Ubiquiti Data-Only Guide

Data-Only Mobile configuration requires the Passpoint protocol. Please ensure your Ubiquiti network is using UniFi Network Controller version 8.4.54 or higher and AP firmware version 6.6.77 or AP firmware version 7.0.66 or higher, depending on hardware release track.
Obtain RadSec Certificates
Each onboarded network requires a unique NAS-ID. For Ubiquiti networks, it is recommended to use the MAC address of the network controller as the NAS-ID.
Run the UniFi network controller locally or log into the cloud UniFi Site Manager.
Navigate to UniFi Devices, choose your Network Controller and copy the MAC Address.

Use this NAS-ID in the Data-Only Onboarding flow and return to this guide after the network is onboarded and certificates have been delivered.
If early access certificates were previously deployed on the network, a Ubiquiti bug may prevent new
certificates from propagating.
Restart all APs on the network after updating the certificates, and the new certificates should be
applied.
Configure UniFi Network Controller
After retrieving onboarded certificates, configuring the network controller for Passpoint is a two-part process. First, create the RADIUS profile, then apply the profile to a newly created WiFi SSID called 'Helium'.

Create a RADIUS Profile
Configure a TLS connection to Helium Cloud AAA server (aka Radiator), which performs Authentication, Authorization, and Accounting for the end customers. Enabling RADIUS communication over TLS (RadSec) increases the level of security for authentication that is carried out across the cloud network.
In the sidebar, choose Settings, then Profiles, then RADIUS:

Press Create New.
Specify a profile name, for example "Helium Radsec".
Configure RADIUS properties:

- Under Radius Settings, check the TLS box.
- Press Upload next to Client Certificate, choose the path to
<HotspotKey>.cer
. - Press Upload next to Private Key, choose the path to
<HotspotKey>.pk
.
Keep Private Key Password empty. - Press Upload next to CA Certificate, choose the path to
data-only.ca
.
- Press Upload next to Client Certificate, choose the path to

-
Specify Authentication Servers:
Add these three servers:
- Enter IP Address:
52.37.147.195
Port:2083
Shared Secret:radsec
. Click Add. - Enter IP Address:
44.229.62.214
Port:2083
Shared Secret:radsec
. Click Add. - Enter IP Address:
44.241.107.197
Port:2083
Shared Secret:radsec
. Click Add.
- Enter IP Address:
-
Check the Accounting checkbox. RADIUS Accounting Server settings will appear.
-
Specify the following Accounting Servers:
- Enter IP Address:
52.37.147.195
Port:2083
Shared Secret:radsec
. Click Add. - Enter IP Address:
44.229.62.214
Port:2083
Shared Secret:radsec
. Click Add. - Enter IP Address:
44.241.107.197
Port:2083
Shared Secret:radsec
. Click Add.
- Enter IP Address:
-
Check Interim Update Interval box.
-
Specify Interim Update Interval with 300 Sec, standard for the Helium Network.
Click Apply Changes to create the new RADIUS Profile.
Create The Helium SSID
Navigate to the Settings in the sidebar, choose WiFi, then press Create New

Configure settings for the new network.
- Set the Name of the SSID to
Helium
. Leave the password blank. - Set Advanced to Manual.
- Set Hotspot 2.0 to
Passpoint
. Passpoint settings will appear below. - Specify Venue Name to a name for your site.
- Specify Venue Type with the option that best matches your site.
- Set Network Type to
Chargeable Public Network
- Set IP Address Type Availability:
- IPv4 to
Double NATed private IPv4
. - IPv6 to
Unavailable
- IPv4 to
- Add NAI Realms with the following two entries:
- Name:
freedomfi.com
EAP Method:EAP-TLS
Sub-Methods:Certificate
. - Name:
hellohelium.com
EAP Method:EAP-TLS
Sub-Methods:Certificate
.
- Name:
- Add Domain List:
freedomfi.com
or leave your home domain, if any. Press Add.

-
Set Security Protocol to:
WPA3 Enterprise
-
Enter the NAS-ID used during onboarding to Helium in the Custom field of NAS-ID.

- Choose Radius Profile:
Helium Radsec
Press Add WiFi Network.
Your Helium SSID is all set up. Verify access by forgetting the existing network on your device and connecting to the new network using a device with a supported carrier, such as Helium Mobile.
Apply security settings to the network to ensure isolation from the existing network(s). See this Ubiquiti guide on network and client isolation for more information.