Sangfor NGFW + UniFi Controller + MikroTik User Manager with MAC Filtering
  

Samianto Lv1Posted Oct-17-2025 11:47

Objective
Enable centralized RADIUS authentication using MikroTik User Manager, with MAC address filtering for access control across UniFi Wi-Fi and Sangfor NGFW.

Network Overview
Client Device (MAC) → UniFi AP → UniFi Controller → Sangfor NGFW → MikroTik (User Manager RADIUS)

Configuration Steps

1. MikroTik User Manager (RADIUS Server)
Install and run User Manager. Add UniFi and Sangfor as RADIUS clients:     

Add users using MAC address as username:
Format MAC as AABBCCDDEEFF (no separators) if required by UniFi.

2. UniFi Controller
Go to Settings > Profiles > RADIUS.Add MikroTik as RADIUS server (port 1812, shared secret).Enable WPA2-Enterprise on SSID.Enable MAC-based RADIUS authentication:
  • Use MAC address as username.
  • Disable MAC randomization on client devices.


3. Sangfor NGFW
Go to Authentication > RADIUS Server. Add MikroTik as RADIUS server. Enable MAC binding:
  • Go to IAM > IP & MAC Binding.
  • Bind MAC to IP or user account.


Apply RADIUS authentication to policies (e.g., captive portal, web access).

Testing
Connect the device to UniFi WiFi. The device sends MAC as the identity to RADIUS. MikroTik authenticates MAC. Sangfor enforces access policy based on MAC binding.

Tips
  Disable MAC randomization on mobile devices. Use VLAN assignment via RADIUS if needed:
  • Tunnel-Type: 13
  • Tunnel-Medium-Type: 6


Monitor logs in UniFi, Sangfor, and MikroTik for troubleshooting.

This topic contains more resources

You must log in to download or view the file. Not registered yet? Register

x

Like this topic? Like it or reward the author.

Creating a topic earns you 5 coins. A featured or excellent topic earns you more coins. What is Coin?

Enter your mobile phone number and company name for better service. Go

admin Posted Nov-11-2025 08:58
  
Thanks for sharing. Your article has been adopted by Sangfor Community and rewarded with 4000 coins.