topic Integrating Ubiquiti APs with ISE - RADIUS CoA Configuration in Network Access Control

Integrating Ubiquiti APs with ISE - RADIUS CoA Configuration

rezaalikhani — Thu, 29 May 2025 17:46:54 GMT

Hi all;

Based on Ubiquiti admin guide for RADIUS CoA supportability in APs line of products, you must satisfy the following requirements from the RADIUS server point of view:

By default, Ubiquiti APs send NAS IDs to RADIUS server based on BSSID parameter which is basically the base MAC address of the AP, as you can see below:

As this type of devices require specific parameters for RADIUS CoA to function properly, I have created a Network Device Profile in ISE to satisfy these requirements, as you can see below:

Everything works great except the NAS ID. Although in other parameters, I have specified 0 as the value, ISE correctly passes the absorbed and actual values from previous RADIUS transactions except NAS ID. For example, if you specify "0" as the value here, ISE sends exactly "0" as the value to AP... My question is, how can I force ISE to include the absorbed value for this field from previous RADIUS transactions?

Thanks

Re: Integrating Ubiquiti APs with ISE - RADIUS CoA Configuration

Arne Bier — Thu, 29 May 2025 21:03:30 GMT

Have you tried selecting Radius:NAS-Identifier from the drop-down on the right side of the "=" operator?

Re: Integrating Ubiquiti APs with ISE - RADIUS CoA Configuration

elliot_adlerson — Thu, 12 Jun 2025 06:57:15 GMT

Hello @rezaalikhani ,

Did you able to get CoA to get working in your environment with Unifi APs ?

Also can you please let me know whats does

Radius:Acct-Session-Id = 0 mean and is there any documentation reference to this ? or can you please share the guide you followed becouse in my deployment account session id have not been send back from the ISE to AP in the CoA request.

Thanks.