Radius & PPTP

RouterOS General
1

Hi,

question, maybe BFU :wink:

  • how I can set ,Local IP, address for PPTP user when is authorizing over Radius ? If I not have set this IP in default profile in PPP, users are after authorizing at Radius disconected


    Thanks

/Tomi

2

why not just set it in profile? =)

3

You have to set Local-Address in a profile, it canā€™t be done via Radius

4

because I have some VPNs what have differenet Local IPs than others (for example LAN-to-LAN VPN have another local ip than Remote Users)
and another q, its possible select Profiles over radius ?

5

No, you canā€™t.

  1. use mutiple profiles, or
  2. rethink what you are doing.

Based on what I am reading, there should be better ways to achieve what you wantā€¦

6

how you mean that multiple profiles ? Profiles is only for Local Users, not ? And I talk about radius.
I have multiple profiles and they are assigned to each group of users, but its Local and I want move it to Radius.

7

Hello,

I have the same problem but it seems that the solution has not been foundā€¦ or i missed something :confused:

Is there a way to specify, by RADIUS, which profile to use?

Regards

8

omgā€¦ please explain why do you need that =)

9

In fact, the client connect to the server through two pptp tunnels (each one related to a different link support), so both get the same gatewayā€¦

  • diagnosing by which one traffic goes (from a traceroute from lan side) is almost impossible

  • I worry about possible mixing in routes

Specifying server local-address seems to be impossible from RADIUS, it has to bet set in profile, so the last solution (before having to set all logins ā€œppp secretsā€ would be to have two profiles with different local-address and choose which one to use from RADIUSā€¦

Maybe thereā€™s another way but i donā€™t know which oneā€¦

10

you may set ā€˜local-addressā€™ to almost anything you want - I just donā€™t understand why do you need to vary itā€¦

do you use public addresses? if no - you may just use different address pool to distinguish clients from the LAN sideā€¦

11

I use RADIUS on the hotspot, and the attribute ā€œMikrotik-Groupā€ selects ā€œ/ip hotspot user profileā€. I enter a profile in ā€œ/ip hotspot user profileā€ named newprofile, then I return ā€œMikrotik-Group=newprofileā€ with the Access-Accept message. Does that sound like it might work with this protocol?

12

I donā€™t know if SurferTim message is a question or a suggestion, anyway I donā€™t know if its setup works, it might, in hotspot mode, but when not using this mode?

My PPTP client is not a hotspotā€¦

Any idea?

13

It is both. To be honest, I learned of the Mikrotik-Group by ā€˜playingā€™ with the OS. Same way I figured out radius-default-domain. Set up a test. Use parameters that you would certainly be able to tell the profile was changed. Try not to affect any other profiles with the test if the router is in service.

I am certain that the router I play with would rather be anywhere but here. I torture it regularly. :smiley:

14

I tried Mikrotik-Group it has no effect, with different operators ā€œ:=ā€ ā€œ=ā€ ā€œ==ā€

radius-default-domain is a hotspot parameterā€¦ so it has no effect on pptp serverā€¦

Another idea :frowning:

15

Just a thought. I checked the docs in the radius section, and ā€œMikrotik-Groupā€ appears to apply only to ā€œ/user groupā€ and ā€œ/ip hotspot user profileā€. :frowning:

EDIT: I see your next post. Didnā€™t want to add another post. If anyone can do it, it will be Chupaka.

16

Maybe Chupaka will have a magic ideaā€¦ hope soā€¦