Multiple WPA keys per SSID

RouterOS General
1

Hi guys,

Any idea how to implement multiple WPA/WPA2/WEP passwords for a single SSID?

We need to have any number of passwords so we can let the user on as long as they match one of them..

Thanks,
Marke

2

For this you need to setup VAP - with different SSID - or use some kind of radius auth.

3

@samsung172 thanks for the prompt reply…

If we use WPA-EAP, with a radius server, would that ultimately allow users to connect with their unique PSK? Would the connect / authentication flow be the same from a users perspective?

For example:
User enters a WPA PSK on AP#1, walks to AP#2 and enters the same PSK to connect.

Even if AP#1 was a regular WPA-PSK interface/ssid and AP#2 was WPA-EAP-PSK, would they roam seamlessly if they used the same PSK on both APs?

Thanks again,
Marke

4

Radius is not mandatory.
You can define multiple passphrases, one for each client MAC address. Use Wireless/Access List menu and add one entry for each client.

5

Thanks noib… unfortunately we cannot know the Mac addresses in advance..
We can only know the passphrases that are available; any number of macs may use them..

6

Further to my previous question:

Would devices roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 radius)?

7

Seamless roaming is not exactly possible with 802.11 for that matter even with hspda and lte it’s not usually seamless in real life. But as long as dhcp server and all acesspoints are on same layer 3 segment it’s fairly seamless unless you doing voiP call or something. The problem you will find is that the client will only disconnect when signal becomes unusable and there’s normally a period before the connection searches while it won’t work. You could try setting minimum signal levels for allowed clients on the ap’s to trigger disconnect sooner before its not usable.