How to Set Up a Captive Portal for Ubiquiti Networks in K-12 Schools

A captive portal is an essential tool for K-12 schools looking to provide secure and controlled access to their wireless network. It allows schools to authenticate users before granting them access, ensuring that students, teachers, and staff are properly segmented within the network. Ubiquiti UniFi networks, including the UniFi Dream Machine Pro (UDM Pro), support captive portals, but to unlock their full potential—such as dynamic VLAN assignment—schools need to integrate their UniFi network with a RADIUS authentication server like Google Workspace, Azure Entra, or Clever.

Step 1: Enable the UniFi Guest Portal

1. Log into the UniFi Network Controller.
2. Navigate to Settings > Guest Control.
3. Enable the Guest Portal and customize the landing page.
4. Select an authentication method (e.g., external RADIUS authentication).

Step 2: Configure VLANs for Network Segmentation

To enhance security, schools should set up separate VLANs for different groups:

• Students
• Teachers
• Staff
• IoT devices (panels, bells, intercoms, phones)

To create VLANs:

1. In UniFi Network Settings, go to Networks > Create New Network.
2. Assign a unique VLAN ID to each user group.
3. Define firewall rules to restrict access between VLANs if necessary.

Step 3: Integrate with a RADIUS Server for Dynamic VLAN Assignment

To automatically assign users to VLANs based on their credentials, schools must integrate UniFi with a RADIUS authentication server such as:

• Google Workspace (via Secure LDAP)
• Azure Entra (formerly Azure AD)
• Clever
• FreeRADIUS or Windows NPS

How to Set Up RADIUS with UniFi

1. In the UniFi Controller, go to Settings > Profiles.
2. Add a RADIUS profile with the RADIUS server’s IP address, port (1812 for authentication, 1813 for accounting), and shared secret.
3. Configure RADIUS policies to assign VLANs based on user groups.
4. Enable 802.1X authentication to enforce VLAN assignments dynamically.

Step 4: Test and Deploy the Captive Portal

1. Connect a test device to the school’s WiFi SSID.
2. Authenticate through the captive portal.
3. Verify that the user is assigned to the correct VLAN.
4. Use UniFi Insights to monitor connections and ensure proper segmentation.

Benefits of a Captive Portal with RADIUS Integration

• Greater Control Over Network Access: Schools can easily manage who has access to the network. If a student leaves or is suspended, their access can be revoked immediately without manual intervention.
• Reduced IT Workload: By using RADIUS integration, schools can automate user authentication, significantly reducing the manpower needed to add or remove users.
• Improved Security: Users are segmented into VLANs automatically, reducing security risks.
• Simplified Management: IT staff can manage access through Google Workspace, Azure Entra, or Clever.
• Seamless Authentication: Staff and students can use their existing school credentials to log in.
• Better Network Performance: VLANs prevent congestion and improve traffic management.
• Improved Security: Users are segmented into VLANs automatically, reducing security risks.
• Simplified Management: IT staff can manage access through Google Workspace, Azure Entra, or Clever.
• Seamless Authentication: Staff and students can use their existing school credentials to log in.
• Better Network Performance: VLANs prevent congestion and improve traffic management.

Conclusion

A UniFi captive portal provides K-12 schools with a secure way to manage network access. However, to fully leverage VLAN segmentation and dynamic user authentication, integrating with a RADIUS server is essential. By using Google Workspace, Azure Entra, or Clever, schools can automate user assignments, ensuring a safe, efficient, and scalable network that supports modern learning environments. Need help setting up your UniFi network? Twotrees can assist with installation, configuration, and best practices for a seamless deployment.