Unifi USG as a DHCP server / Schools Broadband Netsweeper

[MrWu]

Hi all

 

Still trying to get our head around a VLAN/RADIUS setup (we have UniFi, and schools broadband / Netsweeper)

 

Was trying to utilise Netsweeper as a Captive portal (since I believe it's LDAP) but I think that's not developed at the moment which is a shame since SB can provide DHCP / authentication without need of in house NPS/RADIUS/DHCP etc)

 

So my first step is to work out the easiest way to get a BYOD to acquire a DHCP address via VLAN before going into a RADIUS authentication.

 

We have built a NPS server but was wondering if a Unifi USG can do DHCP and Radius role (for £100-£210) seems very cheap?

 

https://www.ui.com/unifi-routing/usg/

 

or have I misunderstood how it works?

 

Thanks as always!

[caffrey]

I use NPS, and a dhcp relay to a windows server on a USG Pro. What you need to remember is the USG is a router and by default it wants to route traffic out of it's WAN, so you need to set up policy based routing for the VLANS to go to the netsweeper gateway instead. I don't think the USG radius can integrate with AD but I could be wrong.

The problem I'm having at the moment is that I have to have the DHCP server gateway set to the USG IP else the DHCP relay breaks - I don't know what happens upstream with the SBB equipment or whether it's something they can fix. I plan on using the USG DHCP server to alleviate that issue soon (The DHCP Server is on the DC and if I use the USG Gateway user sync on netsweeper breaks)

What really needs to happen is Unifi bring out a proper layer 3 switch!

[MrWu]

I use NPS, and a dhcp relay to a windows server on a USG Pro. What you need to remember is the USG is a router and by default it wants to route traffic out of it's WAN, so you need to set up policy based routing for the VLANS to go to the netsweeper gateway instead. I don't think the USG radius can integrate with AD but I could be wrong.

The problem I'm having at the moment is that I have to have the DHCP server gateway set to the USG IP else the DHCP relay breaks - I don't know what happens upstream with the SBB equipment or whether it's something they can fix. I plan on using the USG DHCP server to alleviate that issue soon (The DHCP Server is on the DC and if I use the USG Gateway user sync on netsweeper breaks)

What really needs to happen is Unifi bring out a proper layer 3 switch!

 

Thanks for this!

 

We do have an NPS server running 2019 built and was planning to use a USG (they are fairly cheap) to do the DHCP at least and VLAN that across.

 

I presume then, you link the WAN port on the USG device to SB cloud router, LAN 1 port to the network that NPS server resides and LAN 2 is VLANed to the network where the BYOD Wireless lives?

[caffrey]

We use the wan port to another public IP, you need to setup a policy based route that sends the traffic from the vlan to the SBB gateway e.g. VLAN75 - > netsweeper bypassing the usg WAN

 

https://help.ubnt.com/hc/en-us/articles/360005460813-UniFi-USG-Advanced-Policy-Based-Routing-

 

It's normally used to use both WAN ports to two public IPs and route traffic accordingly (eg main lan out of one wan port all other traffic out of the other) unfortunately you need to do this in the CLI and mess about with some json file to make it permanent (I wish unifi would expose this in the interface...)

 

Looks like this in the cli :-

 

configure
set firewall source-validation disable
set protocols static table 5 route 0.0.0.0/0 next-hop 192.168.5.252
set firewall modify LOAD_BALANCE rule 2500 description "Traffic from Vlan 50 to Netsweeper"
set firewall modify LOAD_BALANCE rule 2500 action modify
set firewall modify LOAD_BALANCE rule 2500 modify table 5
set firewall modify LOAD_BALANCE rule 2500 source address 172.16.0.0/22
set firewall modify LOAD_BALANCE rule 2500 protocol all
set interfaces ethernet eth0 vif 50 firewall in modify LOAD_BALANCE
commit
exit
clear connection-tracking

 

This routes all traffic from vlan 50 to netsweeper

[MrWu]

We use the wan port to another public IP, you need to setup a policy based route that sends the traffic from the vlan to the SBB gateway e.g. VLAN75 - > netsweeper bypassing the usg WAN

 

https://help.ubnt.com/hc/en-us/articles/360005460813-UniFi-USG-Advanced-Policy-Based-Routing-

 

It's normally used to use both WAN ports to two public IPs and route traffic accordingly (eg main lan out of one wan port all other traffic out of the other) unfortunately you need to do this in the CLI and mess about with some json file to make it permanent (I wish unifi would expose this in the interface...)

 

Looks like this in the cli :-

 

configure
set firewall source-validation disable
set protocols static table 5 route 0.0.0.0/0 next-hop 192.168.5.252
set firewall modify LOAD_BALANCE rule 2500 description "Traffic from Vlan 50 to Netsweeper"
set firewall modify LOAD_BALANCE rule 2500 action modify
set firewall modify LOAD_BALANCE rule 2500 modify table 5
set firewall modify LOAD_BALANCE rule 2500 source address 172.16.0.0/22
set firewall modify LOAD_BALANCE rule 2500 protocol all
set interfaces ethernet eth0 vif 50 firewall in modify LOAD_BALANCE
commit
exit
clear connection-tracking

 

This routes all traffic from vlan 50 to netsweeper

 

Thanks again, will try and get our head round this, might pick your brains later if you dont mind!

[caffrey]

Sure, took me a while to work out and some SBB support but everything is working like it should

[caffrey]

Difficult to describe and I'm rubbish at network diagrams especially when more than one gateway is involved - but something like this

 

I have two gateways, if I set a PC gateway to 192.168.5.254 it bypasses Netsweeper completely, set to 252 it's filtered

 

 

 

 

Vlan 50 (type on the diagram should be 50 not 75)

 

Is set like this in Unifi

 

 

Wifi is like this

 

 

And the radius profile is like this

 

 

Then the traffic needs routing to 252 via the CLI, there is a few little extra things to do with the NPS server and SBB needs to do something