Hi all,
I've a strange problem with Mikrotik-FreeRadius integration.
I've configured Wpa2-eap integration with External FreeRadius 2.2.x.
I receive Access-Accept from FreeRadius, but my devices won't log in and keep me asking for the password so i enter in a loop.
Any ideas?
I attach you my radiusd -X output:
Executing section post-auth from file /etc/raddb/sites-enabled/default
+group post-auth {
[sql] expand: %{User-Name} -> 92:7C:A6:XX:xx:XX@Enterprise
[sql] sql_set_user escaped user --> '92:7C:A6:X:xx:XX@Enterprise'
++[sql] = noop
++[exec] = noop
+} # group post-auth = noop
Sending Access-Accept of id 55 to 192.168.0.95 port 39276
Mikrotik-Address-List := "TOP_BUSINESS"
Acct-Interim-Interval := 300
Finished request 36.
Going to the next request
Screenshots do not show enough detail, posting the output of /export hide-sensitive is a good starting point.
The FreeRADIUS output seems incomplete, there is no indication of EAP messages - sending an Access-Accept outside of the EAP handshake will fail as there is no keying information provided.
Nothing obvious. You appear to have configured the RADIUS connector to handle PPP, login, hotspot & wireless - these will send requests in differing formats so your RADIUS server will have to handle them appropriately, the PPP and hotspot options appear to be redundant as there are no PPP or hostpot services configured.
It is most likely a RADIUS server configuration issue, there should be much more debug output and the username being a MAC address is unusual with the wireless EAP method set to passthrough.
Leaving only wireless under radius connector doesn’t change my situation.
I tried different kinds of auth but with DHCP Mikrotik doesn’t send my user password once a client try to log in, so I modified my policy to use my mac address as the password.
My Mikrotik receive the Accept (i can see it into the log) but my device keep asking me for username/password.
DHCP shouldn’t have anything to do with this authentication problem.
use my mac address as the password
A MAC is public information so should not be used as a secure credential, i.e. password. Anyway, what are you trying to do? It sounds like some kind of MAC authentication, which isn’t really WPA2-Enterprise with an EAP method. Since you mention username/password on the client, I suspect you want to do EAP-PEAP-MSCHAPv2, which requires a username/password, but this user/pass will come from the wireless client, not the AP. Do have any X.509 certs in play?
An OTA (over the air) capture can be useful as well to debug these problems. It shows the EAP method chosen, the certs that are used, versions, etc.
As I said in an earlier post the FreeRADIUS output seems incomplete, sending an Access-Accept outside of an EAP conversation will never work.
The choice of MAC address as username is most unusual - typical setups are either EAP-PEAP-MSCHAPv2 with someuser@realm + somepassword as credentials allowing a person to connect multiple devices, or one of the methods requiring both server and client certificates (this is more secure as only devices with a valid client certificate can connect, but more difficult to manage as you need a secure certificate distribution mechanism).
Hi All,
FYI just trying the same Mt configuration but with FreeRadius 3.x everything works like a charm!
2.2.x seems to have different configurations and I’m currently investigating this by using diffmerge everything possible.
