For dynamic VLAN assignment, the RADIUS server must return three standardized IETF attributes within the To establish the authentication backend within the UniFi Network Application, the following configuration steps must be executed:<\/p>\r\n\r\n\r\n\r\n Once the RADIUS profile is active, switch ports must be hardened to enforce 802.1X control:<\/p>\r\n\r\n\r\n\r\n What this tutorial achieves:<\/strong> The deployment of an enterprise-grade IEEE 802.1X port-based access control infrastructure on UniFi switches, incorporating both cryptographic certificate authentication and MAC Authentication Bypass (MAB) with automated VLAN segmentation.<\/p>\r\n\r\n\r\n\r\n Resulting added value:<\/strong> Unauthorized physical access to the local area network is largely prevented; on MAB ports it remains possible with a spoofed MAC address. Unknown devices plugged into Ethernet ports are either blocked or automatically isolated in a quarantine VLAN. Concurrently, network administration is simplified: administrators no longer need to manually configure static VLANs on individual switch ports, as every verified endpoint is dynamically assigned to its correct network segment regardless of the physical port used.<\/p>\r\n\n\nAccess-Accept<\/code> packet:<\/p>\r\n\r\n\r\n\r\n\r\n
Tunnel-Type<\/code> = 13<\/code> (VLAN)<\/li>\r\nTunnel-Medium-Type<\/code> = 6<\/code> (802 \/ Ethernet)<\/li>\r\nTunnel-Private-Group-Id<\/code> = <VLAN ID><\/code> (e.g., 20<\/code> for Corporate, 50<\/code> for IoT)<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n![\"802.1X](\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/unifi-8021x-radius-dynamic-vlan-en.png\")
\n2. Step-by-Step RADIUS Server and Profile Setup in UniFi<\/h2>\r\n\r\n\r\n\r\n
\r\n
Settings > Profiles > RADIUS<\/code>. If using an integrated UniFi Gateway (e.g., UDM-Pro, EFG), enable the built-in RADIUS server under Settings > Services > RADIUS<\/code> and define a secure shared secret. Alternatively, input the IPv4 address, authentication port (default 1812<\/code>), accounting port (default 1813<\/code>), and shared secret of the external RADIUS server.<\/li>\r\nEnable RADIUS assigned VLAN for Wired Network<\/code>. This allows switch ports to override their default native VLAN based on RADIUS responses.<\/li>\r\n\r\n
001122334455<\/code>), and assign the appropriate target VLAN ID.<\/li>\r\n <\/ul>\r\n<\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n3. Step-by-Step Switch Port Security Configuration<\/h2>\r\n\r\n\r\n\r\n
\r\n
UniFi Devices<\/code>. Select the target switch and open the Port Manager<\/code>.<\/li>\r\n802.1X Control<\/code> section and select one of the following enforcement modes:\r\n \r\n
Auto<\/code>: Enforces standard 802.1X authentication. Supplicants must present valid EAP credentials or certificates.<\/li>\r\n MAC-based<\/code>: Automatically triggers MAC Authentication Bypass (MAB) for devices lacking 802.1X supplicant software.<\/li>\r\n <\/ul>\r\n<\/li>\r\nFallback VLAN<\/code> (e.g., Guest or Quarantine VLAN) to isolate devices that fail authentication or do not respond to 802.1X EAPOL requests within the timeout period.<\/li>\r\n4. Summary & Architectural Value<\/h2>\r\n\r\n\r\n\r\n