UniFi RADIUS issues

[Netwacky87]

Hi All,

 

Just looking into rolling out UniFi so bought 3 AP-Pro's. Straight swap of existing wifi. I cannot get RAIDUS vlan's to work, it always ends up on the flat network (default vlan)

 

RADIUS is using Smoothwall as is DHCP. Anyone got any pointers? All looks fine but cannot figure it out for the life of me!!

 

Thanks!

 

Edit - using WPA2 works fine, just RADIUS is an issue.

[Davit2005]

Where is the RADIUS server is it on the smoothwall? It should not matter where the DHCP server is as long as the clients can get to it.

 

Last time I did this was on Windows NPS at home and on the unifi you tell it to use the vlan assigned by the radius server. I no longer have the setup at home because it just stopped working, don't know why, spent a bit of time troubleshooting and I couldn't be bothered to set it up again.

 

With Unifi you normally need to tagg for the different vlans for the SSIDs on the port that the AP is plugged into, sorry if you have done this already.

Edited December 3, 2020 by Davit2005

[howartp]

I use UniFi Radius with Windows NPS server and Smoothwall doing DHCP with scopes on each VLAN interface.

 

Set the VLAN in each Wireless Network in the UniFi controller.

 

[FN-GM]

I use Unifi with Windows NPS. Works well.

 

One thing to note is you need to add the wireless access points as radius clients.

[Netwacky87]

Update:

 

So - all working now, took a good couple of hours.

 

Installed controller at v6.0.36 and earlier noticed there was an update so installed v6.0.46. Same issue.

 

It prompted at the top to go back to 'classic settings' so pushed this and there are a lot more options in this GUI.

 

I recreated the Networks and SSID's. It also asked me for the gateway with subnet mask of the network so input this (couldnt do this in the new GUI) and it all came to life!! All working!! Thanks for your help guys!

[howartp]

I use Unifi with Windows NPS. Works well.

 

One thing to note is you need to add the wireless access points as radius clients.

 

For anyone reading in future, this can be a subnet (eg 192.168.90.0/24) rather than individual AP IP addresses.

[FN-GM]

For anyone reading in future, this can be a subnet (eg 192.168.90.0/24) rather than individual AP IP addresses.

 

Only if you’re using Datacenter Edition

 

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-radius-clients-configure

 

 

Also only do this if you’re separating your access points from general traffic. It isn’t a good idea to open up NPS for devices that are not desired.

[howartp]

Only if you’re using Datacenter Edition

Fair enough, we are so I didn't know that.

 

Also only do this if you’re separating your access points from general traffic. It isn’t a good idea to open up NPS for devices that are not desired.

All our APs are on their own VLAN with Smoothwall, Ruckus and Unifi controllers.

[FN-GM]

All our APs are on their own VLAN with Smoothwall, Ruckus and Unifi controllers.

 

Sounds like ours. We have our radius clients in their own vlan and add the subnets to NPS. Make life much easier.

[Davit2005]

Sounds like ours. We have our radius clients in their own vlan and add the subnets to NPS. Make life much easier.

 

We have radius server behind a firewall so allowed the specific vlan in the case where we had 100 Radius clients and then just added the individual clients to the NPS server. I think I had a powershell script somewhere that I used to import the clients into NPS as had to do 120 in one go once. Cannot for the life of me find it at the mo.

[Guest Guest]

We have radius server behind a firewall so allowed the specific vlan in the case where we had 100 Radius clients and then just added the individual clients to the NPS server. I think I had a powershell script somewhere that I used to import the clients into NPS as had to do 120 in one go once. Cannot for the life of me find it at the mo.

Simply use New-NpsRadiusClient with a foreach loop

[SpaceInvader83]

Only if you’re using Datacenter Edition

 

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-radius-clients-configure

 

 

Also only do this if you’re separating your access points from general traffic. It isn’t a good idea to open up NPS for devices that are not desired.

