Skip to main content

TP-Link Omada Controller

Configure TP-Link Omada SDN Controller with IronWifi's RADIUS authentication and external captive portal. This guide covers RADIUS profile creation, portal profile configuration, free authentication policy (walled garden) setup for guest access, wireless network creation, and WPA-Enterprise deployment for secure corporate networks.

Prerequisites​

  • Omada Controller v3, v4, or v5 (hardware or software)
  • Admin access to Omada Controller interface
  • TP-Link Omada access points adopted by the controller
  • Network configured for guest WiFi

In IronWifi Console (complete these first):​

  1. Create a Network in IronWifi Console
  2. Create a Captive Portal with vendor TP-Link
  3. Note your RADIUS settings (Primary IP, Backup IP, Secret) and Splash Page URL

Omada Controller v4/v5 Configuration​

Step 1: Configure RADIUS Profile​

  1. Navigate to Settings → Profiles → RADIUS Profile
  2. Click Create New RADIUS Profile
  3. Configure:
    • Name: IronWifi
    • Authentication Server IP: {Primary IP}
    • Authentication Port: 1812
    • Authentication Password: {Secret}
    • Accounting Server IP: {Primary IP}
    • Accounting Port: 1813

Step 2: Create Portal Profile​

  1. Navigate to Settings → Profiles → Portal
  2. Click Create New Portal
  3. Configure:
    • Name: IronWifi-Portal
    • Authentication Type: External RADIUS Server
    • RADIUS Profile: IronWifi
    • External URL: {Splash Page URL}
    • Landing Page: External URL

Step 3: Configure Free Authentication Policy​

Configure destinations that guests can access before authentication. This is essential for the captive portal to function correctly.

Add allowed destinations:

  • IP: 107.178.250.42

If you're using social login or payment providers, add these domains to your Free Authentication Policy:

ProviderRequired Entries
Google*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
LinkedIn*.linkedin.com, *.licdn.com, linkedin.com
Twitter/X*.twitter.com, *.twimg.com, twitter.com, *.x.com, x.com
Apple*.apple.com, *.icloud.com, appleid.apple.com
Microsoft/Azure AD*.microsoft.com, *.microsoftonline.com, *.msftauth.net, login.microsoftonline.com
Stripe*.stripe.com, js.stripe.com
PayPal*.paypal.com, *.paypalobjects.com
Twilio (SMS)*.twilio.com

Step 4: Create Wireless Network​

  1. Navigate to Settings → Wireless Networks
  2. Click Create New Wireless Network
  3. Configure:
    • Name: Guest-WiFi
    • Security: None (for captive portal)
    • Portal: Enable
    • Portal Profile: IronWifi-Portal

WPA-Enterprise Configuration​

For 802.1X without captive portal:

  1. Create Wireless Network
  2. Configure:
    • Security Mode: WPA2-Enterprise
    • RADIUS Profile: IronWifi

Older Omada Versions​

Omada v3​

  1. Navigate to Wireless Control → Portal
  2. Configure external portal settings
  3. Add RADIUS server under authentication

Standalone EAP​

For EAPs not managed by Omada:

  1. Access EAP web interface
  2. Navigate to Wireless → Portal
  3. Configure external portal and RADIUS

Troubleshooting​

If you encounter issues after configuration, use this table to diagnose and resolve common problems:

SymptomCauseSolution
Portal not appearingPortal configuration or Free Authentication misconfigurationVerify Portal is enabled on SSID, check External URL is correct, confirm Free Authentication includes splash page IP (107.178.250.42)
RADIUS connection failedIncorrect RADIUS settings or network connectivityTest RADIUS profile connectivity in controller, verify IP, port, and secret, check firewall rules allow RADIUS traffic
Authentication issuesUser credentials or logging problemsReview controller logs under Insights, check IronWifi authentication logs in Console, verify user credentials are correct