Wi-Fi employee access – Ubiquiti UniFi

In this topic, you will learn how to configure Ubiquiti UniFi access points to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Wi-Fi connections.

Important:

This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.

Important:

All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

Note:

The guide reflects the new UniFi UI (Network 10.x), which differs significantly from the legacy UI (Network 9.x and older).

Create a RADIUS profile

In this section, you will create a RADIUS profile for Portnox™ Cloud RADIUS servers. You can then apply this profile to Wi-Fi configurations and Ethernet port profiles.

In the Ubiquiti web interface, go to the Network tab, and in the left-hand side menu, click on the following menu options: ⚙ > Networks.
In the right-hand side pane, scroll down to the RADIUS Servers section, and then click on the Create New link to create a new RADIUS profile.
In the right-hand side pane, configure the new RADIUS profile:
1. In the Name field, enter a name for this profile.
  
  Note:
  You will use this name when assigning the profile to Wi-Fi configurations and port profiles.
2. In the RADIUS Assigned VLAN Support section, activate the Enable checkboxes for Wired Networks and Wireless Networks.
  
  Note:
  If you intend to use this RADIUS profile with only one type of networks, you can activate just one of these checkboxes.
3. In the IP Address field, enter the IP address of the Portnox Cloud RADIUS server that you created earlier, in the Port field, enter the authentication port for this RADIUS server, and in the Shared Secret field, enter the shared secret for this server. Then, click on the Add button.
  
  Note:
  The Cloud RADIUS IP, the Authentication port, and the Shared Secret are all displayed after you create the Cloud RADIUS server.
4. If you use two Cloud RADIUS servers in both regions, repeat the above steps for the second radius server.
5. Activate the Accounting Servers checkbox.
6. Repeat the above steps in the RADIUS Accounting Servers section, entering the same IP address and shared secret, and the Accounting port number from your Cloud RADIUS server configuration (for one or two servers, depending on your configuration).

Note:

If you want to use RadSec to connect to Portnox Cloud RADIUS servers, modify the above configuration according to the instructions in the last section of this topic.

Optional: Create a RadSec profile

This is an optional task that modifies the previous task. Follow this task only if you want to connect to Portnox Cloud RADIUS servers using RadSec. Skip this task if you want to connect to Portnox Cloud RADIUS servers without RadSec.

Important:

According to Ubiquiti documentation, RadSec is not supported by any UniFi Ethernet devices/ports, only by Wi-Fi configurations.

Install OpenSSL on your personal computer.

OpenSSL is an open source library for converting certificates. You will need it to convert the certificate formats so that they are readable for Ubiquiti devices.
- Windows: Download the relevant installation package from the Shining Light Productions website. For example, Win64 OpenSSL Light for Windows 64-bit systems. Then, follow the installer steps to install the package.
- macOS: Install HomeBrew. Then, execute the command in Terminal:
```
brew install openssl
```
- Ubuntu:
```
sudo apt install openssl libssl-dev
```
- RedHat:
```
sudo dnf install openssl openssl-devel
```
  or
```
sudo yum install openssl openssl-devel
```
Follow the steps in this section to download and install the self-onboarding certificate: Get and import the certificate.

Note:
After you download the certificate, you do not need to install it. Take note of the location where you downloaded the certificate.
Follow the steps in this section to download the Cloud RADIUS root CA certificate: Download the root CA certificate from Portnox Cloud.
Use OpenSSL to extract the private key and the client certificate from the self-onboarding certificate:
Type the following commands in the Windows command line window or the macOS/Linux Terminal window:
```
openssl pkcs12 -in self-onboarding-certificate.p12 -clcerts -nokeys -out clientCertificate.crt
```
```
openssl pkcs12 -in self-onboarding-certificate.p12 -nocerts -nodes -out privateKey.pem
```
When asked for an import password, press the Enter key (empty password).

Note:
On Windows, you may need to first change the directory to the installation directory of OpenSSL: C:\Program Files\OpenSSL-Win64\bin.

Note:
We recommend that you open the extracted files in a text editor of your choice and remove all of the content before the -----BEGIN CERTIFICATE----- line.
Use OpenSSL to convert the root CA certificate into the Base64-encoded X.509 format:
Type the following command in the Windows command line window or the macOS/Linux Terminal window:
```
openssl x509 -in rootCertificate.cer -inform der -out rootCertificate.crt -outform pem
```
In the Ubiquiti web interface, go to the Network tab, and in the left-hand side menu, click on the following menu options: ⚙ > Networks.
In the right-hand side pane, scroll down to the RADIUS Servers section, and then click on the Create New link to create a new RADIUS profile.
Configure the new RADIUS profile:
1. In the Name field, enter a name for this profile.
  Note:
  You will use this name when assigning the profile to Wi-Fi configurations and port profiles.
2. In the RADIUS Assigned VLAN Support section, activate the Enable checkboxes for Wired Networks and Wireless Networks.
  Note:
  If you intend to use this RADIUS profile with only one type of networks, you can activate just one of these checkboxes.
3. Activate the TLS checkbox.
4. In the Client Certificate section, click on the Upload link and upload the client certificate that you prepared earlier (for example, clientCertificate.crt.
5. In the Private Key section, click on the Upload link and upload the private key that you prepared earlier (for example, privateKey.pem. Leave the field Private Key Password empty.
6. In the CA Certificate section, click on the Upload link and upload the root CA certificate that you prepared earlier (for example, rootCertificate.crt.
7. In the IP Address field, enter the IP address of the Portnox Cloud RADIUS server that you created earlier, in the Port field, enter the authentication port for this RADIUS server, and in the Shared Secret field, enter the string radsec (not the actual shared secret). Then, click on the Add button.
  