I'm pretty sure this is no longer the case it being limited to datacenter edition, standard lets you enter IP ranges, this wasn't always the case so I'm not sure when it changed and the documentation is mixed on MS.

 

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-top

[FN-GM]

I'm pretty sure this is no longer the case it being limited to datacenter edition, standard lets you enter IP ranges, this wasn't always the case so I'm not sure when it changed and the documentation is mixed on MS.

 

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-top

 

Thanks. You would think a company like Microsoft would have this right [emoji849]

[howartp]

Thanks. You would think a company like Microsoft would have this right [emoji849]

 

That is so fitting with my work this week - how hard can it be to automate OOBE with an answer file that just works?!

[_techie_]

You have to tag every VLAN you want to use on each access points port on the switch for traffic to flow, not just the controller. The APs are the RADIUS clients, not the controller. I put my APs on their own VLAN too so that's untagged.

Unless you are using the Guest portal feature the controller can be powered off. We leave ours running because of this plus it provides some monitoring. The controller really is a configuration push-er.

[_techie_]

Oh and standard edition on 2016 supports IP ranges, I have this confirmed and working.

[Davit2005]

You have to tag every VLAN you want to use on each access points port on the switch for traffic to flow, not just the controller. The APs are the RADIUS clients, not the controller. I put my APs on their own VLAN too so that's untagged.

Unless you are using the Guest portal feature the controller can be powered off. We leave ours running because of this plus it provides some monitoring. The controller really is a configuration push-er.

 

This is the same with a few different vendors that I have worked with including Ruckus, HP MSM. But our Aruba we'd simply add the controllers as the NAS clients as the APs create a tunnel to the controller. Makes it easy when you have 20 odd wireless subnets/vlans and can utilise a pool of vlans instead of specifying so gives a bit of flexibility.

[FN-GM]

This is the same with a few different vendors that I have worked with including Ruckus, HP MSM. But our Aruba we'd simply add the controllers as the NAS clients as the APs create a tunnel to the controller. Makes it easy when you have 20 odd wireless subnets/vlans and can utilise a pool of vlans instead of specifying so gives a bit of flexibility.

 

True. However if the controller goes offline the access points continue to operate as normal.

 

A little bit of extra work during setup makes it worth it I think.

[_techie_]

Agreed! Have to say, Im impressed so far with the bang for your buck with the Unifi/Ubiquiti system. My only gripe is that the update process for the controller is a bit rubbish, as it installs by default, into the user profile. Is there a way around this using command line/powershell?

Cheers.

[Davit2005]

True. However if the controller goes offline the access points continue to operate as normal.

 

A little bit of extra work during setup makes it worth it I think.

 

We have 3 controllers in a cluster, TBH without the controller our APs are useless paperweights once they are set as managed, lol. With over 2500 APs across 3/4 sites and upwards of 20k users (normally) 24/7 it works very well for us.

[computer_expert]

Agreed! Have to say, Im impressed so far with the bang for your buck with the Unifi/Ubiquiti system. My only gripe is that the update process for the controller is a bit rubbish, as it installs by default, into the user profile. Is there a way around this using command line/powershell?

Cheers.

 

I only ever run it on a ubuntu machine as by default it runs as a service. There are some instructions on geting it running as a service here, but they say it doesn't apply to windows server installs...

[FN-GM]

Agreed! Have to say, Im impressed so far with the bang for your buck with the Unifi/Ubiquiti system. My only gripe is that the update process for the controller is a bit rubbish, as it installs by default, into the user profile. Is there a way around this using command line/powershell?

Cheers.

 

For that reason I installed it on an Ubuntu server. Much better than running it on Windows. I made a guide on here. Just copy and paste the commands and you’re all set.

[_techie_]

For that reason I installed it on an Ubuntu server. Much better than running it on Windows. I made a guide on here. Just copy and paste the commands and you’re all set.

 

got a link to it?

[FN-GM]

got a link to it?

 

Here you go mate:

 

http://www.edugeek.net/forums/wireless-networks/214756-how-do-you-do-your-unifi-controller.html#post1837642