Density: 40-50 active client devices at a time (indoors and outdoors) with client count doubling
during peak hours
• Hardware Guidelines

• Total of 3 APs – 2 units of AP15 (4x4:4) for the wide-open large hall and 1 unit of AP17 (2x2:2) for
outdoor use
• One Instant On Switch – 1930 8G 4SFP/SFP+ Class 4 PoE to support APs and other wired devices
such as printers, cameras and cash registers

o Topology

ISP
AP15 AP15
AP17

Modem

1930 8 Port PoE

Employee SSID Guest SSID

• Configuration Guidelines

• Step 1: Instant On Switch Onboarding and Site Creation

• If the coffee shop has the need for wired PoE connections such as cameras, cash registers or
printers, they can be connected to the Instant On 1930 8-port PoE switch
• Connect the Instant On Switch to the ISP modem
• ISP should provide the management IP address to Instant On Switch. If ISP only offers a single IP
address, then an external gateway or router is required to hand out IP address for the Switch.
• At the time of site creation on the cloud portal, a default wired network is created

• Step 2: Instant On AP Onboarding

• We recommend AP15 (a 4x4 AP) to provide the wide coverage needed in an open space such as
a coffee shop
• When creating a new wireless network on the cloud portal to onboard the AP, by default the
network will be assigned to the wired management network or a new wired management network
will be created if one has not been created.
• Add another AP15 to the switch and place optimally (see section on AP placement) to ensure
coverage for the coffee shop

• Step 3: Extend the network

 • Add an outdoor AP (AP17) to extend the coverage to outdoor spaces such as a patio using a
wired connection to the switch

• Recommended Feature Set

Instant On Feature/Offerings Benefits

Separate networks for different Separate network for Employees and Guests
users to keep traffic isolated
To Factor Authentication can be enabled for
Two Factor Authentication
employees for privileged access
Enhanced Wi-Fi security for Employee as
well as Guests. WPA3 Enterprise for
WPA3
Employee network and WPA3 Personal for
Guest network
To protect the network from a malicious
Client Blocking
user/client
Get advanced analytics and improve
External Captive Portal marketing capabilities and customer loyalty
by partnering with an External Captive Portal
Automatically turn off PoE controlled APs
PoE Scheduling after business hours and automatically turn
on PoE cameras during nights

USE CASE #3: Motel or Bed and Breakfast

• Customer Requirements
• Easy to manage Wi-Fi solution for the reception, breakfast area (high density), ten rooms and pool
(outdoor)
• Each room needs to have a wired desk phone, an IPTV and an optional wired port for further
expansion
• Secured Wi-Fi access with separate networks for employees and guests
• The network should be able to scale with business growth
• Connectivity for phones, cameras, printers and IoT devices such as door locks and PoE lighting for
pool areas
• Isolation of clients connected to the guest network to prevent direct inter-client communication
• Client Density: 75 – 100 active client devices at a time (indoors and outdoors)

• Hardware Guidelines
• Total of 14 APs – 10 units of AP11D (2x2:2 with Desk mount) – one for each room, 1 unit of AP15
(4x4:4) for the breakfast area, 1 unit of AP22 (2x2:2 Wi-Fi 6) for the reception and 2 units of AP17
(2x2:2) for outdoor use
• Total 1 Instant On Switch – 1930 48G 4SFP/SFP+ Class4 PoE 370W to support APs and other wired
devices such as printers, door locks and IoT lighting devices

o Topology
 1 2 3 4 5 6 7 8 9 10

AP11D AP11D
ISP

AP15 AP17 AP17

Modem
Breakfast

AP22 Pool

1930 48 Port PoE Reception

Employee SSID Guest SSID

• Configuration Guidelines

• Step 1: Instant On Switch Onboarding and Site Creation

• We recommend a 1930 48-port PoE switch for this deployment to handle the number of PoE and
wired connections for phones, cameras, APs and IoT lighting. The additional ports can be used for
connecting VoIP server, streaming devices and set top boxes.
• Connect the Instant On Switch to the ISP modem
• ISP should provide the management IP address to Instant On Switch. If ISP only offers a single IP
address, then an external gateway or router is required to hand out IP address for the Switch.
• At the time of site creation on the cloud portal, a default wired network is created

• Step 2: Instant On AP Onboarding

• We recommend AP11D (2x2 Desk mount AP) to provide the additional wired connections needed
in the reception area including wired printers and desk phone
• When creating a new wireless network on the cloud portal to onboard the AP, by default the
network will be assigned to the wired management network
• The first wireless network will always be an employee network. Create three networks with
different network quality and control to separate high-priority employees (IT team) from other
employees and guests. For this deployment, select Authentication server (RADIUS) for first
employee network, add server IP, and shared secret for the same. Select WPA3 personal for the
second employee network and the guest network.
• The first Instant On AP will act as a DHCP, NAT server for wireless clients.
 • IP and VLAN assignment: Select Instant On (NAT) option for guest network so that clients will
receive an IP address provided by the Instant On AP.

