How do I disconnect a device that is already connected?

You need two things. RADIUS accounting has to be on, because the button is on a live session. See "Do you support RADIUS accounting?". And you need a connector at the site. It's a small Docker container that runs on the client's own network. The client's Connectors tab gives you a one-time token and the command to run.

A disconnect has to reach the access point or switch holding the session, at its local address, and that can't be reached from the internet. A site with several access points can't forward one port to all of them either. The connector connects out to Passbeam and stays connected, so nothing needs opening inbound, and it works behind NAT and CGNAT.

Run it with --network host, or it reports a container address and disconnects are dropped without any error. Then add the address shown on its row as an extra accounting server in the RADIUS profile. That's the accounting list, not the authentication list. Equipment only accepts a disconnect from an address in its own profile. It can go anywhere in the list, and authentication still goes to Passbeam.

Give that row the site's RADIUS secret, from the client's Transport tab. Don't copy the secret from the other rows. On a RADSec profile those say radsec, because RFC 6614 sets it and the site is identified by its certificate. Passbeam signs every disconnect with the site's own secret, so a row with radsec fails the check and the disconnect is dropped without a reply.

If the site has more than one profile, add the connector to each one you want disconnects on. A network with RADSec on one SSID and standard RADIUS on another has two profiles.

The equipment also has to be set to accept disconnects. On UniFi the setting is DAS/DAC (CoA), under Settings → WiFi → the network → Behavior Controls. It turns on a small listener on the access point, on UDP 3799, that takes instructions about sessions that are already connected. RFC 5176 calls these Disconnect and Change-of-Authorisation. Without it, a session only ends when the device leaves or re-authenticates.

It's off by default and set per network, not per site or per profile. Turning it on for one SSID doesn't turn it on for any other, even if they share a profile and a connector. On UniFi it isn't in the RADIUS profile, so it's easy to miss.

Passbeam builds and signs the disconnect itself, so the connector doesn't need your shared secret for it. The reply is checked against the secret before Passbeam shows the device as disconnected. If you turn on offline authentication for a site, the connector does hold that site's secret. See "What happens if a site loses its internet connection?".

A disconnect ends one session. If the device is still allowed, it will just connect again. To keep it off, suspend or revoke it.

For the firewall rules, see "What firewall rules does the connector need?".