How-To: Enable Cloud RADIUS with Entra ID Authentication in Ubiquiti Unifi

How to Set Up Entra ID Users to Authenticate with RADIUS

Don’t want to manage certificates? No problem! You can authenticate your existing Entra ID users using their username and password without needing to manage any PKI infrastructure.

Note that if you have conditional access policies set up in Entra ID (such as MFA), you will need to add an exception for EZRADIUS in order for username/password authentication to work. View this page for more details on adding this exception.

Configure Conditional Access Exception

How to Set Up Local Users to Authenticate with RADIUS

Have legacy devices or non-Entra ID users? You can also create local users directly in EZRADIUS and authenticate them using their username and password. Check out this page for more information on creating local users in EZRADIUS or letting your Entra ID users self-register local RADIUS accounts if needed.

Create Local RADIUS Users

How to Create an Entra ID Username and Password Access Policy

An Entra ID username and password access policy allows you to authenticate your Entra ID users using their existing credentials. View this guide to learn how to create an Entra ID username and password access policy in EZRADIUS if you have not already done so.

Create Entra ID Password Access Policy

How to Create a Local Username and Password Access Policy

A local username and password access policy allows you to authenticate users that you have created directly in EZRADIUS. View this guide to learn how to create a local username and password access policy in EZRADIUS if you have not already done so.

Create Local User Access Policy

How to Add a Cloud RadSec Server to Ubiquiti Unifi

1. Navigate to your Ubiquiti Unifi Controller.

2. Click on Network on the top menu.

   

3. From the left-hand menu select Settings.

   

4. Scroll down to the RADIUS section and click Create New.

   

5. In the Add RADIUS Server dialog, enter the following details for your RADIUS server:

   • Name: Enter something like EZRADIUS RadSec

   • RADIUS Assigned VLAN Support: Select what type of networks you want to use with EZRADIUS, wireless and/or wired.

     

How to Create a RadSec Certificate and Private Key for Ubiquiti Unifi

A RadSec Client Certificate is required to authenticate your network controller (RADIUS client) to the EZRADIUS server over a secure TLS connection. You can create a RadSec Client Certificate using EZCA or a 3rd Party Certificate Authority.

How to Create a RadSec Client Certificate Using EZCA

EZRADIUS is integrated with EZCA to make it easy to generate a new RadSec Certificate directly in your browser.

1. In the EZRADIUS dashboard, from the left-hand menu click on Create RadSec Certificate.

2. Under the Issuing CA dropdown, select the EZCA Certificate Authority you previously added to your EZRADIUS policy. If you just have one, it will be selected by default.

3. Optionally add Tags for your certificate to help identify it later.

4. Keep the Subject Name as CN=radsec.

5. Enter at least one IP address of your network controller in the IP Address field and click Add. This field isn’t used for RadSec authentication so even if you have a dynamic IP, you can still proceed with your current IP.

   

6. In the Certificate Location dropdown, select Generate Locally.

7. Click on Request Certificate. It will take a few seconds to generate the certificate.

   

8. Click on Download Full Certificate.

   

9. This will download 2 files. The .key file is the private key and the .pem file is the certificate.

   

How to Create a RadSec Client Certificate Using a 3rd Party Certificate Authority

Refer to your PKI documentation for creating a new RadSec Client Certificate. You will need both the certificate (.pem) and the private key (.key) files.

How to Upload a RadSec Certificate to Ubiquiti Unifi

Now that you’ve created your RadSec Client Certificate and Private Key, you can upload them to your Ubiquiti Unifi Controller.

1. Back in your Ubiquiti Unifi Controller, configure the RadSec TLS Settings:

   • TLS: Check this box to use RadSec.

   • Client Certificate: Upload the .pem RadSec certificate file you created earlier.

   • Private Key: Upload the .key RadSec private key file you created earlier.

   • If your private key is password protected, enter your Private Key Password.

     

How to Get the RadSec CA Certificate from EZRADIUS

The RadSec CA Certificate is used by your network controller to verify the identity of the EZRADIUS server when establishing a secure TLS connection. You can download the RadSec CA Certificate directly from the EZRADIUS dashboard.

1. Navigate to the EZRADIUS Policies page from the left-hand menu.

2. Click Download RadSec CA Certificate and save it to your local machine. It should be named radsec_ca.cer, or similar.

   

How to Upload the RadSec CA Certificate to Ubiquiti Unifi

Now that you have your RadSec CA Certificate (radsec_ca.cer), you can upload it to your Ubiquiti Unifi Controller.