• Step 3: Guest Network Creation

• Since the first network has been created, now we can create the second employee network and
the guest network.
• Client isolation is enabled by default for guest network. That means clients connected to the guest
network are isolated from reaching other clients directly over the WLAN. Note that any network
resources for e.g., printers connected to guest network are not reachable directly by the guests.

• Step 4: Extend the network

• To the AP11D via a wired connection, we recommend adding a AP22 (2x2 Wi-Fi 6) in the lobby
area where there can be high wireless client density (to handle incoming visitors)
• All AP11D AP in the rooms need to be connected directly to the 1930 switch via a wired
connection. The desk phone and the IPTV in the rooms can use the wired ports on the AP11D
present in each room
 • Add couple of outdoor APs (AP17) to extend the Wi-Fi coverage to the pool area by connecting
them to the switch
• Regardless of where a user goes, all wireless networks will be available and provide seamless
transition across locations in the hotel

• Recommended Feature Set

Instant On Feature/Offerings Benefits

Separate networks for different Separate network for Employees and Guests
users to keep traffic isolated
Two Factor Authentication can be enabled for
Two Factor Authentication
employees for privileged access
Enhanced Wi-Fi security for Employee as
well as Guests. WPA3 Enterprise for
WPA3
Employee network and WPA3 Personal for
Guest network
Simplify authentication setup for users on the
External RADIUS Server Employee network using an external RADIUS
server
To protect the network from a malicious
Client Blocking
user/client
Get advanced analytics and improve
External Captive Portal marketing capabilities and customer loyalty
by partnering with an External Captive Portal
Easily identify devices important to you such
Editable Client Name
as IoT devices (pool light, lobby camera, etc.)
Reserve static IPs in your network for legacy
IP Reservation and IoT devices that always expect to
operate with a specific IP address
For in-room APs where the LEDs can be
LED Quiet Mode
turned off to blend in with the rest of the room
Automatically turn on and off PoE controlled
PoE Scheduling lighting and other IoT devices based on a set
schedule for areas in the hotel

USE CASE #4: Work from Home

• Customer Requirements
• Reliable and secure Wi-Fi solution, for running a business from home
• Separate network for business, home and children’s’ use with different QoS and bandwidth settings
• Ability to support streaming, audio video content
• Parental control, ability to block web content as well as restricting duration of network access
• Minimal configuration, hardware and setup needed
• Extend the network to an outdoor area (yard)
• Mesh networking needed in hard-to-wire location with option to have a wired printer from the meshed
AP
 • Connectivity for cameras, TV and gaming devices
• Client Density: 10 – 30 active client devices at a time (indoors and outdoors)

• Hardware Guidelines
• Total of 5 APs – 3 units of AP12 (3x3:3) for the bedrooms as well as the open area (Hall), 1 unit of
AP11D (2x2:2 with Desk mount) for the hard-to-wire location and 1 unit of AP17 (2x2:2) for outdoor
use
• Total 1 Instant On Switch – 1930 24G 4SFP/SFP+ Class 4 PoE 370W to support APs and other wired
devices such as cameras, TVs and gaming devices

o Topology

Bedroom 1 Dining Bedroom 2 Bedroom 3

AP12 AP11D
Mesh
Link
c c
c
AP12
c
ISP
c AP17
Bathroom
c
Bathroom
Hall
Modem

AP12
c
Bathroom
1930 24 Port PoE

c c c
Garage Kitchen Utility Storage Yard

Office SSID Home SSID Kids SSID

• Configuration Guidelines
• Step 1: Instant On Switch Onboarding and Site Creation
• We recommend a 1930 24-port PoE switch for this deployment to handle a number of wired
connections to cameras, APs, TV and gaming devices across the home
• Connect the Instant On Switch to the ISP modem
• ISP should provide the management IP address to Instant On Switch. If ISP only offers a single IP
address, then an external gateway or router is required to hand out IP address for the Switch.
• At the time of site creation on the cloud portal, a default wired network is created

