konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

docs(radius): Renner UniFi is WPA3 Enterprise with Passpoint #1567

Merged
k.renner merged 1 commits from docs/dot1x-passpoint-renner-unifi into main 2026-11-05 13:02:23 +00:00
Conversation 0 Commits 1 Files Changed 1
+12 -3
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/radius/dot1x.md
+12 -3
View File
@@ -125,7 +125,15 @@ Created through the UniFi Network API (site `default`):
|---|---|---|
| Firewall policy "Allow APs RADIUS" | `62c21e63-8c15-4720-adf8-b2333c090e2f` | zone Isolated `10.2.10.0/24` → zone External `10.2.99.91`, UDP `1812-1813`, ALLOW, IPv4 |
| RADIUS profile "Cluster 802.1X" | `3e5fcfed-63dc-4e7d-ad51-17cbc074e4bb` | auth `10.2.99.91:1812`, acct `10.2.99.91:1813`, secret `DOT1X_NAS_SECRET`, VLAN assignment on (`vlan_wlan_mode: optional`) |
| WLAN "Renner Test" | `3eba27e7-ddc2-41fb-ad3f-82add317847a` | copy of "Renner UniFi" (WPA2/WPA3 Enterprise transition, fast roaming, BSS transition, same AP group and bands), network (90) Guest as fallback, RADIUS profile "Cluster 802.1X" |
| WLAN "Renner UniFi" | `ef4122f2-4a83-4dca-9ef3-468d29f39a6b` | WPA3 Enterprise (no transition), PMF required, fast roaming, BSS transition, client isolation off, RADIUS profile "Cluster 802.1X"; Application Hotspot, type Passpoint (set in the UniFi UI: the API format differs from the UI's) |
Passpoint on "Renner UniFi" (UniFi offers Passpoint only with WPA3 Enterprise):
venue "Renner", Residential / Private Residence, network type Private with
Guest Access, IPv4 single NATed private, IPv6 available, NAI realm
`renner.uno` with EAP-TTLS, sub-methods PAP and username/password, domain
`renner.uno`, operator friendly name "Renner", connection capability ICMP
allow. The AKMs on air are `FT/802.1X` and `802.1X/SHA-256`; plain `802.1X`
is not offered.
## Live login check
@@ -159,7 +167,8 @@ user's own access token, and returns the profile in the response to that GET,
as the Android installer requires. The page stores nothing. Deleting the app
password in authentik removes that device from the WLAN. The profile matches
WLANs that advertise Hotspot 2.0 with domain and NAI realm `renner.uno`
(EAP-TTLS/PAP). Creating the app password needs no admin rights.
(EAP-TTLS/PAP), i.e. "Renner UniFi". Creating the app password needs no admin
rights.
App passwords expire when unused. The page creates them with 29 days (the API
caps new tokens at 30 days unless the group attribute
@@ -203,7 +212,7 @@ is never sent in clear over the air.
Settings > Network & Internet > Wi-Fi > Manage known networks > Add network:
- Network name: `Renner UniFi`
- Security type: WPA2-Enterprise AES
- Security type: WPA3-Enterprise AES
- EAP method: EAP-TTLS
- Authentication method: Unencrypted password (PAP)
- Server validation: where offered ("Verify server identity" / trusted