  Note:
  The Cloud RADIUS IP, the Authentication port, and the Shared Secret are all displayed after you create the Cloud RADIUS server.
8. If you use two Cloud RADIUS servers in both regions, repeat the above steps for the second radius server.
9. Activate the Accounting Servers checkbox.
10. Repeat the above steps in the RADIUS Accounting Servers section, entering the same IP address and string radsec as the shared secret, and the Accounting port number from your Cloud RADIUS server configuration (for one or two servers, depending on your configuration).

Create a Wi-Fi configuration for the 802.1X network

In this section, you will create a configuration for a Wi-Fi network with WPA2 Enterprise authentication (802.1X) and assign the RADIUS profile to this network.

Note:

In this example, we used an unprotected Wi-Fi configuration for SSID SIGMA957, as well as a working network configuration called VORLON.

Important:

UniFi does not let you combine 802.1X and MAC-based authentication on the same Wi-Fi configuration. You need to create separate SSIDs for 802.1X and MAB.

In the Ubiquiti web interface, go to the Network tab, and in the left-hand side menu, click on the following menu options: ⚙ > WiFi.
In the right-hand side pane, click on the Create New link to create a new Wi-Fi configuration.
Complete the new Wi-Fi configuration:
1. In the Advanced section, click on the Manual option. This will cause some of the fields to change and other fields to become active.
2. In the Name field, enter the SSID for the new network.
3. In the Network field, select your existing network configuration.
  
  Note:
  You can use the same network that was configured for your non-secured Wi-Fi. After testing the secured Wi-Fi configuration, you can delete the non-secured Wi-Fi configuration.
4. In the Security Protocol field, select the WPA2 Enterprise option.
5. Above the RADIUS Profile field, select the External RADIUS Server option, and in the RADIUS Profile field, select the name of the RADIUS profile that you created earlier for connection to Portnox Cloud RADIUS servers.
  
  Note:
  If you want this connection to use RadSec, select the RadSec profile that you created earlier.
6. Configure any other fields as required for your environment, and then click on the Create button to add the new Wi-Fi configuration.

Result: Your Wi-Fi devices can now access the protected Wi-Fi network, using the Portnox Cloud RADIUS servers for authentication.

Optional: Create a Wi-Fi configuration for MAC-based authentication

This is an optional task. Follow this task only if you want to authenticate devices, such as IoT devices, that do not support 802.1X, using their MAC address instead. Skip this task if you do not need MAC-based authentication.

Note:

UniFi does not support IPSK (Identity PSK). It only offers PPSK (Private Pre-Shared Key), where each password maps to a network (for example, a VLAN), not to a device. UniFi does not check PPSK passwords against an external RADIUS server, so you cannot use PPSK with Portnox Cloud.

Important:

UniFi does not let you combine 802.1X and MAC-based authentication on the same Wi-Fi configuration. You need to create separate SSIDs for 802.1X and MAB.

In the Ubiquiti web interface, go to the Network tab, and in the left-hand side menu, click on the following menu options: ⚙ > WiFi.
In the right-hand side pane, click on the Create New link to create a new Wi-Fi configuration.
Complete the new Wi-Fi configuration:
1. In the Advanced section, click on the Manual option. This will cause some of the fields to change and other fields to become active.
2. In the Name field, enter the SSID for the new network.
3. In the Network field, select your existing network configuration.
  
  Note:
  You can use the same network that was configured for your non-secured Wi-Fi. After testing the secured Wi-Fi configuration, you can delete the non-secured Wi-Fi configuration.
4. In the Security Protocol field, select the Open option.
5. Scroll down to the Behavior Controls section, and activate the RADIUS MAC Authentication checkbox.
6. Select the External RADIUS Server option, and in the RADIUS Profile field, select the name of the RADIUS profile that you created earlier for connection to Portnox Cloud RADIUS servers.
  
  Note:
  If you want this connection to use RadSec, select the RadSec profile that you created earlier.
7. Configure any other fields as required for your environment, and then click on the Create button to add the new Wi-Fi configuration.

Result: You created a separate Wi-Fi configuration that authenticates IoT devices by their MAC address using the Portnox Cloud RADIUS servers on the basis of MAC-based accounts.