MPSK (Multi Pre-Shared Key)

What MPSK is

Multi Pre-Shared Key (MPSK) is Aruba's name for per-device pre-shared keys on a shared SSID. Rather than one password for the whole network, MPSK lets each device authenticate with its own key and receive its own role and policy. It brings unique-credential security to devices that cannot run an 802.1X supplicant.
MPSK is Aruba's expression of the broader PPSK concept. Cisco's equivalent is Identity PSK (iPSK), and PPSK is the generic, vendor-neutral term.

MPSK Local vs MPSK with ClearPass

Aruba offers MPSK in two forms, and the difference is where the keys and policy live. MPSK Local stores keys directly on the access point or gateway, so the matching and role assignment happen on the device itself. It is simple to deploy and works well in cloud-managed Aruba Central environments.
MPSK with ClearPass uses a RADIUS server to manage keys and return richer policy attributes, similar to how Cisco's iPSK leans on ISE. This gives more centralized control and finer policy at the cost of running ClearPass.

How MPSK works

When a device connects, the Aruba infrastructure matches the unique key the device presents during the WPA handshake. With MPSK Local, the access point checks the key against its local configuration and assigns the mapped role. With ClearPass, a MAC authentication lookup returns the device's key and policy from the RADIUS server.
Either way, each key can map to a distinct VLAN, role or access control list, so devices that share an SSID are still separated and governed individually.

Setting up MPSK

An MPSK Local setup defines the named keys and their roles directly in Aruba Central or on the controller, which suits smaller or cloud-managed deployments. An MPSK with ClearPass setup registers endpoints and key mappings in ClearPass and points the WLAN at it for MAC authentication.
The choice usually comes down to scale and policy needs. Choose Local for simplicity, or ClearPass when you want centralized control, detailed policy, and integration with the rest of an Aruba security stack.

The PPSK family

MPSK, iPSK and PPSK are the same idea under three labels. PPSK is generic, iPSK is Cisco, and MPSK is Aruba. All deliver unique per-device keys on one SSID so you can secure and segment devices that cannot run 802.1X.
Seeing them as one capability — rather than three competing technologies — makes it much easier to plan a consistent strategy across a mixed-vendor network.

Where MPSK fits

MPSK is a strong fit for IoT and BYOD on Aruba networks. It removes the shared-password risk for cameras, sensors and other headless devices, and it gives BYOD users a unique, revocable key without a certificate rollout.

• Headless IoT devices that need segmentation but have no supplicant.
• BYOD on Aruba where 802.1X is not yet deployed everywhere.
• Sites that want per-device revocation without a separate SSID per group.

MPSK with Cloud4Wi

Because Cloud4Wi is vendor-agnostic, organizations running mixed Aruba and Cisco estates can apply a consistent per-device key strategy and centralize policy. This holds regardless of whether a given site uses MPSK Local, MPSK with ClearPass, or Cisco iPSK. The operational model stays the same even as the underlying mechanism changes from site to site.

MPSK and the shift away from shared keys

MPSK exists because the single shared WiFi key has become a liability in environments full of IoT and personal devices. One password for everything cannot be attributed to a device, spreads informally, and forces a disruptive re-key across the whole network when it leaks. MPSK replaces that with per-device keys that can be issued, scoped and revoked individually.
On Aruba networks this matters most for IoT. Cameras, sensors, displays and controllers can each receive their own key and role, so they sit in separate segments rather than sharing one flat trust zone. If a single device is compromised, the damage is contained to its own segment instead of exposing every other device that shared the key.
Whichever delivery model a site uses, the operational discipline is the same as for any per-device key scheme. Generate keys cleanly, map each to the right role, rotate and expire them on a schedule, and revoke immediately when a device leaves. Done well, MPSK gives an Aruba estate per-device accountability and segmentation without the supplicant and certificate overhead of full 802.1X.
For Aruba-centric organizations, MPSK is the most direct route to per-device security on existing infrastructure. It needs no supplicant, no certificate authority, and no change to how users connect beyond entering their own key.
The strategic value grows in mixed environments. When an estate spans Aruba and Cisco, it helps to treat MPSK and iPSK as one capability, managed through a single platform and a single policy model. That avoids the trap of running two parallel key systems with different tools and processes. That consistency is what keeps a per-device key strategy maintainable as the network grows and hardware is refreshed.
For organizations that have lived with a single shared key for years, MPSK is often the lowest-friction first step toward per-device security and segmentation. It also lays the groundwork for a later move to certificate-based authentication where that is warranted.