Greetings, I just picked up a cAP AX wireless access point and I would like to set it up for dynamic vlans. I read this article: http://forum.mikrotik.com/t/step-by-step-tutorial-on-enabling-dynamic-vlans-using-capsman-and-the-new-user-manager-on-ros7/158410/1 but it seemed to use CAPSMAN in order to set this up. So I figured out how to get packages and installed the Wireless package and disabled the wifi-qcom package. However, no wireless interfaces show up at all when I do this so I went back to the wifi-qcom package and they came back.
I was able to set up a VLAN trunk to our switch, assign it a couple of VLANs, and authenticate with the Radius server. However I can’t seem to figure out how to take the Tunnel-Private-Group-ID RADIUS attribute to assign which VLAN the wireless client should be connected to.
I have this same setup working on our older Cisco switches and also OpenWRT. But I’d like to switch over to Mikrotik for all of our wireless access points as we move towards WPA3/Wifi6.
Perhaps a different question.
I understand that this unit uses a different set of Radius attributes. Unfortunately, the documentation is missing. The entire wiki seems to have gone missing.
Does anyone know how to set this up? https://wiki.mikrotik.com/Wiki/Manual:RADIUS_Client/vendor_dictionary
EDIT: the article shows the mikrotik user-manger radius implementation but the 3 attributes are standardized no matter if it is a cisco ISE, an aruba clearpass, mikrotik user-manager or even a MS NPS
I have dynamic vlan assignment working with cAP ax and freeradius (works both with and without capsman), but only when I use WPA-EAP. Weirdly enough, when using WPA-PSK, the radius server is not even contacted. I am planning to write to support about this soonish. As a workaround, the new PPSK functionalit http://forum.mikrotik.com/t/new-ppsk-functionality/179026/1 could be used.
Aha! That’s where the link should go. Google still has everything pointing to old links in the wiki that are empty. There should be redirects. Looks like they just removed the path /Wiki/ from the URL.
Thank you! I just added the two attributes to NPS and am going to try this over the weekend.
Right… now that you put it that way, it makes sense. So with PSK, we want MAC address authentication. This has to be done though an Access List entry with query-radius action. I have tried this in the past, and it didn’t work.
That said, I just tried again, and while I don’t have it working yet I think I can get there. I have the following problems to solve:
Get an access list entry to actually match one of my mac addresses. If I put a mac address into the access list entry, that entry is never triggered. What did work so far was leaving the mac address field blank and so match EVERY client. Fixing this might even be optional for me, as I have my WPA-PSK exclusively on wifi2, so I could make a single entry for all my clients by filtering on the interface only.
Make my FreeRadius send back what my capsman or AP expects. Right now what I get back (in the mikrotik log) is wireless,debug B8:XX:XX:XX:XX:XX@cap-wifi2 got RADIUS reply TIMEOUT and wireless,debug B8:XX:XX:XX:XX:XX@cap-wifi2 connection rejected, forbidden by RADIUS
I think I can get this to work, but not tonight. Will take a week or two. I will report back.
EDIT: Couldn’t stop fiddling and now it works. The missing piece (for the second point above) was an AAA entry on my wifi2 interface, that defined Username Format and Password Format in the way that FreeRadius expects it. So, for FreeRadius on pfsense, in an entry in the Users Tab (no entries in MACs tab needed), if you have Mac Address set lowercase and with dashes (eg a2-b2-ef-52-ab-12) for both Username and Password, set the AAA entry to aa-aa-aa-aa-aa-aa for both Username Format and Password Format, see https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-AAAproperties . Or use colons, works as well if you configure the AAA entry and the entries in FreeRadius accordingly.
Ok, I have dynamic wifi VLANs working !! Thank you for your help with this.
Notes:
The ethernet is 802.1Q tagged for all VLANs going to the wifi router.
The main VLAN for the wifi itself is VLAN10.
There is a DHCP helper on the upstream Cisco that handles sending requests to a Microsoft DHCP server with VLAN scopes from 8-15 (192.168.8-15.0/24).
The radius server is Microsoft NPS, with the two additional Mikrotik radius attributes added, #26 and #27.
Active Directory domain accounts are mapped to the radius server by group membership.