Prerequisites

• Juniper Mist system running the latest firmware.
• Juniper Mist Access Points (APs) linked to the Mist Dashboard.
• Basic traffic routing working with existing SSID(s).
• ACLs or firewalls allow Juniper Mist APs to communicate over TCP ports 2083 RadSec.
• Access to the cloud‑hosted Juniper Mist Dashboard.

High‑Level Steps

1. Build a Helium Passpoint SSID on Juniper Mist.
2. Create a new SSID.
3. Configure Passpoint settings.
4. Add RadSec servers.
5. Apply the configuration to your sites and access points.
6. Verify operation and troubleshoot as needed.

Configure Juniper Mist for Helium Mobile

To begin, sign in to the Juniper Mist Dashboard at https://manage.mist.com.

Create a New SSID

1. Navigate to Organization → WLAN Templates.
2. Click Create WLAN Template or select an existing template.
3. Click Add WLAN to create a new SSID.

Required settings

Configure Passpoint Settings

In the WLAN settings locate the Passpoint section and set:

• Venue Name: (The Venue name or the name provided by the Helium Plus team)

Advanced Settings

• Domain Name: freedomfi.com

NAI Realms

• freedomfi.com (EAP‑TLS)
• hellohelium.com (EAP‑TLS)

Add RadSec Servers

1. Under Authentication Servers, choose RadSec from the dropdown.
2. In the Server Name field, enter radius.stage.wifi.freedomfi.com
3. Click Add Server under Server Addresses and enter:

Repeat this process for Helium's RadSec servers 52.37.147.195 and 44.241.107.197 4. NAS Identifier: use either a static MAC address (e.g. a8:53:7d:0b:fb:d0) or the token {{DEVICE_MAC}} to insert the AP’s MAC address.

This NAS Identifier must match the identifier used during onboarding through self-serve or Helium Plus.

Other WLAN Settings

These instructions include the minimum steps required to authenticate a client via the Helium network. Most venue operators will want to take additional security precautions, such as placing Helium clients into their own VLAN / subnet which is segmented from other WLANs. The steps to accomplish this are outside the scope of this document, but should be considered achieve a healthy security posture for both the venue operator and mobile users.

Upload Certificates

Save the three certificates obtained from the Helium Network into a directory for safekeeping and reference.

• ca.pem – Root CA certificate
• cert.pem – User certificate
• key.pem – Private key matching cert.pem

The keys may have different file names depending on their source.

First add the root CA in 3 parts:

1. Navigate to Organization  Settings
2. Under RadSec Certificates, click the Add a RadSec Certificate link
3. Open the CA file in a text editor; note that it contains three separate CA certs.
4. Copy and paste the first CA cert, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- header and footer into the text box, and click the Add button.
5. Repeat this process for the other two CA certs in the file.

Next add the Cert and Key

1. Under AP RadSec Certificate, click the View Certificate link.
2. Open the key.pem (or similarly named) file in a text editor, then copy and paste the contents into the Private Key field.
3. Open the cert.pem (or similarly named) file in a text editor, then copy and paste the contents (including the header & footer) into the Signed Certificate field.

NOTE: you may need to delete existing keys and certs that in boxes when you open this popup. If wanted you can save these to a local file on your computer in case you need them in the future.

4. Apply / Save as applicable

Apply the Configuration

1. Navigate to Sites and select the desired site.
2. Assign the updated WLAN Template to the site.
3. Click Apply Changes to push the configuration to all APs.

Verify Configuration

• Confirm that the Helium SSID is broadcasting on your Juniper Mist APs.
• Connect a Passpoint‑enabled device and verify authentication through RadSecProxy to the Helium Network.
• In the Mist Dashboard under Clients, ensure that client sessions are active.

Troubleshooting

Notes

• Juniper Mist does not list Helium as a Passpoint Operator. Use preset Passpoint Operator configurations only after receiving approval from the Helium Plus team.