Passpoint FAQs

How do I connect to Passpoint?

Disconnect and turn off auto join to your current network. Toggle your Wi-Fi radio off and on. Passpoint will then auto join.

Passpoint will not hijack a connection to an existing network set to autojoin, so if you're trying to join passpoint in an area you are typically connected to Wi-Fi, ensure you turn off autojoin to or forget other networks, then toggle your Wi-Fi radio to connect to Passpoint.

Why is Passpoint prompting for a username and password?

On an iPhone, if you click on the SSID, instead of allowing it to autojoin, it will prompt you for a username and password even though one doesn't exist. Confirm the phone is not connected to another SSID, toggle the Wi-Fi radio, and allow the phone to connect automatically.

Other Phones are connecting to our Passpoint SSID but my Samsung is not.

Samsung provides their users a lot of control over how Wi-Fi is used, including the ability to turn off Passpoint (Samsung refers to it as Hotspot 2.0). Although it is on by default from the factory, the first step is verifying that Passpoint functionality is enabled. Click on the 3 dots in the upper right of the Wi-Fi Connections page and choose Advanced Settings. From here, make sure Hotspot 2.0 is turned on. Toggle your Wi-Fi on and off and you’re your phone should auto-join the Passpoint SSID.

Can the SSID be hidden?

The Passpoint SSID must be broadcast, it cannot be hidden. If you want it to be more inconspicuous, you can name the SSID just a period or a dash.

The PLMN IDs of the carriers are broadcast in the beacon, so if the SSID is hidden phones will not be able to authenticate to the network.

Why do phones attempt to connect to a Passpoint SSID automatically (loading wheel spins), but it eventually fails to auto-join?

Check that the two provided UDP ports are allowed outbound on your firewall.

Why are phones auto joining the Passpoint network, but phone calls are not going through?

Verify that the IPSec tunnel with the carriers is being established.

• On an iPhone: Underneath the SSID on the device in small print it should list the name of the carrier (e.g. T-Mobile Passpoint). 

  Put the phone in airplane mode or turn off the cellular radio, pull down on the upper right corner of the screen to open the widgets. In the upper left look for the name of your carrier (e.g. T-Mobile Wi-Fi or Wi-Fi Calling)

• On an Android: The Passpoint SSID should be renamed on the device to the name of the carrier followed by Passpoint (e.g. AT&T Passpoint)

If the IPSec tunnel is not being established, ensure that the correct ports are allowed outbound on your firewall. Files attached for T-Mobile, Google, and AT&T Wi-Fi Calling include the necessary ports for each carrier.

Why is an Android phone not auto joining the Passpoint network, but other phones are connecting?

Some Android phones (most often Samsung) need the user to specify that the Passpoint network should authenticate with the SIM credentials.

To do this, click on the Passpoint SSID on the Android device, and in the EAP method dropdown select AKA. This tells the Android to authenticate to the network using its SIM card. This only has to be done once; in the future the phone will autojoin Passpoint.

We made changes to get Passpoint working (e.g. firewall rules), but the test phone has stopped attempting to join the network even though it attempted previously?

Restart your phone, it eventually "gives up" trying to join the network if it has already attempted multiple times. After the restart, it will attempt to join the network again.

Can we use Meraki NAT mode instead of a separate VLAN?

Features such as Meraki NAT mode, where individual APs hand out IP addresses, are not supported with Passpoint because they do not allow for seamless roaming (802.11r) between access points and will lead to calls dropping as users roam from AP to AP.

A VLAN with only internet access that is either bridged or tunneled is the recommended configuration.

Our building gets a lot of transient traffic, what would you recommend since anyone in range will auto join?

For areas with more transient traffic (APs near a sidewalk, city/town buildings), we recommend a shorter lease time (e.g. 30 minutes) because anybody in range will autojoin Passpoint.

Passpoint was working before but now no one is able to join?

The customer's network is responsible for handing out IP addresses, if Passpoint was previously working and now no one can join, check your DHCP pool size, consider shortening the lease time to 30 minutes or putting Passpoint on its own VLAN if it is not already.

Can we apply bandwidth throttling to Passpoint?

If you apply bandwidth throttling to Passpoint networks, carriers require that the throttled speed must be at least 10 Mbps—it cannot be reduced below that threshold.