Hello.
I install a RADIUS Server Using Miktotik User Manager.
Then Configure a wAP to authenticate connected mobiles using this RADIUS Server
and create a wireless profile to authenticated users using EAP TLS without certificate verification.
Now, when I try to connect to Wireless router Using cellphone, the radius server successfully verify user authentication and authorization but the wAP getting @wlan1: disconnected, 802.1x authentication failed
This is wAP confiruation
[admin@MikroTik] > export
nov/16/2020 10:52:05 by RouterOS 6.48beta48
software id = PT7A-Z2FB
model = RouterBOARD wAP 2nD
serial number = 5D480548D374
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection-key=WiFiPr0tK3y mode=
dynamic-keys name=WiFi radius-mac-mode=as-username-and-password
supplicant-identity=MikroTik wpa2-pre-shared-key=Inf0rm^tikz
add authentication-types=wpa2-eap eap-methods=eap-tls interim-update=59s
management-protection-key=WiFiPr0tK3y mode=dynamic-keys name=WiFi-EAP
radius-called-format=mac radius-mac-accounting=yes
radius-mac-authentication=yes supplicant-identity=MikroTik
wpa2-pre-shared-key=Inf0rm^tikz
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX
disabled=no distance=indoors frequency=auto installation=
indoor mode=ap-bridge security-profile=WiFi-EAP ssid=WL-F1S-01
wireless-protocol=802.11 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=wlan1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add comment=defconf interface=wlan1 list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=wlan1 network=
192.168.88.0
add address=172.17.0.100/22 interface=ether1 network=172.17.0.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,4.2.2.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed”
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat
/ip route
add distance=1 gateway=172.17.1.60
/ip service
set www-ssl disabled=no
/radius
add address=172.17.0.101 secret=WR@ut3nt service=wireless
/radius incoming
set accept=yes
/system logging
add topics=radius,wireless
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
and this is Radius Server configuration
[admin@radius] > export
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/queue interface
set ether1 queue=ethernet-default
/tool user-manager customer
set admin access=
own-routers,own-users,own-profiles,own-limits,config-payment-gw
/tool user-manager profile
add name=Limited name-for-users=“” override-shared-users=unlimited owner=admin
price=0 starts-at=logon validity=0s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=172.17.0.101/22 interface=ether1 network=172.17.0.0
/ip cloud
set update-time=no
/ip dns
set servers=8.8.8.8
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip route
add distance=1 gateway=172.17.1.60
/system clock
set time-zone-autodetect=no
/system identity
set name=radius
/tool user-manager database
set db-path=primary-slave/user-manager2
/tool user-manager router
add coa-port=3799 customer=admin disabled=no ip-address=172.17.0.100 log=
auth-ok,auth-fail,acct-ok,acct-fail name=Wireless shared-secret=WR@ut3nt
use-coa=yes
/tool user-manager user
add customer=admin disabled=no ipv6-dns=:: password=“” shared-users=
unlimited username=XXXXXXXXXXXX wireless-enc-algo=none wireless-enc-key=“”
wireless-psk=“”