13 Replies Latest reply: May 9, 2013 7:16 PM by chemchem_
christian.aust Level 1 (20 points)

My AirPort Extreme (model A1354) is connected to the local LAN, just like my Mac Mini OSX Server. Before I upgraded to 10.8, Radius authentication worked fine using Snow Leopard Server 10.6. Now the manual reads that my AE should show up in the sidebar of the server app but it doesn't. I can't enable or configure the internal Radius service anymore.


I've tried rebooting and resetting the AE, it did not help. Can somebody confirm that this is a working combination?

Mac mini, OS X Server, Gigabit LAN
  • Strontium90 Level 4 (3,860 points)

    It is a working combination but you need a lot of prerequisites to make this happen:


    1:  The Airport MUST be in DHCP & NAT mode (I know, I know, who uses it in that mode)

    2:  Your server and the Airport must be on the same subnet (you are limited by the options of the Airport)

    3:  The Airport and the Server must be on the same wired network

    4:  Quit Server.app and then launch it again when all the requirements are set


    Once you set it all up, you can then connect to the Airport and convert to Bridge mode.  Provided you set the IP address of the Airport in advance, the RADIUS config will continue to work.


    Yes, this is a pain in the ....

  • christian.aust Level 1 (20 points)

    Thank you, I've read about this and in fact tried it before. It did not work.


    • Both the mini server and the AE are on the same wired network
    • Both devices are set to static IPs within the same /24 subnet
    • The AE has software version 7.6.1, like it had for some time before the migration to OS X 10.8
    • The AE's network mode is "DHCP & NAT", with a different subnet
    • Accordingly, the Airport Utility app warns me about double NAT and that my AE is configurable via the LAN device. So be it.
    • I logged onto the server and started the Server.app, which hasn't been active while preparing the settings.
    • Nothing is under hardware besides the server itself.


    What else could be wrong? Besides 10.8, that is...

  • Strontium90 Level 4 (3,860 points)


    • The AE's network mode is "DHCP & NAT", with a different subnet



    If I understand this, this is likely what is wrong.  The server and the Airport must be on the same subnet from what I've found.  I've also only been able to make the airport seen if I connect the server directly to the airport for the initial setup. 


    Keep in mind this all can should be possible using serveradmin command line tool.  I am setting these conditions up in a lab but will not get to it until next week.

  • christian.aust Level 1 (20 points)

    If I understand this, this is likely what is wrong.  The server and the Airport must be on the same subnet from what I've found.  I've also only been able to make the airport seen if I connect the server directly to the airport for the initial setup. 


    Using DHCP and NAT will give me two networks:


    1. One on the ethernet WAN-side of the AE
    2. One on the wireless side of the AE


    Wireless clients connecting to this AE would receive an IP from subnet aa.aa.aa.0 while the AE itself would have an outbound IP within the subnet of bb.bb.bb.0 How could they all be on the same subnet?


    I wonder if for any reason the network itself coud cause problems: I'm using for my internal network.

  • mtecson Level 1 (0 points)

    Sounds like you are trying to create a subnet just for your wifi users. This subnet has its own NAT & DHCP. Your RADIUS server is connected on the WAN side of the Airport which has a different subnet than what is used for wifi. Is that right?


    While this ought to work in theory, I would be surprised if Server.app would allow you to do this. It's possible you could set it up with serveradmin on the command line or by manually configuring the Airport to use your RADIUS server.


    I think Apple's expected setup is that you have one Airport used as the Internet gateway and that both the wired and wireless segments of the internal network share the same subnet. Server.app will happily let you configure it that way.

  • christian.aust Level 1 (20 points)

    @mtecson: I tried this only because @Strontium90 wrote that the AE has to be in DHCP/NAT mode to be successfully detected by server.app. Certainly it should not be that way: AE should only act as a network bridge, without its own DHCP. It worked always before installing ML server.


    For the record: I haven't been able to get this working until now. Anyone?

