# UniFi

{% hint style="info" %}
RADIUS over TLS (RADSEC) has been added to **UniFi Network 8.4** and newer versions. Please have your controller and network devices **up-to-date** before following this guide.
{% endhint %}

{% hint style="warning" %}
Customers have reported **delays** between activating the RadSec feature on the Unify Dashboard and becoming functional.
{% endhint %}

## Prepare certificates

To establish a valid RadSec connection, your Access Points must trust the **RADIUS Server Certificate** and your RADIUS server must trust your **RadSec Client Certificate**. To achieve this,

1.  Download the root certificate of the CA that has issued your active **RADIUS Server Certificate** as described [here](../../../../admin-portal/settings/settings-server#download).\
    In this example SCEPman is used as Root CA and has issued the RADIUS server certificate. So, we download the root CA certificate from SCEPman portal:\
    \
    ![](https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2Fqcje6zykfUaJtZ2Mpn2J%2Fimage.png?alt=media\&token=2d4e54d1-79fa-40ff-8886-a3f23fa93eec)\
    Afterwards, please convert your certificate to Base-64. This can be easily done via Windows Certificate Export Wizard, OpenSSL or other tools:\


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FPsfLYTHWwhFMHRC5e9v0%2Fimage.png?alt=media&#x26;token=9699aa03-c995-4dd6-9023-83ea4bcedc62" alt=""><figcaption></figcaption></figure>
2.  Create a **RadSec Client Certificate** for your access points. If you are using **SCEPman Certificate Master**, the process is described [here](https://docs.scepman.com/certificate-deployment/certificate-master/client-certificate-pkcs-12).\
    In this example we generate a certificate in the format "PEM". Please note down the password, as we need this later.\


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FiiknhsyBtg1OMx5zokB4%2Fimage.png?alt=media&#x26;token=008eea9c-a5a8-4ad6-9b0c-d43eda7501f6" alt=""><figcaption></figcaption></figure>
3.  Split the generated certificate into the private key (named "priv.key" in this example) and the certificate (named "clientcert.cer"). This can be easily done via a text editor:\


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2Fy4RgXqj46pwMDFObuQT0%2FScreenshot%202024-09-24%20101150.png?alt=media&#x26;token=e40c8932-f818-481e-af8c-ff8980dffea0" alt=""><figcaption></figcaption></figure>
4.  Add the root certificate of the CA that has issued the **RadSec Client Certificate** to your RADIUS instance as described [here](../../../../admin-portal/settings/trusted-roots#add) and select **RadSec** under **Use for**.\
    In case the **RadSec Client Certificate** has been issued by SCEPman (this example) and you already trust the SCEPman Root CA for client authentication, simply edit the trusted SCEPman Root CA certificate and select **Both** under **Use for**:\
    \


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FRC0VFYe5IAzWPOK6ZWrg%2Fimage.png?alt=media&#x26;token=7ea810cd-aa2e-49a0-a5c2-0508bc1f818f" alt=""><figcaption></figcaption></figure>

## UniFi configuration

{% hint style="info" %}
Below settings are the necessary settings to establish a functional RadSec connection with our service. Configure any other settings at your discretion.
{% endhint %}

1. Navigate to your Unifi Network controller and open **Settings** **> Profiles > RADIUS**.
2.  Create a new profile or update an existing one:\


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F3ZiX4U8lG2ODqepWi9TR%2Fimage.png?alt=media&#x26;token=3f8e33a3-87a1-4628-9051-8f5c9f79f5c3" alt=""><figcaption></figcaption></figure>
3. Fill in the required information:
   1. **RADIUS Assigned VLAN Support**: optional / if needed
   2. **RADIUS Settings**:
      1. **TLS**: Enable the checkbox.
      2. **Authentication Servers**:\
         \- **Server IP Address/es**: Provide the IP address of your [RadSec service endpoint](../../../../admin-portal/settings/settings-server#properties).\
         \- **Port**: 2083.\
         \- **Shared Secret**: `radsec`.
      3. **Client Certificate**: Upload the **RadSec Client Certificate** (obtained from step 3 [here](#prepare-certificates)).
      4. **Private Key**: Upload the private key of your **RadSec Client Certificate** (obtained from step 3 [here](#prepare-certificates)).
      5. **Private Key Password**: as noted down.
      6. **CA Certificate**: Upload the Root certificate of the CA that has issued your **RADIUS Server Certificate** (obtained from step 1 [here](#prepare-certificates)).
      7. **Accounting**: Enable the checkbox.
      8. **RADIUS Accounting Server**:\
         \- **Server IP Address/es**: Provide the IP address of your [RadSec service endpoint](../../../../admin-portal/settings/settings-server#properties).\
         \- **Port**: 2083\
         \- **Shared Secret**: `radsec`
      9.  **Interim Update Interval**: optional / if needed\


          <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F7bVZwLVu65fJAw2ip9yW%2Fimage.png?alt=media&#x26;token=f4f95e73-62aa-493d-ad3a-b2aae7e7282d" alt=""><figcaption></figcaption></figure>
4.  Assign this profile to the desired WiFi profile:\


    <figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FIYtSOpXKancg5DOguLnp%2Fimage.png?alt=media&#x26;token=9d545eb1-1f53-483d-b0bb-b96dce504ec3" alt=""><figcaption></figcaption></figure>
5. Give your Access Points some time to apply the new configuration:\
   \
   ![](https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FgLOTqgYBnWr21PwSxqwx%2Fimage.png?alt=media\&token=6db006ec-38eb-4b04-be4e-cabe263426ea)

### Reference: UniFi Help Center

[UniFi Gateway - Configuring a RADIUS Server](https://help.ui.com/hc/en-us/articles/360015268353-UniFi-Gateway-Configuring-a-RADIUS-Server)
