Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to implement WPA-Enterprise authentication on my UniFi Controller (3.1.10) without the need for certificates on clients.

My RADIUS server will be Windows Server 2012R2 with NPS role installed.

All I want is for my devices (Macs + Android) to auth on the Wi-Fi with an AD account for the person using it.

Could anyone shed any light on this scenario?

Any help is much appreciated,

Cheers!

EDIT I have attempted to set this up from what @Nathan has mentioned below

Added RADIUS Client http://i.stack.imgur.com/E4R9M.png

Added Network Policy http://i.stack.imgur.com/M1N6r.png

From an NPS view, does this look correct?

share|improve this question
    
Wait but I think more discussion is needed to clarify that in your case you must have deployed Active Directory PKI already; the NPS server has certificate from that internal CA and the client needs to "not validate" since the client doesn't have the internal CA's root? Isn't there a way to make this work WITHOUT deploying Active Directory PKI but instead buy a certificate from Go Daddy and likes and import it onto the NPS server? Two birds with one stone; validation will work AND you don't have to deploy Active Directory PKI! Where does one buy the authentication purpose cert -- Authenticatio –  Beeb Sep 18 at 20:53

1 Answer 1

I actually have this exact setup on my network. All you need to do is add each AP as a "Trusted RADIUS Client" in NPS and configure the other settings as you see fit. On the UniFi, just add the correct information (IP and secret) for it to start working.

When connecting with Windows clients at least, you'll need to configure each one to not validate the server certificate if you don't have a trusted certificate installed or association will fail.

share|improve this answer
    
thanks @nathan - I have amended my post with an update, does this look similar to yours? –  jlwoff Mar 28 at 14:10
    
That looks correct to me. –  Nathan C Mar 28 at 14:11
    
Thanks, will give it a whirl when on site –  jlwoff Mar 28 at 14:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.