Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

[Wangz]

My understanding right now is that the AP should respond to Mikrotik request.

Except that the very point of arp=reply-only is that no request ever comes This setting is a poor man’s substitution of 802.1x. It prevents RouterOS from sending ARP requests on that interface and thus from dynamically populating the ARP table (IP->MAC address translation) on demand; instead, the ARP record is created when a DHCP lease is given to the client (and removed when the lease expires), so devices which manually set the IP from the proper subnet cannot receive any traffic from the Mikrotik. But this must be explicitly enabled in the DHCP server configuration. Or you can create the ARP records manually (using the ones added dynamically while arp=enabled as a base) and then set arp=reply-only if the APs do not obtain their addresses from the Mikrotik.

An eventual attacker may beat arp=reply-only if he first sniffs both the MAC addresses and the IP addresses related to them from live traffic (which is quite simple) and then spoofs them. Only the real 802.1x is secure as the MAC address alone is not enough for authentication, the device must know the proper secret.

Hi sindy, thanks for the answer. So are there any workaround in this? i cannot create arp records manually (the dynamic way) because the AP’s have static ip and the ip subnet of hotspot 10.0.0.0/24 and AP’s 192.168.5.0/24 are not the same. I have already set arp-reply only if Ap’s do not obtain their addresses from the mikrotik (static ip) and also a static arp. Also i am not using any form radius server that 802.1x you are referring.