Mikrotik and Freeradius
RouterOS general discussion

5 posts   •   Page 1 of 1
migmac
just joined
 
Posts: 5
Joined: Sat Nov 17, 2012 5:33 pm

Mikrotik and Freeradius

by migmac » Fri Mar 15, 2013 5:49 pm

Hello,

I was able to connect the Mikrotik to a Freeradius server, it works fine with PPTP but it does not work with SSTP and L2TP. Is there anyway I can make it work with SSTP and L2TP?

thnak you

telepro
newbie
 
Posts: 43
Joined: Sun Apr 03, 2011 7:50 pm

Re: Mikrotik and Freeradius

by telepro » Sat May 18, 2013 8:08 pm

i have been successful (as I believe you have) in implementing PPTP VPN authentication using a FreeRadius. However, I have not been able to successfully use the response from FreeRadius to authenticate a WinBox login. For Winbox I needed to implement a Mikrotik User Manager, which was certainly not my preference. Have you been successful in authenticating Winbox Logins using FreeRadius?

I have not had reason yet to attempt SSTP or L2TP authentication.

thanks

tomaskir
Forum Veteran
Forum Veteran
 
Posts: 887
Joined: Sat Sep 24, 2011 2:32 pm
Location: Slovakia

Re: Mikrotik and Freeradius

by tomaskir » Sat May 18, 2013 9:52 pm

We authenticate users for WinBox login and L2TP from FreeRadius with MySQL.

For Winbox, you have to send back a group name as an attribute.

telepro
newbie
 
Posts: 43
Joined: Sun Apr 03, 2011 7:50 pm

Re: Mikrotik and Freeradius

by telepro » Sat May 18, 2013 10:34 pm

Thanks much for the info that it can be made to work. We'll give it a try. Since there are about 90+ standard attributes, do you remember in which attribute you sent the group name? The only standard Attribute with 'group' in its name that I find is "Tunnel-Private-Group-ID", which does not seem appropriate. Perhaps it is a vendor specific type value? If so, did you find the attribute type number defined some place?
thanks again, and have a great day

tomaskir
Forum Veteran
Forum Veteran
 
Posts: 887
Joined: Sat Sep 24, 2011 2:32 pm
Location: Slovakia

Re: Mikrotik and Freeradius

by tomaskir » Sat May 18, 2013 11:03 pm

Include this as a dictionary in FreeRadius.
http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary

Send Mikrotik-Group back as an attribute with the name of the group you want the user to be in for winbox.
Also, winbox uses CHAP, but console, ssh, telnet, use PAP.

5 posts   •   Page 1 of 1

Who is online

Users browsing this forum: dcuk, gabrielpike, ghira and 45 guests

It is currently Thu Dec 18, 2014 11:10 pm