Setup a UPSK SSID

7 min

A Unique Passphrase (UPSK) SSID lets every user or device connect to the same Wi-Fi network using its own passphrase. If a passphrase is shared accidentally or a device is lost, you can revoke or change that passphrase without affecting other users or devices.

By consolidating devices onto a single SSID, UPSK can reduce the number of PSK SSIDs and associated beacon and other management frames, helping reduce RF overhead and improve Wi-Fi airtime efficiency.

Use UPSK for:

Devices that cannot authenticate with a username and password (802.1X), such as cameras, printers, TVs, and meeting-room equipment.

Employee-owned headless devices, where employees authenticate through your identity provider and register a unique passphrase for each device. Mobile devices with a private (random) Wi-Fi address can't use self-registration.

Prerequisites

Complete the following steps before creating a UPSK SSID. SSO is required only if employees will self-register their devices. Each step has a dedicated page with detailed instructions.

Configure a Service Area. Define the sites, buildings, and floors where you need Nile connectivity. See Setup Service AreasSetup Service Areas.

Configure DHCP. Choose Nile DHCP or an external DHCP server, and define the subnets your users will use. See Setup DHCPSetup DHCP.

Configure Segments. Create a segment for this SSID. A RADIUS server is not required for UPSK SSIDs. See Setup SegmentsSetup Segments.

Configure SSO (required for self-registration). Integrate your identity provider (IdP) with Nile. For IdP integration, refer to Integrations > Identity Providers (IdP): Google Workspace, Okta, Microsoft Entra ID, or Azure Active Directory.

Configuration Steps

In the left navigation, select Network Setup > Wireless, click the '+' sign, and choose Personal.

Name: Enter the SSID name.

Select the Hide SSID checkbox to hide the SSID.

Security: Select WPA2.

Note: The Unique passphrase option is available only with WPA2. WPA3 is not available for a UPSK SSID.

Select the Unique passphrase checkbox to assign a unique passphrase per user or device for the SSID.

Optional: Select the Enable SSO checkbox to let employees sign in through your identity provider (IdP) and create passphrases for their own devices.

Segments: Select one or more segments/subnets for this SSID to separate device groups, such as cameras and printers. Each passphrase maps devices to its associated segment/subnet. For example, with Nile-UPSK, camera, printer, and meeting room passphrases can map to the Cameras, Printers, and Devices segments, respectively. All devices use the same SSID.

Click Save to complete configuration.

Note: UPSK networks operate only on the 2.4 GHz and 5 GHz bands. They do not support WPA3 due to current security protocol limitations, and the 6 GHz band requires WPA3 security.

Create Unique Passphrases

Option 1: Create passphrases as an administrator

Use this option for headless devices (devices that cannot use 802.1X), such as cameras and printers.

In the left navigation, select Network Setup > Access Management, and open the Wireless tab.

Click on the '+' icon. In the Add Access dialog, enter the following details:

Select: Choose UPSK.

Name / User: Enter a name for the device or person (for example, Lobby cameras).

Tag: Optional. Enter a label for your reference.

OUI/MAC: Optional. Enter the MAC address of the device. If you leave it blank, any device that connects with this passphrase joins the segment mapped to the passphrase.

SSID: Select the UPSK SSID that the passphrase will work on.

Segments: Required. Select the segment the device joins when it uses this passphrase. The list shows only the segments selected on the SSID.

UPSK: Click the refresh icon to have Nile generate a passphrase, or enter one manually. Passphrases follow the same rules as a PSK SSID and must be between 8 and 64 characters long.

Click Save to complete configuration.

Share the passphrase with the user, or enter it on the device.

Notes:

If you enter a MAC address, turn off the private (random) Wi-Fi address on that device for this network first. Otherwise, the device may connect with a different address from the one you entered.

CSV upload is not currently supported for UPSK passphrase creation.

UPSK SSID with multiple segments

A single UPSK SSID can map to more than one segment. The passphrase a device uses, not its MAC address, decides which segment the device joins, so you can separate device groups without creating extra SSIDs. For example, cameras, printers, and meeting-room devices can all use the same SSID but join different segments.

Create the UPSK SSID and select two or more segments. See Configuration Steps.

Create a passphrase for each device or group, as described above. The Segments field is required. Its list shows the segments mapped to the SSID, for example, Printer_Seg and Camera_Seg. Select the segment for that passphrase.

When a device connects with the passphrase, Nile places it in the selected segment. The device gets an IP address from that segment's subnet, and the segment's policies apply.

Notes:

Mapping a MAC address to a passphrase is optional. A device is placed in the segment of the passphrase it uses to connect to the SSID.

Each passphrase maps to one segment only. To place devices in different segments, create a separate passphrase for each segment.

You can't add a Guest segment to a UPSK SSID.

A device that has connected to one segment can't connect to another segment with a different passphrase until you remove it from its current segment. In the Nile Portal, go to Network Setup > Access Management, open the Wireless tab, find the rule name, and delete the device's MAC address from it.

Broadcast forwarding is not supported on a multi-segment SSID. Keep devices that rely on broadcast, such as cameras that use broadcast discovery, on a single-segment SSID.

Option 2: Employee self-registration

Use this option for employee-owned (BYOD) devices that can open a browser and sign in through SSO, such as laptops. Employees sign in through SSO to create the passphrase, and each device is redirected to the SSO sign-in page when it connects. It requires the Enable SSO checkbox on the SSID and an SSO integration with your identity provider (Okta, Microsoft Entra ID, or another IdP).

Important: Devices must be able to complete the SSO sign-in, so headless devices that can't open a browser can't use self-registration. Use Option 1 for them.

When SSO and a UPSK SSID are enabled, Nile generates a self-registration link.

Share the link with your employees. The link is available in the following places:

The my.nilesecure.com page, for users connected to any Nile SSID.

Connect to the SSID, open a browser, go to my.nilesecure.com, and click the self-registration icon at the top right.

Employees open the link and sign in through your identity provider, if prompted.

On the Manage WiFi Key tab, click ADD KEY to create a key. Each key shows its creation date, name, SSID, and QR code.

Expand the key to view its passphrase. From here, employees can:

Show or hide the passphrase, and copy it.

Click REGENERATE PASSWORD to create a new passphrase.

Optionally, click ADD DEVICE to add a device MAC address to the key.

Connect the device to the SSID in one of two ways:

Click Show QR Code and scan the code with the device. The dialog displays 'Please scan to connect' followed by the SSID name.

Enter the passphrase manually on the device.

After the device connects, it is redirected to the SSO sign-in page. The employee signs in through your identity provider.

After a successful sign-in, the device gets internet access. The device then appears under the key with its MAC address and the status Device Added through credential match.

To manage devices later, employees return to the same page. They can delete a device from the key by clicking the trash icon on its row, or remove a device and add another one in its place. This frees up a slot within the device limit.

Notes:

Wireless devices that employees register join the segment selected on the SSID.

The self-registration option appears on my.nilesecure.com only when Enable SSO is selected on the SSID.

By default, each user can have up to 3 passphrases and up to 5 devices. These limits can be changed for your organization.