SSO RADIUS with Microsoft NPS for Authenticating Wireless Ubiquiti Access Points

A very simple answer to part of your question, the only APs the XG knows about are Sophos, anything else is just a network device.

Hello, 

I've figure that out, but i'm not trying to use the WiFi network since i don't have like you said Sophos AP. So i'm guessing it should received the RADIUS accounting information for the Wireless connected device from the LAN network like it does for devices connected via ethernet. Am I wrong?

That would be my guess.

Hi Dennis,

did you add the Radius Server inside Authentication > Servers? Is the test working?

Also you should change the Servers priority as authentication mechanisms.

Follow this guide:

https://community.sophos.com/kb/en-us/123164

That is correct, I have added it there and test was successful. Also I have change the priority and it is RADIUS,PRIMARY DC, SECONDARY DC. In the authentication log i can see that users are authenticated via RADIUS but they are only windows machines connected via LAN. No android devices. I'm reading a couple of other forums and i think it might be something related to the AP Controller not sending the IP address in Framed-IP parameter to the accounting server.

Dennis,

use the tcpdump command on XG to capture what the windows server is sending to XG and do the same between AP controller and Windows Server (you can use wireshark there).

Let us know.

Regards

Thank you, i will check and revert with result.

Is what i'm trying to do even possible? Has anyone done it? I mean authenticate android/apple devises for web filtering using RADIUS and without having Sophos AP?

Unfortunately Ubiquiti APs don't send the Framed-IP-Address as part of the the RADIUS accounting requests. So the XG wont have any idea who belongs to which IP address.

Did you ever find an alternative way to authenticate in this scenario?  We have run into the same situation.

Nope,

But the way I did it was to add users connected to the different WiFi SSIDs in different vlans and applied policies per vlan connection.

Nope,

But the way I did it was to add users connected to the different WiFi SSIDs in different vlans and applied policies per vlan connection.