I wanted to introduce MT platform to the new company I work for, but what I really need is seamless authentication in MS environment for our wifi notebook users. By seamless I mean I am not willing to set-up user manager and manually enter users, nor am I willing to set-up CA here and to manually generate/upload certificates to users.
So, the question is simple - where’s my PEAP, standard in MS world? Even small linkys we have here can make it. I still hope I am overlooking something, but reading some past messages and googling reveals no satisfactory answer for me.
Did you try a security profile with WPA2-EAP and EAP passthrough on your MikroTik access point? In EAP passthrough mode all certificate verfication and PEAP handling are done between the client and the RADIUS server only, so this should work just fine provided that you have the needed Microsoft mojo (MS IAS Radius sitting on the Active Directory, server and client SSL certificates already in place, …)
thank you very much for your suggestion. We tried it before I posted my request, unfortunatelly we later found out, that our RADIUS is not properly configurated for such option. Now everything works OK.
So, my post is just informative for those who will search this conference in the future - it can be solved and used in MS PEAP environment
I trying to implement same scenario without success.
The AP is forward the credentials to IAS server but with wrong attributes (nothing VALUE
in NAS-Port-Type and NAS-port). The IAS server was drop the request because is not
matching any policy.
I was make the tests with v2.9.27 2.9.49 and 3.0rc10-11, and for authentication
PEAP-MSCHAP-V2 and EAP-TLS (certificates), without luck.
I was make bridge interface with ether1 and wlan1.
The AP is forward the credentials to IAS server but with wrong attributes (nothing VALUE
in NAS-Port-Type and NAS-port). The IAS server was drop the request because is not
matching any policy.
What kind of error you see on RADIUS ?
Do you have correct configuration for RADIUS client and wireless security settings ?
Post your configuration from ‘radius print’ and ‘interface wireless security-profile’.
I was try with routeros 2.48-49 and with 3.0rc10 -11. The same thing
My IAS server log entry is same oll the time :
User ccc@domain.com was denied access.
The connection attempt did not match any access policy.
NAS-Port-Type =
NAP-Port =
I thing te reason is uknown NAS-Port-Type.
In IAS wireless policy i was put port type Wireless - IEEE 802.11 and Wireless - Other
In other mikrotiks who working like NAS for VPN, there is not problem with IAS.
I don't know how to make attributes for Mikrotik-VSA
