Ubiquiti Conversion Guide

Data-Only Mobile configuration requires the Passpoint protocol. Please ensure your Ubiquiti network is using UniFi Network Controller version 8.4.54 or higher and AP firmware version 6.6.77 or AP firmware version 7.0.66 or higher, depending on the hardware release track.

Obtain RadSec Certificates

Each onboarded network requires a unique NAS-ID. For Ubiquiti networks, it is recommended to use the MAC address of the network controller as the NAS-ID.

Run the UniFi network controller locally or log into the cloud UniFi Site Manager.

Navigate to UniFi Devices, choose your Network Controller and copy the MAC Address.

Retrieve the MAC address of the network controller.

Use this NAS-ID in the WiFi Conversion Onboarding flow and return to this guide after the network is onboarded and certificates have been delivered.

If updating from older RadSec certificates:

If early access certificates were previously deployed on the network, a Ubiquiti bug may prevent new certificates from propagating.
Restart all APs on the network after updating the certificates, and the new certificates should be applied.

Configure UniFi Network Controller

After retrieving certificates, configuration is a two-part process: create the RADIUS profile, then apply it to a new Wi-Fi SSID named Helium.

UniFi Settings screen within the UniFi Site Manager.

Create a RADIUS Profile

Configure a TLS connection to the Helium Cloud AAA server (aka Radiator), which performs Authentication, Authorization, and Accounting for the end customers. Enabling RADIUS communication over TLS (RadSec) increases the level of security for authentication that is carried out across the cloud network.

In the sidebar, choose Settings, then Networks, then scroll to the bottom to Radius Servers.

Settings > Networks > Radius Servers.

Click Create New.

Specify a profile name, for example "Helium RadSec".

Configure RADIUS properties:

1. Under Radius Settings, check the TLS box.
   1. Click Upload next to Client Certificate, choose the path to cert.pem.
   2. Click Upload next to Private Key, choose the path to key.pem. Leave the Private Key password empty.
   3. Click Upload next to CA Certificate, choose the path to ca.pem.

Load the certificates from the network onboarding.

2. Specify Authentication Servers:

   Add these three servers:

   1. Enter IP Address: 52.37.147.195 Port: 2083 Shared Secret: radsec. Click Add.
   2. Enter IP Address: 44.229.62.214 Port: 2083 Shared Secret: radsec. Click Add.
   3. Enter IP Address: 44.241.107.197 Port: 2083 Shared Secret: radsec. Click Add.

3. Check the Accounting checkbox. RADIUS Accounting Server settings will appear.

note

If the Accounting Servers checkbox is greyed out as in the image below, create the RADIUS profile with only the Authentication Servers, save, then reopen and edit the profile to add Accounting Servers. This is a current Ubiquiti UI bug.

Accounting checkbox greyed out. Workaround: save and reopen the RADIUS profile.

4. Specify the following Accounting Servers:

5. Enter IP Address: 52.37.147.195 Port: 2083 Shared Secret: radsec. Click Add.

6. Enter IP Address: 44.229.62.214 Port: 2083 Shared Secret: radsec. Click Add.

7. Enter IP Address: 44.241.107.197 Port: 2083 Shared Secret: radsec. Click Add.

8. Check the Interim Update Interval box.

9. Set Interim Update Interval to 300 seconds (standard for the Helium Network).

Configure RADIUS settings.

Click Apply Changes to create the new RADIUS profile.

Create the Helium SSID

Navigate to Settings in the sidebar, choose WiFi, then click Create New.

Create a new Wi-Fi network.

Configure settings for the new network.

1. Set the Name of the SSID to Helium. Leave the password blank.
2. Under Application select Hotspot.
3. Under Hotspot Type select Passpoint. Passpoint settings will appear below.
4. Specify Venue Name to a name for your site.
5. Specify Venue Type with the option that best matches your site.
6. Set Network Type to Chargeable Public Network.
7. Set IP Address Type Availability:
   1. IPv4 to Double NATed private IPv4.
   2. IPv6 to Unavailable.
8. Add NAI Realms with the following two entries:
   1. Name: freedomfi.com EAP Method: EAP-TLS Sub-Methods: Certificate.
   2. Name: hellohelium.com EAP Method: EAP-TLS Sub-Methods: Certificate.
9. In Domain List, add freedomfi.com (or your home domain if applicable). Click Add.

