private PSK per USER (MACs unknow) + RADIUS --> dynamic VLAN assignment, feasible?

RouterOS Wireless Networking
3

@bpwl thx being that kind replying that quickly :smiley:

that was my first intention but how to deal with devices that don’t support EAP?
Offering a second (Guest) WiFi to allow such devices to go online. If such a device would be a smart device such as TV-Box the user, who is located in its own VLAN needs access to it, so I would have to migrate it manually from the Guest (untrusted devices) VLAN to its VLAN by modifying the Client-List in the RADIUS Server each time this happens.
I would like to get rid of this manual workflow. Either by allowing self-enrollment of such devices but FreeRADIUS does not have such a feature. I’m exploring such workflow here: Self Service Kiosk / Workflow to trust untrusted devices to add them to personal VLAN dynamically (freeradius.org)

So I thought what you properly asked for by

but if I read

  1. DPSK/PPSK individual PSK without preconfig - MikroTik
  2. Auth WPA2/PSK agaist radius server - MikroTik
  3. Feature Request : Wireless Private Passphrase as a Match in Access-List - MikroTik
  4. DPSK Dynamic WPA2 PSK support - MikroTik

I have to admit

According to DPSK Dynamic WPA2 PSK support - MikroTik it seems not to be possible and in [Proof of Concept] Private PSK / Personal PSK (PPSK) with dynamic VLAN via RADIUS MAC-auth | Ubiquiti Community is repeated again

that the AP doesn’t send any information on which RADIUS could decide

how to distinguish between users but it is said as well

The only way to have more than one PSK that every client can use is to use a wpa_psk file on the access point (in addition). It allows for more than one PSK every client can connect to, because> it allows a wildcard MAC of 00:00:00:00:00:00> .

but how to implement that in an MT device?


So my questions are:

  1. Could be any script generated that would enhance the Access-Request or Accounting-Request?
  2. A script what manipulates the MAC before being send to the RADIUS-Server?
  3. A script like Feature Request : Wireless Private Passphrase as a Match in Access-List - MikroTik to do an script based VLAN assignment?
  4. Using Vlan tag override, see Wireless Interface - RouterOS - MikroTik Documentation but no clue what it actually does an how to use
  5. any other idea?

It seems that other vendors have the implementation of PPSK or iPSK but as far as I understand there are still based on the assumption that you know the MAN before connecting it to WiFi:

  1. Configuring Meraki IPSK with FreeRADIUS – The Wi-Fi Channel (synic.nl)
  2. Industrial Control Protocols: Cisco Identity PSK and Freeradius (indcontrolproto.blogspot.com)
  3. [Proof of Concept] Private PSK / Personal PSK (PPSK) with dynamic VLAN via RADIUS MAC-auth | Ubiquiti Community
  4. (22) Shared SSID with Cisco’s Identity PSK and FreeRADIUS | LinkedIn
  5. IPSK with RADIUS Authentication - Cisco Meraki
  6. (1) PPSK (Private Pre-Shared Key) alternatives for Cisco : networking (reddit.com)
  7. (1) Setting up iPSK using FreeRADIUS for auth. Do I really need to specify additional RADIUS attributes? : Cisco (reddit.com)
  8. PPSK Is Not an Alternative to 802.1x (securew2.com)

last but not least

thx for referring to it but I would like to wait until ROS 7.x has a somehow stable feature set.
I’m even not sure if this User-Manager could solve my use-case?