eduroam - FAQ

The eduroam service is an international secure federated access service, allowing for members of participating institutions to access a secure wireless network when on the CU Boulder campus or one of the hundreds of other institutions in both the United States and world-wide.

Users must download and install eduroam configuration software for their device prior to connecting to eduroam. After installing the certificate, simply select eduroam from your available Wi-Fi networks to connect.

For detailed instructions on setting up your device to connect to the eduroam network, please refer to the following:

• Windows eduroam setup
• Mac OSX eduroam setup
• Android eduroam setup
• Apple iOS eduroam setup

Our Secure Wireless has a couple software components that are used for onboarding:

Secure W2 onboarding agent

• Configures devices network settings to easily join our encrypted wireless network.
• Installs a secure certificate for our wireless authentication controller to prevent person-in-the-middle attacks if someone presents a fake "eduroam" wireless network.

SafeConnect Policy Key

• Posture assessment tool for verifying the health of a device before it connects to our Secure Wireless environment. This is used to ensure devices comply with CU Boulder's Minimum Security Requirements. This includes:
  • Authentication against the campus Active Directory
  • Verifying Antivirus is installed, running, and has latest definitions
  • Verifying Windows / Macintosh firewall running
  • Verifying Windows / Macintosh operating system updates are enabled, running, and up-to-date
• Additional posture checking
  • Checking if user is behind a NAT device
  • Detection of Peer-to-peer (P2P) software
  • Detection of outdated or vulnerable software, such Oracle Java, Adobe Acrobat Reader, Adobe Flash Player
  • Detection of outdated or expired operating systems, such as OS X 10.5, 10.6, and Windows XP
  • Detection of specific malware

No, printers can't attach to eduroam SSID because they lack encryption mechanisms.

In general, faculty or staff should not use wireless printers because data is passed unencrypted and may violate FERPA, HIPAA or other data sensitivity policies. However, if you need to setup wireless printing, the printer should remain on UCB Wireless.

Campus visitors from institutions participating in eduroam can simply select eduroam from their operating system's Wi-Fi options and connect to eduroam using their institution's credentials. If you experience any issues with while visiting CU Boulder, please contact your home institution's service desk.

Campus visitors not from a participating institution should use the UCB Guest Wireless network.

Yes. Refer to the following tutorials to learn how to set up your device:

• eduroam - Android Setup
• eduroam - iOS Setup

Due to the dynamic nature of the onboarding process, the eduroam configuration software must be downloaded from the Secure W2 onboarding webpage. This is necessary and can be trusted.

Due to the nature of your eduroam credentials being stored locally on your device, changing your IdentiKey password using Identity Manager will cause an eduroam authentication failure.

Depending on your operating system, you may be prompted to re-enter your credentials. If not prompted, the most reliable method for correcting the authentication issue is to repeat the onboarding process. The following tutorials explain this process:

• eduroam - Windows Setup
• eduroam - macOS Setup
• eduroam - Android Setup
• eduroam - iOS Setup

In general, it is best practice to use eduroam for most secured on-campus connections, while Cisco VPN should be used for secured off-campus connections. Refer to the chart below for usage specific usage scenarios: