Under tools, or perhaps as a function of configuring a radius item, it would be very hand to be able to specify a username and password, and force a “test” of the radius server. Basically just use the supplied information and try to authenticate.
Could be a very helpful troubleshooting tool. Ideally, it would show all of the output of the radius server such as attribute replies and such.
Right now you are able to switch on ‘radius,debug’ logs, that provide very detailed information about information exchange between RouterOS RADIUS client and RADIUS server.
‘/system logging add action=memory topics=radius,debug’.
The point is not to test the radius server, but to make sure that the particular router you are troubleshooting is properly communicating with the radius server.
Technical Droid: “The user can’t authenticate, they’re getting a 678 error”
Admin Droid: “Just a second…” <clicks “test radius server”> “Looks like it’s not communicating with the radius server, i’ll check it out”
This would be handy in a lot of ways: View the actual attributes that the router is receiving, make sure that it’s working (and you didn’t mistype a key or address) before trying to authenticate a customer, troubleshoot a problem when a customer is having an issue logging in…
I agree with the other posts that this feature would be quite handy, I know that there are numerous times I would love to just click a test button to ensure the RADIUS communication is passing through my labyrinth of security
I third that request. Having that tool halves a problem domain. Is the issue with the user talking to the NAS or with the NAS talking to the AAA server? By forcing a credential test from the NAS you can immediately tell without having to walk the user through simulating a test.
A ‘yes-to-all’ radius implementation on RouterOS would be very nice.
So RouterOS basically would become a Radius-Server which will allow everyone to establish a connection.
This could become very handy in testing and emergence scenarios.
(Emergency: primary radius-server is down, enable ‘yes-to-all’ radius and make your clients happy!)
That is not true. I enabled the radius login, and when i try the log only says ‘login failure for user XX from YY via ZZ’, and says nothing related to the specific radius/mikrotik protocol.
Just now i am trying to authenticate hotspot users using freeradius and daloradius.
The freeradius server is running fine, all the external tests runs fine, including radclient, ntradping, daloradius itself, etc… but the routerboard just not connect to the radius server.
Then, i will must expend too many hours GUESSING WITH BLIND EYES what happens betweeen the routerboard and the freeradius server. Arghhh!!!
For sure, we need to be able to force a radius test from the router for all of the reasons posted. Since Mikrotik isn’t listening, can someone who is a good script writer develop a script to test the radius interaction? If I knew how to write scripts, I’d give it a go…but, alas, my script skills are primitive at best. I should think that the script should test authenticating to a particular user which the script user could easily modify.
So, how about it? The community will be forever grateful!