Wi-Fi offload sounds simple – push mobile traffic onto cheap Wi-Fi. OpenRoaming and eduroam show exactly where it gets complicated.
Alan DeKok, CEO and Founder, InkBridge Networks
Wi-Fi offload (sometimes called network convergence or carrier Wi-Fi) is the practice of having devices use Wi-Fi instead of cellular data - automatically, invisibly, and without the user doing anything.
For a mobile operator, this is almost entirely a cost decision: cellular spectrum is licensed and expensive to build out, Wi-Fi spectrum is unlicensed and cheap. Cell towers are large, and they have many people connected. Wi-Fi hotspots are smaller, and they have few people connected. The hard part has always been making it work well at scale.
OpenRoaming and eduroam are two of the most instructive examples of federated Wi-Fi roaming in practice, and what they teach us goes well beyond the technology. This post covers the commercial case for Wi-Fi offload, what the federated model does that an open hotspot cannot, and what a decade of real deployments reveals about where things go wrong.
For the deeper architecture question - how RADIUS and federation standards form the technical foundation that makes any of this possible - see The authentication foundation: How federation standards enable network convergence.
The economic benefits of Wi-Fi offload
The physics make the case bluntly. A cell tower covers a mile or so and delivers a few gigabits of aggregate throughput across that entire area. A Wi-Fi access point connected to a wired backhaul delivers the same gigabits of data to a room.
You can see the consequence of this at any large venue - concerts, airports, sports stadiums - where tens of thousands of people on a single tower produce the familiar experience of watching a loading spinner for five minutes. Distributing Wi-Fi access points throughout that same venue largely solves the problem.
The savings also extend to the roaming case. If a customer would otherwise be doing 5G roaming on another carrier’s network - expensive for everyone in the transaction - and they land on a Wi-Fi network with a roaming agreement instead, that’s a win on both sides. The customer gets data. The carrier avoids the roaming cost. The Wi-Fi operator gets traffic. Nobody had to do anything.
We spoke to one provider who had built this out to an extreme conclusion: no cell service at all, just Wi-Fi networks across a city and state, sold as connectivity to other operators. It worked, and they made good money doing it. OpenRoaming makes that kind of model significantly easier to operate by removing the need for bespoke bilateral agreements with every potential partner.
The federated model vs. just opening a hotspot
The word “seamless” gets used a lot in this space - meaning the user does nothing. No captive portal, no password, no terms-and-conditions checkbox, no entering an e-mail address to get Starbucks Wi-Fi. The device authenticates automatically against credentials it already holds, and the user is just connected.
This is what separates a federated identity model from an open hotspot. An open hotspot has no identity layer. Anyone can join. There is no mechanism to bill for roaming, enforce policy, or offer the network to a carrier as a genuine offload destination. The federated model keeps the identity layer intact across network boundaries - your device carries credentials from your home provider, the visited network verifies them through the federation, and the connection happens without user intervention.
OpenRoaming, managed by the Wireless Broadband Alliance (WBA), does this using RADIUS authentication running end to end across the federation. The home provider’s RADIUS server is reachable through the WBA interconnects, authentication succeeds or fails there, and the visited network never needs to know the user’s credentials directly.
From the carrier’s perspective, it is cheaper to offer than 5G roaming and draws more users onto Wi-Fi - not an either/or, but a complement that substantially reduces the cost of keeping customers connected when they’re outside the home network.
The most vivid historical example of what this looks like when it works is Free.fr in France. Free built custom DSL equipment that broadcast two SSIDs - one private for the household, one shared as part of their network. Any Free subscriber walking through Paris was automatically on their Wi-Fi network.
The side effect was that when they launched mobile service a few years later, almost all their traffic ran over Wi-Fi or cheap data connections. They offered unlimited calls, texts, and data for 20 euros a month, or a bare-minimum plan for two euros. They could do it because they had designed their own equipment and their own app, and they controlled the stack top to bottom. OpenRoaming is a similar idea, but it is built on open standards so that any operator can participate.
