Hi,
I would like to use the user manager to distribute the IP addresses via DHCP. Authentication on the port works via Dot1x. But the devices do not get an IP address. Why? or what can be done better?
Router:
# aug/01/2023 12:22:32 by RouterOS 7.6
# software id = HD12-GV43
#
# model = CCR2004-16G-2S+
# serial number = VAV01CCX0VU
/interface bridge
add name=BRIDGE protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether10 ] name=WAN3_LTE
set [ find default-name=ether4 ] name=WAN4
set [ find default-name=sfp-sfpplus1 ] advertise=1000M-full auto-negotiation=no speed=1Gbps
/interface vlan
add comment=MGT interface=sfp-sfpplus1 name=VLAN_99 vlan-id=99
add comment=COM interface=sfp-sfpplus1 name=VLAN_100 vlan-id=100
add comment=GUEST interface=sfp-sfpplus1 name=VLAN_300 vlan-id=300
add comment=DMZ interface=sfp-sfpplus1 name=VLAN_301 vlan-id=301
/interface list
add name=VLAN
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=MGT ranges=10.99.1.5-10.99.1.253
add name=COM ranges=192.168.113.10-192.168.113.250
add name=GUEST ranges=10.178.1.10-10.178.1.100
add name=DMZ ranges=10.178.2.10-10.178.2.20
/ip dhcp-server
add address-pool=MGT interface=VLAN_99 name=MGT
add address-pool=COM interface=VLAN_100 name=COM
add address-pool=GUEST interface=VLAN_300 name=GUEST
add address-pool=DMZ interface=VLAN_301 name=DMZ
/port
set 0 name=serial0
set 1 name=serial1
/user-manager user
add attributes=Tunnel-Medium-Type:6,Tunnel-Private-Group-ID:300,Tunnel-Type:13 comment=TEL name=00:07:3B:93:49:0B
add attributes=Tunnel-Medium-Type:6,Tunnel-Private-Group-ID:100,Tunnel-Type:13 comment=Macbook name=22:E0:4C:A4:91:76
/interface bridge port
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=ether5
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=ether6
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=ether7
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=ether8
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=ether9
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1
add bridge=BRIDGE frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2
/interface bridge vlan
add bridge=BRIDGE tagged=BRIDGE,ether5,ether6,ether7,ether8,ether9,sfp-sfpplus1,sfp-sfpplus2 vlan-ids=99
add bridge=BRIDGE tagged=BRIDGE,ether5,ether6,ether7,ether8,ether9,sfp-sfpplus1 vlan-ids=100
add bridge=BRIDGE tagged=BRIDGE,ether5,ether6,ether7,ether8,ether9,sfp-sfpplus1 vlan-ids=300
add bridge=BRIDGE tagged=BRIDGE,ether5,ether6,ether7,ether8,ether9 vlan-ids=301
/interface list member
add interface=WAN1 list=WAN
add interface=WAN2 list=WAN
add interface=VLAN_99 list=VLAN
add interface=VLAN_100 list=VLAN
add interface=VLAN_300 list=VLAN
add interface=VLAN_301 list=VLAN
/ip address
add address=10.99.1.254/24 interface=VLAN_99 network=10.99.1.0
add address=192.168.113.254/24 interface=VLAN_100 network=192.168.113.0
add address=10.178.1.254/24 interface=VLAN_300 network=10.178.1.0
add address=10.178.2.254/24 interface=VLAN_301 network=10.178.2.0
/ip dhcp-client
add interface=WAN1
add interface=WAN2
add interface=WAN3_LTE
/ip dhcp-server lease
add address=10.99.1.253 client-id=1:74:4d:28:a7:c1:2d mac-address=74:4D:28:A7:C1:2D server=MGT
/ip dhcp-server network
add address=10.99.1.0/24 dns-server=10.99.1.254 gateway=10.99.1.254
add address=10.178.1.0/24 dns-server=10.178.1.254 gateway=10.178.1.254
add address=10.178.2.0/24 dns-server=10.178.2.254 gateway=10.178.2.254
add address=192.168.113.0/24 dns-server=192.168.113.254 gateway=192.168.113.254
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=ROUTER
/system ntp client
set enabled=yes
/system ntp client servers
add address=1.de.pool.ntp.org
add address=2.de.pool.ntp.org
add address=3.de.pool.ntp.org
/system routerboard settings
set auto-upgrade=yes silent-boot=yes
/tool romon
set enabled=yes
/user aaa
set interim-update=5m use-radius=yes
/user-manager
set certificate=*0 enabled=yes
/user-manager router
add address=10.99.1.253 name=SWITCH
Switch:
2023-08-01 08:00:37 by RouterOS 7.10
# software id = 46TM-JV4A
#
# model = CRS328-24P-4S+
# serial number = B1A30NE4C137
/interface bridge
add ingress-filtering=no name=bridge1 protocol-mode=none vlan-filtering=yes
/interface ethernet
set [ find default-name=ether14 ] disabled=yes
set [ find default-name=sfp-sfpplus1 ] auto-negotiation=no
set [ find default-name=sfp-sfpplus2 ] auto-negotiation=no
/interface vlan
add interface=sfp-sfpplus2 name=vlan99 vlan-id=99
add interface=sfp-sfpplus2 name=vlan100 vlan-id=100
add interface=sfp-sfpplus2 name=vlan300 vlan-id=300
add interface=sfp-sfpplus2 name=vlan301 vlan-id=301
/interface list
add name=dot1x
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge1 interface=ether16
add bridge=bridge1 interface=ether14
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether20
add bridge=bridge1 interface=dot1x
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge1 tagged=sfp-sfpplus1,sfp-sfpplus2,bridge1 vlan-ids=100
add bridge=bridge1 tagged=sfp-sfpplus1,sfp-sfpplus2,bridge1 vlan-ids=300
add bridge=bridge1 tagged=sfp-sfpplus1,sfp-sfpplus2,bridge1 vlan-ids=301
add bridge=bridge1 tagged=sfp-sfpplus1,sfp-sfpplus2 vlan-ids=99
/interface dot1x client
add disabled=yes eap-methods=eap-mschapv2 identity=switch01 interface=sfp-sfpplus2
/interface dot1x server
add guest-vlan-id=200 interface=ether2
add auth-types=mac-auth interface=ether16 mac-auth-mode=mac-as-username-and-password
add interface=ether8
add auth-types=mac-auth interface=ether10 mac-auth-mode=mac-as-username-and-password
add auth-types=mac-auth interface=ether20 mac-auth-mode=mac-as-username-and-password
/interface list member
add interface=ether1 list=dot1x
add interface=ether2 list=dot1x
add interface=ether8 list=dot1x
add disabled=yes interface=sfp-sfpplus2 list=dot1x
add disabled=yes interface=vlan99 list=dot1x
/ip address
add address=10.99.10.253/24 interface=vlan99 network=10.99.10.0
add address=10.10.10.253/24 interface=sfp-sfpplus2 network=10.10.10.0
/ip dhcp-client
add interface=vlan300
add interface=vlan99
add interface=vlan100
add interface=vlan301
/ip route
add check-gateway=ping disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=10.10.10.254 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=10.99.10.254 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=yes distance=1 dst-address=0.0.0.0/0 gateway=10.99.10.253 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/radius
add address=10.99.1.254 service=ppp,login,hotspot,wireless,dhcp,ipsec,dot1x
/radius incoming
set accept=yes
/system identity
set name=SWITCH
/system logging
add topics=dhcp
/system note
set show-at-login=no
/system routerboard settings
set auto-upgrade=yes boot-os=router-os
/tool romon
set enabled=yes