Authenticating vlan-id with Radius/DHCP

RouterOS General
1

Hello,

I would like to provide radius authentication for DHCP, based on the vlan/interface that the request was received on. How can I get the mikrotik to send the vlan-id with the dhcp request ie in the radius access-request packet?

I should clarify this to say that the incoming trunk is terminated directly on to the mikrotik. If I have a cisco switch inserted before the mikrotik everything is ok. Problem is this is not the topology we have.

SO basically we need the mikrotik to optionally insert dhcp option 82 on incoming DHCP requests.

Appreciate your thoughts.

2

‘Called-Station-Id’ contains DHCP Server name - isn’t that enough?

3

No. This would be the same for each user, where as I want to base my authentication on the vlan-id of the user. Basing the authentication on the vlan-id also means that a customer can change their mac without having to talk to us.

4

but you’re creating DHCP Server per interface, so each VLAN will have its own DHCP Server name, won’t it?..

5

No, I’ve added all the vlans into a bridge, and set a horizon on each vlan so they cannot “talk” to each other.

6

hmmm, I don’t think that DHCP Server can know about VLANs in that case - it’s working on the bridge, so it doesn’t have information about underlying layer

7

THe dhcp server knows about the vlans from the Option 82 data.

8

but Option82 is being added by DHCP Relays - there’s no packet changes inside the bridge, and there’s no any info about bridged ports for the application receiving packets on the bridge. so the solution is simple - just do not bridge :slight_smile:

http://www.facebook.com/#!/photo.php?fbid=275923005774116&set=o.184655268266805&type=1&theater