How do I set up UniFi's guest portal with Passbeam?

Five steps, about ten minutes. This is the setup we have tested end to end on UniFi's Hotspot portal: standard RADIUS, CHAP, and accounting on, so guests appear on the Sessions page with their address and data used.

1. Turn on standard RADIUS for the site. The portal speaks standard RADIUS only, so a site set up for RADSec alone needs it switched on: open the site in Passbeam, turn on RADIUS — standard, and generate its shared secret. RADSec carries on as before for everything else. The secret must be 16 characters or fewer, because UniFi's portal refuses a longer one without saying so; Passbeam issues 16-character secrets, and if your site has an older, longer one, add a new secret there. Both stay live, so the equipment already using the old one is unaffected.

Let the controller reach Passbeam. The portal's requests come from the UniFi Network server itself, so its firewall needs to allow outbound UDP 1812 and 1813 to both Passbeam addresses on the site's RADIUS panel. A self-hosted UniFi OS Server behind a strict outbound policy is the usual place this is missing.

2. Make a RADIUS profile for the portal. In UniFi Network, go to Settings → Profiles → RADIUS and create one called Passbeam GUEST, with the values in the table below. Use standard RADIUS, not RADSec: the portal sent nothing at all when we pointed it at a RADSec profile.

3. Point the Hotspot at it. Go to Hotspot → Landing Page. Under Authentication Methods, tick RADIUS and press Edit beside it.

In the dialog, choose the Passbeam GUEST profile and set RADIUS Authentication Type to CHAP. MS-CHAPv2 is refused, and the authentication log says so by name. Leave Disconnect Requests off for now, then press Save.

4. Put the portal on the guest network. In the guest Wi-Fi network's settings, turn on the Hotspot portal. If your controller is UniFi OS Server, leave Secure Portal off: it needs port 8843, which UniFi OS Server does not publish, and the sign-in page will never load.

5. Make a login and prove it. In Passbeam, open the client's Guest users tab and add a login. On a phone, join the guest network and sign in with it. Then try once with a wrong password: a refusal proves the portal is really asking Passbeam, because a portal that is not asking lets everybody on. The guest then shows on UniFi's Hotspot Guests list as authenticated by RADIUS.

In Passbeam, the sign-in appears in the authentication log, and a minute later the session appears under Authentications → Sessions → Guest, with the device's address and the data it has used. The login's row on Guest users links straight to it.

If the page just spins after the guest presses Login, the portal never sent us anything. Check the profile is standard RADIUS rather than RADSec, that its secret is 16 characters or fewer, and that both Passbeam addresses are listed. If a phone is refused as over its device limit, it has probably changed its private Wi-Fi address: press Forget devices on the login, or raise its limit with Edit.