We're a UK charity providing guest Wi‑Fi for visitors. Our network uses SonicWall firewalls, while the rest of the environment is built around UniFi switches, a Cloud Key+, wireless access points, CCTV, and DisplayCast Pro devices. The UniFi captive portal appears to be designed to work with a UniFi gateway, but we don't have one. Has anyone successfully used the UniFi guest portal with a SonicWall or another non‑UniFi gateway? I'm particularly concerned about whether the guest VLAN needs access to the Cloud Key, whether guests could simply browse to the Cloud Key's management address, and how the portal behaves on iOS and Android devices. We need guests to accept acceptable-use terms before accessing the internet, so alternative approaches—such as hosting the portal on the SonicWall—would also be useful.
3 Answers
For a simple acceptable-use click-through, the SonicWall’s own guest services or captive portal may be the easier option. It keeps the portal and enforcement on the firewall instead of exposing the Cloud Key to the guest VLAN. If you use the UniFi portal over HTTPS, make sure it has a certificate trusted by phones; a self-signed certificate can cause errors in the iOS or Android captive-network window. Also avoid allowing the connectivity-check destinations that devices use to decide whether they already have internet access, or the portal may not appear reliably. Record the acceptance time, device address, and version of the terms if you need an audit trail, keeping in mind that randomized MAC addresses can make the same phone appear as a new device.
The important distinction is between the portal ports and the controller administration port. UniFi commonly uses 8880 for HTTP guest redirection and 8843 for HTTPS, while the controller management interface uses 8443. Allow the guest VLAN to reach only the portal ports on the Cloud Key and keep 8443 blocked. A SonicWall can enforce the rest of the guest isolation and internet policy, so a UniFi gateway isn’t necessarily required for wireless guests.
You can host the UniFi guest portal on the Cloud Key without using a UniFi gateway. Put the guest Wi‑Fi and management devices on separate VLANs, then allow the guest network to reach only the specific portal services it needs. Block access to the Cloud Key’s management interface so visitors can’t reach the controller login page directly. The built-in portal can include a terms-and-conditions checkbox.
That clears up my concern—I was worried that allowing portal access would also expose the Cloud Key’s administration page.