USG FLEX H external captive portal with SignLogger RADIUS authentication

Created February 12, 2026 08:42 - Updated February 12, 2026 13:42

Serhii Boiarynov

With this third-party integrated option with RADIUS authentication, a guest user is redirected to a portal hosted on an external server. The guest user is authenticated by a RADIUS server when the user logs in to the external portal.

The following configuration is based on the above figure as an example. The address of the external SignLogger RADIUS/Portal server is 172.24.28.100/24 The guest network subnet of USG FLEX H is 192.168.169.0/24

Step 1:

On the server > Device Management. Create a USG FLEX H device.

Step 2:

On SignLogger server > RADIUS Management > RADIUS Clients. Create a RADIUS client for the USG FLEX H device.

Guest Network: type-in the subnet of the guest network. In this example is 192.168.169.0/24
Firewall IP: Type-in the captive portal SignLogger Radius server address set on your USG FLEX H
The default value is 6.6.6.6

Note: You need to type-in the captive portal SignLogger Radius server address instead of any interface IP address of your USG FLEX H.

Portal Name: Type-in portal name, and this name will be the URL path of the portal page on the SignLogger Radius server
In this example, portal name is “hotspot” and the SignLogger Radius server address is “172.24.28.100” and the port is 8080.
Then, the external portal URL is http://172.24.28.100:8080/hotspot

Redirect URL: Type-in the URL the guest will be redirect after login. You can type-in http://6.6.6.6 to show the login session page.

Step 4:

On SignLogger server > Hotspot management > Created Users. Create a test user account for login test.

Step 5:

On USG FLEX H > User & Authentication > User Authentication.
Name: The name of this authentication server object. In this example is ”signlogger”.
Server Address: The IP address of SignLogger server, 172.24.28.100 in this example.
Authentication Port: 1812
Key: The RADIUS secret created in step 2.
NAS IP Address: The management interface IP address of USG FLEX H, 172.24.28.254 in this example.

Step 6:

On USG FLEX H > Captive Portal > Authentication Policy > Policy. Enable captive portal.

Then, click Add to create authentication policy.
Incoming: select the interface connect to guest network. In this example is ge4 (192.168.169.0/24).
Sign-in Method: Choice Sign-on With and select the RADIUS authentication server created in step 5. In this example is “RADIUS/signlogger”.
Portal Type: Choice External, and type-in the external portal URL of SignLogger server created in step 3. In this example is http://172.24.28.100:8080/hotspot .