Dear all,
we’re currently deploying an EAP-SIM configuration following in use steps for the needed security-profile. routerOS version is 5.11, but we’re experiencing lot of troubles related to the EAP authentication.
Currently we defined a WPA-EAP profile in passthrough mode for external RADIUS authentication and we linked it to a specific area which should be used for mobiles.
Configurations seems consistent and should work according to our experience, but the mobile phone timeout the authentication and no RADIUS protocol exchange is created by the AP.
Below the profile and area configuration:
add authentication-types=wpa-eap,wpa2-eap eap-methods=passthrough group-ciphers=tkip,aes-ccm
group-key-update=5m interim-update=0s management-protection=disabled
management-protection-key=“” mode=dynamic-keys name=eapsimauth
radius-eap-accounting=yes radius-mac-accounting=no
radius-mac-authentication=no radius-mac-caching=disabled
radius-mac-format=XXXXXXXXXXXX radius-mac-mode=as-username static-algo-0=
none static-algo-1=none static-algo-2=none static-algo-3=none
static-key-0=“” static-key-1=“” static-key-2=“” static-key-3=“”
static-sta-private-algo=none static-sta-private-key=“”
static-transmit-key=key-0 supplicant-identity=MikroMyMikro
tls-certificate=none tls-mode=no-certificates unicast-ciphers=
tkip,aes-ccm wpa-pre-shared-key=“” wpa2-pre-shared-key=“”
add area=“” arp=enabled bridge-mode=enabled default-ap-tx-limit=0
default-authentication=yes default-client-tx-limit=0 default-forwarding=
yes disable-running-check=no disabled=no hide-ssid=no l2mtu=2290
mac-address=02:0C:42:69:E7:42 master-interface=wlan1 max-station-count=
2007 mtu=1500 name=EAP proprietary-extensions=post-2.9.25
security-profile=eapsimauth ssid=EAP-SIM update-stats-interval=disabled
wds-cost-range=0 wds-default-bridge=none wds-default-cost=0
wds-ignore-ssid=no wds-mode=disabled wmm-support=disabled