Create a new Wi-Fi network.

10. Set Security Protocol to WPA3 Enterprise.

11. Choose External RADIUS Profile: Helium RadSec.

Set to WPA3 Enterprise.

12. Under NAS ID, enter the NAS-ID used during Helium onboarding in the Custom field of NAS-ID.

Identify the NAS ID using the MAC address.

13. Ensure Client Device Isolation is checked for secure networking. See the Ubiquiti guide on network and client isolation for more information.

Click Add WiFi Network.

Your Helium SSID is now configured. To verify, forget the existing network on your device and connect to the new network with a device that has a supported carrier, such as Helium Mobile.

Video Walkthrough

Quality Metrics Integration

Quality metrics integration lets Helium read Wi-Fi quality metrics from your UniFi controller over a private WireGuard VPN tunnel. Helium uses these metrics to monitor the Wi-Fi experience carrier subscribers get on your network. Depending on the venue tier and the partner carrier's requirements, this integration may be required. Contact the Helium sales team for details about your site.

Setup has three parts: a view-only metrics user, a WireGuard VPN client, and a firewall policy that allows the metrics poller to reach the controller.

Before you begin, make sure you have:

• UniFi Network 9.0 or higher. The firewall policy uses the zone-based firewall introduced in 9.0.
• A UniFi gateway (UDM, UCG, or UXG). The VPN client and firewall policies run on the gateway, so self-hosted controllers without a gateway can't complete this setup.
• Admin access to the UniFi controller.
• Metrics user credentials (username and password) and a WireGuard configuration file. Request both from your Helium Plus contact.

Create a Metrics User

1. Click the People icon at the bottom of the left sidebar.
2. Click Create New, then Create New Person. Depending on the controller version, this option may be labeled Add New Person or Create New User.
3. Enter a First Name, for example "WiFi QM Poller". Leave Last Name and Email blank.
4. Check the Admin box.
5. Check Restrict to Local Access Only. On some controllers this box is already checked and greyed out.
6. Fill in Username and Password with the credentials provided by the Helium team.
7. Leave Use a Predefined Role unchecked.
8. Select View Only next to the Network app icon.
9. Select None for all other apps.
10. Click Create.

Create a local, view-only metrics user.

Configure the WireGuard VPN Client

1. Click the Settings icon at the bottom of the left sidebar.
2. Open the VPN section.
3. Select VPN Client and click Create New.
4. Make sure the WireGuard type is selected.
5. Enter a Name, for example "WiFi QM Metrics".
6. Under Setup, select File and click Upload Configuration File to upload the WireGuard configuration file provided by Helium.
7. Leave Device Wizard and Content Wizard set to Off. Either wizard creates a policy-based route that can send client traffic through the tunnel.
8. Click Create.

Create a WireGuard VPN client from the configuration file.

Confirm the connection Status shows Established in the VPN Client list.

The WireGuard VPN client connection is established.

Create a Firewall Policy

1. Click the Settings icon at the bottom of the left sidebar.
2. Under Policy Engine, select Policy Table.
3. Click Create New Policy at the top.
4. Make sure Firewall is selected.
5. Enter a Name, for example "Allow WiFi QM Poller access".
6. Set Source Zone to External and select the IP option.
7. Under Specific, add 10.13.13.1/32 as IP Address / Subnet. This is the metrics poller's address inside the WireGuard tunnel and is the same for every deployment.
8. Under Action, select Allow.
9. Set Destination Zone to Gateway.
10. Under Destination Zone, set Port to Specific and select HTTPS as the Service.
11. Click Add Policy.

Allow HTTPS access from the metrics poller to the gateway.

Notify the Helium Team

Once the VPN client shows Established and the firewall policy is in place, let your Helium Plus contact know that setup is complete. The Helium team will confirm that quality metrics are flowing from your controller.