Radius noob

RouterOS General
1

So I have FreeRadius running on a FreeBSD server doing auth for a Aruba WAP system. This works great. Moving to WPA3 this week..

I decided to explore Mikrotik Radius as this would free me from having a seperate server.

After playing with Radius and User Manager.. I can’t get it to work. I must be doing something wrong.

A few questions. On FreeRadius this is all very easy. You create a client and you create a user. Done. I tried following some of the manual wiki pages and watched some youtube vids and I guess i just dont get it.

So do I need to use user manager ? Why not just use the Radius server in the OS and use the “users” ? Im not sure i understand how to link UserManager with the radius server.

Is there a step by step someplace I missed ? Most of what I read seemed to be for internal auth, where I want to have external devices ( Aruba ) connect to the Radius server on the Tik..

2

As no one else seems to offer a more qualified answer - the User Manager is a Radius server itself. So there is no need (and no way) to use both - either use User Manager (which has some limitations, e.g. cannot support EAP authentication until ROS 7 gets released), or use the external Radius server.

3

Thank you.

I shall play more with 7 and until that is ready will stick with FreeRadius.

Also as i plan on switching over to WPA3 Enterprise on the Aruba’s tomorrow I will start out on FreeRadius as I know that works with the Arubas.

I intend on doing CNSA and so:

To use WPA3 enterprise, the RADIUS servers must use one of the permitted EAP ciphers:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

In order to use this authentication, the RADIUS server must support these ciphers. Also, WPA3 192-bit security will be exclusive for EAP-TLS, which will require certificates on both STA and RADIUS server.