Setting up Ubiquiti Unifi Wifi with Radius

[beancole]

Hi All,

 

I have for some time now been trying to get some solid information on Ubiquiti setup.

 

My goal;-

 

To implement a new WiFi Network where devices are automatically connected to the WiFi with no user intervention (possibly connected in the image.)

 

I'm told I must use radius authentication but I know nothing of this. How do others have this set up and what results have you had.

[strawberry]

Are the devices all on your domain?

[beancole]

The laptops will be on the domain yes, there will be ipads etc but these I'm less worried about.

[hailstorm]

iPads work fine with Radius. I've done UniFi + Radius before and had no problems.

[fairm010]

You any further with this? I'd like to know too!

[pirran]

Hi, bit of an old post but I've just implemented a windows radius server for AD computer and byod/AD username authentication methods (x2 SSIDs) for some Unifi gear. Let me know if anyone needs a few pointers.

Ta

[dry]

What is best practise for WiFi on a public bank of laptops? A separate SSID and PSK (deployed via GP) so that the laptop can reach a DC, or something else? There's no way people would be willing to log into WiFi (via RADIUS) first and then into the laptop here!

[LeMarchand]

Hi, bit of an old post but I've just implemented a windows radius server for AD computer and byod/AD username authentication methods (x2 SSIDs) for some Unifi gear. Let me know if anyone needs a few pointers.

Ta

 

This is one of my backburner projects, so I'd like to hear more.

[pirran]

Ok, well this is part of what i recently setup. Firstly you need to do a bit of reading on NPS (network policy and access services) Understanding and Configuring Network Policy and Access Services in Server 2012 (Part 2)

Essentially you'll need a radius server, I installed the NPS role on one of our server 2012 R2 VMs.

 

1. run a NPS server - This is the tricky bit, i'm happy advising but you'll need to have a read about it all first. There's loads of guides on the web and it's not a difficult as you might think. https://technet.microsoft.com/en-us/library/dd283091(v=ws.10).aspx

 

2. setup a couple of SSIDs: @dry this first one would solve your problem, remember - no user input whatsoever. Once deployed you could just switch off your old SSID, all client computers connect themselves to your new prefered network.

one of these is going to permit connections from your AD joined machines, you'll need to setup a certificate that's deployed to all client machines. You can use a standard GPO to connect to the wireless SSID using peap. This means that all your AD joined machines will automatically have the wireless profile added for the SSID you have already created, they'll authenticate and require no input from the user to connect to the wireless SSID you're broadcasting, it can be hidden if you like.

Second network is for BYODthis uses the radius server to authenticate clients using their AD username and password.

 

What you end up with is domain joined machines that just authenticate and connect to your prefered secure wireless SSID, and then another SSId that's broadcast that only permits users with an AD account that exist in a particular security group. That for me at least ticked a few boxes.

 

Obviously you could also run a guest SSID hitting a captive portal etc. Best practice would be to VLAN off your different SSIDs too to keep your domain secure...

 

I'm happy to do some screenshots etc or provide more info.

Edited February 22, 2016 by pirran

[pirran]

Hi,

Thought I'd add a few screenshots of my test setup.

 

You'll notice that for the Cisco WLAN controller we only have the single IP added, this is because the controller communicates with the radius server rather than from the APs as with the unifi setup.

For the Unifi AP's each IP has to be added as a Rad

 

 

Unifi settings config to hit the radius server:

 

Group policy is one profile containing two SSIDs, this is because our Cisco kit also hits the same Radius server and uses a different SSID (same authentication method).

Edited February 23, 2016 by pirran

[LeMarchand]

Looks like I'm going to have to do more reading...

[pirran]

Take a look then post up issues and i'll try and help.

 

Thanks