What the eduroam track record reveals
The education sector’s federated roaming network, eduroam, has been running long enough to surface problems that commercial deployments are only now encountering. It is worth reading about the unique challenges of campus networks for the fuller picture, but two practical lessons from eduroam stand out for anyone building a Wi-Fi offload deployment today.
The first is about what happens to credentials when they are no longer needed. When a student graduates, their eduroam account stays on their device. Nobody removes it. So that former student’s device - now located in a different city, being carried past university access points - keeps trying to authenticate.
Figures I’ve seen put the volume of these ghost authentication attempts at roughly 30-40% of traffic at the edge of some eduroam networks. That is infrastructure load serving people who have no business being on the network, and there is currently no reliable way to stop it remotely.
The second is what happens when you block someone and their device doesn’t accept the answer. At a venue where Wi-Fi is restricted by age - an 18-plus concert, for instance - a device that gets rejected will typically keep trying. Scale that up to a few hundred devices at a venue already running 20,000 active connections and you have a meaningful load problem that compounds the congestion you were trying to solve.
Both issues are being worked on through updated RADIUS and EAP standards. The goal is to give the network a way to tell a device to stop trying for a defined period, and to support automatic credential renewal so that deprovisioning becomes a matter of not renewing rather than trying to reach out to a device you no longer control. These are not solved problems yet, but they are known problems with active standards work behind them.
Worth subscribing to.
Worth reading.
Our weekly newsletter covers network authentication tips, how-tos, security vulnerabilities, free resources, standards updates, and industry news. (All stuff you should stay up to date on!)
What this means if you’re building a converged network now
The
practical takeaway from OpenRoaming and eduroam is that the technology
is sound and the economics are real, but the integration work is harder
than the technology itself.
Standards compliance is a starting point. Everyone implements the standards slightly differently. Before committing to a roaming partner or joining an OpenRoaming federation, test the actual packet flow. The WBA runs a RADIUS interoperation group - the WRIX programme - specifically because “we both support the standard” does not reliably mean “our systems will talk to each other without modifications.” Most of the effort in a real integration is the bilateral conversation about what each side sends and what they expect back.
Think about credential lifecycle before you need to. The ghost-account problem in eduroam is not a design flaw in the protocol - it is a consequence of deploying federation without a deprovisioning strategy. If you are building OpenRoaming into your network or deploying Hotspot 2.0 for guest or roaming access, design credential management with expiry in mind from the start. Short-lived credentials that renew automatically are more work upfront and considerably less work to manage when someone leaves or a device is lost.
It is also worth noting where ISPs sit in this picture. Most carriers have telco arms and Wi-Fi arms that are in different departments and do not naturally talk to each other. The business case for joining these up is clear - the corporate and organisational reasons why it takes time are equally clear. OpenRoaming does not remove that friction; it reduces the technical barriers enough that the conversation becomes worth having.
Need more help?
If your team is wrestling with network configuration, a troubleshooting problem you cannot resolve, or a system that needs to be more resilient, we can help. InkBridge Networks has 25 years of expertise - we wrote the standards, maintain FreeRADIUS, and have seen every failure mode there is. Reach out to request a quote.
Related Articles
How to set up a wireless RADIUS server for secure Wi-Fi authentication
When setting up a Wi-Fi network at home, you
typically set up an SSID and password, accept the defaults for any other
options, and be done with it. (In some cases, these are done for you by
your service provider — you don’t even have to think.) You share the
password with family and visitors, and everyone is happy.
The unique challenges of campus networks
Unlike corporate networks designed primarily for employee productivity, campus area networks (CANs) must balance open academic culture with robust protection for sensitive research, personal data, and critical infrastructure. As universities continue to serve as both educational institutions and technology hubs, their IT teams face challenges rarely seen in other sectors.