Configure the hotspot to use RADIUS shared password authentication

RADIUS shared password authentication requires each user to enter a password. This password is validated by an external RADIUS server, and the password is the same for all users.

Create a user on the RADIUS server with the username guest. The password assigned at the RADIUS server for the user guest is the shared password that your hotspot users should enter to authenticate to the hotspot via the RADIUS server.

By default, the router redirects unauthenticated users to the HTML authentication page located on the router at etc/config/hotspot/password.html. You can customize the authentication page as needed, or host an authentication page on a remote server. See Customize the hotspot login page for further information.

Required configuration items

Create a new hotspot or Enable hotspot using the default configuration.
Select RADIUS shared password authentication.
IP address or hostname of the primary RADIUS server.
A user on the RADIUS server with the username guest.
RADIUS server secret.
RADIUS NAS ID.
Domain name or subnet of the RADIUS server included in the "white list" of servers that unauthenticated hotspot clients can access.

Additional configuration items

IP address or hostname of the secondary RADIUS server to be used if the primary RADIUS server is unreachable.
Modify the local HTML authentication page, /etc/config/hotspot/password.html, or enter the name of an alternative HTML authentication page stored in the same directory, or identify a remote web server to host the HTML authentication page and include that server in the "white list" of servers that unauthenticated hotspot clients can access. See Customize the hotspot login page for further information.

Hotspot LAN configuration:

 Configure hotspot for RADIUS shared password authentication from the WebUI

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Create a new hotspot or Enable hotspot using the default configuration.
During hotspot configuration, for Authentication mode, select RADIUS shared password .
Click to expand Radius.
1. For Primary server name, enter the IP address or fully-qualified domain name of the primary RADIUS server to use to authenticate hotspot users.
2. (Optional) For Secondary server name, enter the IP address or fully-qualified domain name of the backup RADIUS server to use to authenticate hotspot users if the primary RADIUS server is not available.
3. (Optional) For Port, type the port number to use for RADIUS authentication requests. The default is 1812.
4. (Optional) For Accounting port, type the port number to use for RADIUS accounting requests. The default is 1813.
5. For Secret, enter the shared secret for the RADIUS server. This is configured on the RADIUS server.
6. For NAS ID, enter the unique Network Access Server (NAS) identifier used by the RADIUS server. The default is hotspot.
7. (Optional) Enable Swap Octets to swap the meaning of the input octets/packets and output octets/packets RADIUS attributes. This can fix issues if the data limits and/or accounting reports appear to be reversed on the RADIUS server. The default is disabled.
Click to expand Walled garden.
Walled garden settings define the "white list" of domains and subnets that unauthenticated clients are able to access. Include the domain or subnet of the RADIUS server(s) that are being used for authentication.
- To add domains that can be accessed by the client prior to authentication:
  1. Click to expand Allowed domains.
  2. Click  to add a domain.
  3. For Domain, type the hostname of the allowed domain.
  4. Repeat to add additional domains.
- To add subnets that can be accessed by the client prior to authentication:
  1. Click to expand Allowed subnets.
  2. Click  to add a subnet.
  3. For Subnet, type an IPv4 address and optional subnet mask, using the format IPv4_address[/netmask], or the keyword any.
  4. Repeat to add additional subnets.
Click Apply to save the configuration and apply the change.

 Configure hotspot for RADIUS shared password authentication from the Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```
Create a new hotspot or Enable hotspot using the default configuration.

Set the authentication mode to radius-shared-password:

(config)> network hotspot hotspot_name auth radius-shared-password
(config)>

Configure the RADIUS server:
1. Set the fully qualified domain name or IP address of the primary RADIUS server:
```
(config)> network hotspot hotspot_name radius primary_radius_server address
(config)>
```
2. (Optional) Set the fully qualified domain name or IP address of the secondary RADIUS server, used if the primary RADIUS server is unreachable:
```
(config)> network hotspot hotspot_name radius backup_radius_server address
(config)>
```
3. (Optional) Set the port number to use for RADIUS authentication requests.
```
(config)> network hotspot hotspot_name radius auth_port port
(config)>
```
  The default is 1812.
4. (Optional) Set the port number to use for RADIUS accounting requests.
```
(config)> network hotspot hotspot_name radius acct_port port
(config)>
```
  The default is 1813.
5. Set the shared secret for the RADIUS server. This is configured on the RADIUS server.
```
(config)> network hotspot hotspot_name radius secret secret
(config)>
```
6. Set the unique Network Access Server (NAS) identifier used by the RADIUS server:
```
(config)> network hotspot hotspot_name radius nas_id id
(config)>
```
  The default is hotspot.
7. (Optional) Enable Swap Octets to swap the meaning of the input octets/packets and output octets/packets RADIUS attributes. This can fix issues if the data limits and/or accounting reports appear to be reversed on the RADIUS server:
```
(config)> network hotspot hotspot_name radius swap octets true
(config)>
```
  The default is disabled.
Set walled garden settings.
Walled garden settings define the "white list" of domains and subnets that unauthenticated clients are able to access. Include the domain or subnet of the RADIUS server(s) that are being used for authentication.
- Add domains that can be accessed by the client prior to authentication:
```
(config network hotspot new_hotspot)> add walled_garden domains end domain_name
(config network hotspot new_hotspot)>
```
  Repeat to add additional domains.
- Add IP addresses and subnets that can be accessed by the client prior to authentication:
```
(config network hotspot new_hotspot)> add walled_garden subnets end value
(config network hotspot new_hotspot)>
```
  where value is an IPv4 address and optional subnet mask, using the format IPv4_address[/netmask], or the keyword any.
  Repeat to add additional IP addresses or subnets.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.