1. Beck in your Ubiquiti Unifi Controller, in the RadSec TLS Settings update CA Certificate and upload the RadSec CA certificate file you downloaded earlier (radsec_ca.cer).

   

How to Get Your EZRADIUS Server IPs for Ubiquiti Unifi for RadSec

You can get your EZRADIUS Server IP addresses from the EZRADIUS dashboard. These IP addresses are needed to configure your network controller to communicate with the EZRADIUS service.

1. Navigate to the EZRADIUS Policies page from the left-hand menu.

2. At the top of the Policies page, you will find the EZRADIUS Server IP addresses. Copy one of the IP addresses from the region closest to your network controller (you’ll add the others later).

   

How to Add EZRADIUS RADIUS Servers in Ubiquiti Unifi for RadSec

Now that you have your first EZRADIUS Server IP address, you can add it to your Ubiquiti Unifi Controller for RadSec.

1. Update IP Address with an IP address closest to your Ubiquiti Unifi Controller from the EZRADIUS Server IP addresses (you’ll add the others later).

2. Set the Port to 2083 which is the port used for RadSec.

3. For the Shared Secret enter radsec, as required by the Radsec RFC.

4. Click Add to save this IP address.

   

5. Repeat for one IP address from each region if your instance supports multiple regions for higher availability.

How to Configure RADIUS Accounting in Ubiquiti Unifi for RadSec

Accounting logs contain information about user sessions and can be useful for auditing and troubleshooting. You can optionally enable RADIUS Accounting in your Ubiquiti Unifi Controller to send accounting logs to EZRADIUS. From there EZRADIUS can forward the logs to your SIEM and make them available in Audit Logs.

1. Check the Accounting Servers box to optionally send RADIUS Accounting logs to EZRADIUS.

2. Use the same IP Addresses and Port (2083) as the RADIUS Servers.

3. Leave Interim Update Interval unchecked.

4. Click Add to save your RADIUS Server.

   

5. Click Add to save your RADIUS Server to the Ubiquiti Unifi Controller.

   

How to Add a RADIUS Server to a Ubiquiti Unifi Wired Network

It’s easy to leverage your EZRADIUS RADIUS server to authenticate users connecting to your Ubiquiti Unifi wired network using 802.1X authentication. Follow the steps below to enable RADIUS authentication on your Ubiquiti Unifi Switch(es).

How to Enable RADIUS Authentication in a Ubiquiti Unifi Switch

1. In the left-hand menu, click Unifi Devices.

2. Select your switch from the list of devices and click on the Settings gear icon.

3. Under the Advanced tab, uncheck Global Switch Settings.

4. Enable 802.1X Control.

5. For RADIUS Profile, select the EZRADIUS profile you created earlier.

6. Click Apply Changes to save your configuration.

   

How to Create an Ethernet Port Profile for RADIUS Authentication in Ubiquiti Unifi

This step is only necessary if you want to create a reusable Ethernet Port Profile for RADIUS authentication. You can also enable 802.1X directly on individual switch ports without creating a port profile.

1. From the Unifi Settings page, scroll down to the Ethernet Port Profiles section.

2. Click on Create New.

   

3. Fill out the following fields:

   • Name: Enter a name for your Ethernet Port Profile (e.g., EZRADIUS Authentication).

   • Tagged VLAN Management: Set to Block All unless you want to use a specific VLAN.

   • 802.1X Control: Set to Auto.

     

How to Assign the Ethernet Port Profile to Switch Ports in Ubiquiti Unifi

1. From the left-hand menu, click Ports.

2. Select the first port you want to configure for RADIUS authentication.

3. Under Advanced switch to Manual mode.

4. Click the Ethernet Port Profile box.

5. From the port profile list, select the Ethernet Port Profile you created earlier.

6. Click Apply Changes to save your configuration.

   

7. Done!

How to Push the RADIUS CA Certificate and Wi-Fi Profile Using Jamf Pro

Follow these Jamf Pro step-by-step guides to push the required CA certificate and Wi-Fi profile to your users’ devices so they can seamlessly connect to your Ubiquiti Unifi network using Cloud RADIUS.

Jamf Pro Guide

How to Manually Configure the RADIUS CA Certificate and Wi-Fi Profile on Your Devices

Follow these manual configuration step-by-step guides to manually configure the required CA certificate and Wi-Fi profile on your users’ devices so they can connect to your Ubiquiti Unifi network using Cloud RADIUS.

Manual Configuration Guide