  • David Kurtz2 Level 1 (55 points)


    Does it help (does your aebs show up in Server.app) if you run:

    "sudo killall servermgrd"


  • Strontium90 Level 4 (3,860 points)

    It appears that this is a limitation of Apple's Server.app.  In order for Server.app to "see" the base station for UI config, it MUST be in DHCP & NAT mode.  Put it in this state, connect your server to it and configure RADIUS.  Then connect your server back to the primary LAN and change the mode of the Airport back to Bridge.  As long as you have set a fixed address on the Airport everything will continue to work.  However, once you switch to Bridge, then the BS will not appear in Server.app.

  • christian.aust Level 1 (20 points)

    @Strontium90: Thanks for your continued support, I really appreciate that.


    What do you mean: "Connect your server to it"?


    Both server and AE are connected to the same wired ethernet gigabit LAN, with static IPs from the subnet for both. The server has WIFI enabled, although it's not connected to a network. The servers firewall is disabled.


    Are you suggesting to (1) unplug the wired ethernat cable from the server and (2) connect it to the WLAN of the AEBS in DHCP/NAT mode? From that perspective, the 10.99.99.x address of the AEBS would be the WAN-side of the router, would it be able to connect to that?


    I assume that all services of the OSX Server would go nuts if I switched the network interface to a completely different subnet, would they?

  • Strontium90 Level 4 (3,860 points)

    If you want to do this through the GUI, then do this.


    1:  Let's assume you have a functional network on the subnet.  This means that a DHCP server, DNS, and other support services are running.  Let's assume you have an existing Router at and your existing OS X server is at 


    2:  Power on your Airport but don't plug it into your network.  If you do, and it is in DHCP/NAT mode, it will start handing out IP addresses on the subnet (this is the default)


    3:  Instead, grab a laptop or other workstation and connect the two units in isolation.  Once you do this, configure the Airport to have a fixed IP address on the subnet.  Let's say address 


    4:  Now that the unit is configured to be on the same subnet as the server and remaining infrastructure, go to your server and ensure that you have an SSL certificate in place if desired. 


    5:  Disconnect your server from the LAN and plug it directly into the Airport.  If you must, temporarily change the router address of your server from to to trick the server into believing the Airport is the gateway (which seems to be what Apple wants it to be).  When you connect directly, yes, the unit will still be broadcasting DHCP.  But the server is using a fixed address so who cares.


    6:  Quit an launch Server.app.  The base station should appear in the list of hardware.


    7:  Select the device and complete the setup options to enable RADIUS auth on the airport.  Use sudo serveradmin settings radius to see what was done.


    8:  Once the Radius config is complete, connect to the Airport from the server (over ethernet) using Airport Utility and change the mode from NAT/DHCP to Bridge.  Save settings and let the unit reboot.


    9:  Connect both the Airport and the server back to your LAN (remember to change the router address of the server back to if you changed it).


    10:  Connect a wireless device and get RADIUS joy.

  • eschw95458 Level 2 (235 points)


         Thanks for the guide, much appreciated, however (and it has been awhile since I have set os x server up (10.5)  I could not get it to work, I suspect apple has changed something in the latest airport utility. 

      What I had to do and what I found is key (following the rest of your guide )

    1) Airport base station should be in bridge mode to start

    2) Set the static address on the ABS.  MAKE in the router section on your ABS static address to use the ip of the apple base station, so for example your ABS statip ip is then the router should also be

    3) change router on os x server to same ABS number

    4)  Do not try to set the ABS to NAT/ DHCP leave it in bridge mode

    5) After you are done setting radius change router numbers back to your proper number

  • eschw95458 Level 2 (235 points)

    Nevermind what I said, you can't have the static ip and the dhcp in the same network, I missed that in the previous guide. -1 for me not paying attention LOL

  • chemchem_ Level 1 (0 points)

    I'm not sure. But you have to check your DNS address in your Mac-mini.

    During the 1st setting of OS X Server App, normally DNS service start automatically, and Server App changed DNS address like


    Change Mac-mini's DNS from to 10.99.99.x - same as your Mac-mini's IP, then restart Server App.


    I think you can see the AirPort in the Server App.


    Please let me know when it works.