Creating a RADIUS configuration in OneIdP RADIUS does not, by itself, enable authentication. Your NAS — the Wi-Fi access point, wireless controller, switch, or VPN gateway that users actually connect through — must also be configured to send its authentication requests to the Scalefusion RADIUS server.This configuration is performed directly within your network device's administration console, rather than in the Scalefusion dashboard.
Until this step is completed, the NAS has no way of knowing that a RADIUS server exists for it to use, and users attempting to connect will not be authenticated through OneIdP RADIUS at all — regardless of how the OneIdP RADIUS-side configuration is set up.
What you'll need before you start
Before opening your NAS or VPN gateway's admin console, make sure the following are ready from the corresponding RADIUS configuration in OneIdP RADIUS:
Value | Where to find it in OneIdP RADIUS |
|---|---|
RADIUS Server IP (Primary/Secondary Server IP) | Step 1: RADIUS Server Details |
Shared Secret | Step 2: NAS/AP/Router Configuration |
RADIUS Server CA Certificate ( | Step 1: RADIUS Server Details |
Authentication port | Typically |
You'll also need administrator access to the NAS, access point, wireless controller, or VPN gateway itself. If your network infrastructure is managed by a third party or a separate networking team, this is the point where they'll need to be involved.
Make sure any firewall between your network and Scalefusion allows outbound RADIUS traffic on UDP ports 1812— this is a common reason RADIUS requests never reach the server.
Locating the Radius setting on your devices
Most networking hardware groups this setting under a section named something like RADIUS Server, AAA Server, External Authentication Server, or simply Authentication. Exact naming and location depend entirely on your NAS vendor and model — the general concept is the same everywhere: you're telling the device where to send authentication requests, and what shared secret to use when doing so.
Configuring a Wi-Fi access point or wireless controller
Open the settings for the specific SSID (Wi-Fi network name) that should be secured through RADIUS.
Change the network's security/encryption mode to the Enterprise mode (ex.WPA2 Enterprise). This is the setting that tells the access point to authenticate each connecting device against an external server, rather than a single shared Wi-Fi password.
When prompted, add a new RADIUS server entry and enter:
The RADIUS Server IP from RADIUS configuration.
The authentication port (
1812, unless your device specifies otherwise)The Shared Secret from RADIUS configuration.
Save the SSID/security settings.
In the matching RADIUS configuration, the NAS/AP IP Address field should be set to your organization's public IP address (the IP your ISP has assigned you) — not the local IP of the individual access point. Since access points on the same network typically share one public IP, this single entry usually covers all of them; you don't need to list each access point separately unless they genuinely egress through different public IPs.
Configuring a VPN gateway
Open the Authentication or AAA server group section of your VPN configuration.
Add a new authentication server of type RADIUS.
Enter the RADIUS Server IP, port, and Shared Secret from RADIUS configuration, the same as above.
Assign this RADIUS server as the authentication method for the relevant VPN profile or user group on the gateway — some gateways support multiple authentication methods (e.g., local accounts and RADIUS) simultaneously, so make sure RADIUS is actually applied to the profile your users will connect through.
Save the configuration.
In the matching RADIUS configuration, set the NAS/AP IP Address to the IP address of your VPN server itself (where the VPN service is hosted).
Note: If your VPN gateway connects from a different public/source IP address than your Wi-Fi access points, you need a separate NAS/AP IP Address entry — or a separate RADIUS configuration entirely — using the VPN server's specific IP. Otherwise, VPN authentication requests will be rejected even if Wi-Fi RADIUS is working correctly.
Configuring multiple access points or gateways
If your network has more than one access point, controller, or gateway that needs to authenticate through this RADIUS configuration:
Repeat the same setup — server IP, port, and Shared Secret — on every device individually. Most enterprise Wi-Fi systems let you push this configuration centrally from a wireless controller rather than configuring each access point one by one; check whether your hardware supports this before configuring devices individually.
In RADIUS configuration, make sure the IP address of every device that will send RADIUS requests is added under NAS/AP IP Address in Step 2 of the RADIUS configuration. RADIUS will silently reject requests from any IP address not listed there, even if the server IP and shared secret are otherwise correct.