Skip to content

Configuring UniFi Wireless Network for WPA-Enterprise with External RADIUS Server

This guide will walk you through the steps to configure a UniFi wireless network for WPA-Enterprise authentication using an external RADIUS server.

Prerequisites

  • UniFi Controller installed and accessible.
  • A provisioned EasyRadius instance. Its Dashboard shows the IP address and port of the primary and secondary endpoint under Endpoints — you need all of them below.
  • Administrative access to the UniFi Controller and to the EasyRadius administration portal.

Step 1: Configure the RADIUS Server Profile in UniFi

  1. Log in to your UniFi Controller.
  2. Navigate to Settings > Profiles > RADIUS.
  3. Click on Create New RADIUS Profile.
  4. Enter the following details:
Setting Value
Profile Name Enter a name for the RADIUS profile, e.g. EasyRadius
Authentication Servers Add two servers: the primary endpoint's IP address and the secondary endpoint's IP address, each with the port shown on the dashboard (not 1812) and the same shared secret
RADIUS Secret The shared secret of the client entry you create in Step 3
Accounting Servers Do not configure
  1. Click Save to create the RADIUS profile.

Note: Adding both endpoints is what gives you failover between the two regions: UniFi tries the second server when the first does not answer.

Step 2: Configure the Wireless Network for WPA-Enterprise

  1. In the UniFi Controller, navigate to Settings > WiFi.
  2. Click on Create New WiFi Network.
  3. Enter the following details:
Setting Value
Name/SSID Enter the SSID for the WiFi network
Security Select WPA-Enterprise
RADIUS Profile Select the RADIUS profile created earlier
VLAN (Optional) Enter the VLAN ID if applicable
  1. Click Save to create the WiFi network.

Step 3: Configure EasyRadius

In the EasyRadius administration portal, open Settings → Radius Clients and add a client entry for your UniFi site with the public IP address (or address range) it connects to EasyRadius from, and the same shared secret as in Step 1. See RADIUS clients.

This guide uses plain RADIUS, so make sure RADIUS (UDP) is offered under Settings → System. See Protocols and ports.

After adding the client entry it can take up to 1 minute before the configuration is applied.

Step 4: Deploy WiFi profile using MDM

See this guide.