Multiple RADIUS servers

RouterOS General
1

Hi there,
I have following scenario:
Multiple Microsoft Active Directory forests behind one Mikrotik router. Each forest in its own segment. Each forest is having its own Directory servers with NPS role (RADIUS server) installed. Is there any chance to have multiple RADIUS servers defined in Mikrotik to use with L2TP VPN from different domains?
I know the multiple radius servers can be added for resiliency reasons, but can I segment it based on domain of user?

Best Regards, Jan

2

You can add various RAID server, but only one can be used for each service.

The single services supported are:
dhcp dot1x hotspot ipsec login ppp wireless

3

Thank you, It would be nice if I can authenticate user@domain.one against domain.one RADIUS server, user@domain.two against domain.two RADIUS server.

The only solution for now is to create users manually and sync passwords from oustide the router, am I right?

4

Install FreeRADIUS on a local machine, configure as a proxy server to direct requests to the appropriate NPS instance based on the request realm

5

I think you can use the “domain” property on the radius client for that. Create one radius client for each domain you have.

6

It probably needs some testing - it isn’t clear if that setting adds a realm / user domain if none is present in the username, and/or will direct requests for a realm / user domain to a particular server.

7

It adds it as an extra domain attribute for Windows servers that require domain validation (from the wiki)

The best bet is to run a proxy radius that can read and split based on realm. FreeRADIUS should be a quick and easy one to get going

Mikrotik → FreeRADIUS —^v> Multiple NPS based on realm.

8

the realm field adds an attribute (MT-Realm). I’m not 100% sure if the domain field adds a radius attribute. RouterOS automatically adds a “MS-CHAP-Domain” attribute if it discovers a domain in the username.

For ppp connections both styles domain/username and username@domain works. For IKEv2 only username@domain works. I opened a support ticket and they said they will fix it in the next beta release but 6.49beta46 did not fix the problem.

9

Ummm.... you can. We did this when we acquired another company, so we could steer all RADIUS auth requests from old company to the old server whilst we migrated them over to our infrastructure

I can't remember if it was the 'domain' or the 'realm' field, but it acts like a filter
If you enter "domain.one" (or maybe "@domain.one" it will only match when that is the domain