Fortigate RSSO NPS and Ubiquiti Controller

[microchipmatt]

Hello Everyone, we switched to the Unifi Network Server (Unify Controller): https://ui.com/download/releases/network-server  and Ubiquiti APs to save money. We used to have Ruckus and it was dead simple to set up the Fortigate RSSO, Ruckus Controller, and NPS radius RSSO Collection and Auth. I used to follow these instructions here:

https://travelingpacket.com/2015/07/23/fortigate-radius-sso-with-ruckus-802-1x-logins-using-nps/

Now I am trying to do the same in the Ubiquiti world, but I cannot find ANY coherent instructions on how to do a similar setup to the instructions above. I was wondering if anyone has some coherent instructions to do the same RSSO setup detailed in the instructions I provided but for the Unify Network Server/Controller, with Fortigate and Windows NPS. All of the how-to's I've come across are half-baked. 

Keep in mind I already have a working WPA2-Enterpise Configuraiton, that is working with NPS Policy AND the Unify Network application. The only difference in the Ubiqioti world is that Unlike in the Ruckus world where the Ruckus Control is the gatekeeper to manage all Radius Auth with the Windows NPS server, in the Ubiquiti world you specify the Radius Connection to the NPS server on the Unifi Network Server, and then it PUSHES the radius conf to all APS, and the APS talk directly to the NPS server. You just approve the SUBNETs for all the traffic the APs are coming from as a client with a secret on the NPS server, and boom all the APs happily talk to the NPS server and follow the NPS Network policy for 802.1X which looks at the AD groups. So that's all working, I'm just trying to wrap my head around, what "Entity" in the Ubiquitu world is sending Fortigate the Radius Accounting information so that Fortigate can Collect the users and the group they are a part of and feed that info to RSSO on the FortiGate.  It ALMOST seems like the APs should, or the subnet the APs are on should. I tried Setting up the Radius accounting Server option on the UnifY network Server, similar to how Ruckus does it, and tried specifying the Fortigate as the IP for the accounting server, but that didn't seem to work. Any ideas?  Does anyone have a Great how-to? 

How

[pminarik]

The FortiGate RSSO listener doesn't configure the IP of the source, it just validates the secret key. So there should be no issues with receiving RADIUS accounting from multiple APs.

The last time I've heard of Unify and RSSO (a couple years ago), the critical problem was that the Unifi devices didn't bother sending Framed-IP-Address in the accounting messages, which rendered them completely useless for RSSO purposes. Has this been fixed since, or is accounting from Unify still useless? :)

If not sure, you can do a packet capture of the packets and look inside them. (UDP/1813 by default)