• Step 2: Instant On AP Onboarding

• We recommend AP12 (3x3:3) for running your business from home while also hosting the home
and children’s’ SSID on the same wireless network
• When creating a new wireless network, by default the network will be assigned to the wired
management network or a new wired management network will be created if one has not been
created.
 • The first Instant On AP will act as a DHCP, NAT server for wireless clients

• Step 3: Home and Kids Network Creation

• Since the first network has been created, now we can create the second network for Home users
and Kids network for children
• Client isolation is enabled by default for the two new networks. That means clients connected to
the home network are isolated from reaching other clients directly over the WLAN. Note that any
network resources for e.g., printers connected to home network are not reachable directly.
• Set per-network bandwidth limits for the Home network to prevent unlimited usage from
consuming a large portion of the bandwidth
• Do the same for the Kids network and also use the Time of Day SSID feature to make the network
available only at specific times of the day.
• On the Kids network, additional restrictions to visiting sites can be achieved by using the
Application Blocking feature and turning off access to unwanted categories of traffic

• Step 4: Extend the network

• Add the two other AP12 access points and the three networks will also be made available to those
APs
• Set up Mesh networking for the hard-to-wire room with AP11D and use the downlink port to
connect legacy wired devices such as printers. AP11D allows wired devices in remote corners of
the house get a wired connection through a Mesh link to the nearest AP
• For outdoor use (yard), add an outdoor AP (AP17) and have it wired to the switch
• Now the same set of access points will be serving 3 different SSIDs regardless of where the user
may be located

o Recommended Feature Set

Instant On Feature/Offerings Benefits

Separate network for Office, Home and Kids

Separate networks for different
usage to ensure bandwidth availability and to
users
keep traffic isolated
Enhanced Wi-Fi security for Office, Home
WPA3
and Kids network. WPA3 Enterprise for Office
 network and WPA3 Personal for Home and
Kids network
Block unsolicited traffic Aruba Instant On APs come with a built-in
firewall that can block any unwanted or
unsolicited traffic coming in from the Internet to
keep malicious hackers at bay
Block undesired traffic categories Aruba Instant On APs have a built-in deep
packet inspection (DPI) engine and firewall to
offer you visibility into the different application
and website categories that users on each of
the networks are accessing. You also have the
ability to block one or more traffic types. This
can be used by parents to block age-restricted
content for the home network.
Easily identify devices important to you such
Editable Client Name
as IoT devices (pool light, lobby camera, etc.)
For in-room APs where the LEDs can be
LED Quiet Mode
turned off to blend in with the rest of the room
QoS Instant On has enabled this feature in the
background to automatically prioritization for
voice/video traffic (enabled by default)
Dynamic RF Optimization Instant On has enabled this feature in the
background to dynamically change the operating
channel and adjust Tx power in case of co-
channel interference (enabled by default)
Time of the Day SSID Control Wi-Fi usage outside of configured time.
Very handy feature to reduce screen time for
children
Smart Mesh Aruba Instant On APs offer One click mesh easy
way extend the Wi-Fi coverage at hard to wire
areas and ensure better coverage. For e.g., patios
and multiple floors and larger rooms.
Nord VPN Partnership 256-bit AES encryption, no tracking of visited
sites, and high throughput for streaming
Discounted pricing when ordered via the Instant
On app

SUMMARY

Aruba Instant On access points and switches are designed with small businesses in mind. It is a simple, secure,
and reliable solution that small businesses deserve Instant On APs come with two year of hardware warranty and
Instant On Switches limited lifetime warranty respectively. Instant On APs and Switches offer 24x7 phone support
for 90 days, 24x7 chat support (two years for APs and limited lifetime for Switches) and an active
online community to take care of any product questions or concerns. Click here to learn more about Aruba Instant
On devices.

To keep you worry free, Aruba offers optional Foundation Care support services for Aruba Instant On. Adding
Foundation Care support is simple and extends the warranty and support to a period of 3 years. Add Foundation
Care with new Instant On purchases within 90 days of original purchase to obtain these benefits.
 • Three years of Next Business Day advanced replacement of defective network equipment and parts – so
your network can stay up and functioning as expected.
• 24x7 telephone support access to our Aruba experts – delivered by the Aruba Technical Assistance Center
(TAC).
• Three years of software support along with advice from our Aruba experts on any questions or concerns.
• Three years of chat support provided through our Aruba Instant On community.

Speak to your Aruba authorized business partner today about adding Foundation Care support services for Aruba
Instant On Access Points and Switches.