Good afternoon,
Trying to setup a mikrotik router with authenticating users via a radius server. We don’t want use active directory with network policy and cert authentication. I read about setting this up through mac address authentication but is there a way to do this easier as what do you do when you have to update the mac addresses constantly?
Just curious to see if there is another way to authenticate users not through the mac address or through AD?
If you don’t want to use AD and NSP for authentication (understandable), you could always try using FreeRADIUS.
–
Backups are your friend. Always make a backup!
/system backup save encryption=aes-sha256 name=MyBackup
Please, export and attach your current config to your post if you want help with a config issue:
/export hide-sensitive file=MyConfig/export file=MyConfig
we have multiple locations and going the route of Network Policy Server/Active Directory authentication was the original plan but we are going to be migrating to Azure through our parent company and this may not be a possibility of going this route although is working currently. The next plan was to authenticate users through MAC address, but we have multiple locations and the issue is we’re wanting to have a seamless transition so if we device that is authorized to login from say location A and they travel to location B, they are authenticated to login automatically once at location B.
Issue being with turnover and change of devices we don’t want to have to update the list of mac addresses at each location constantly.
If there is a better way to do this rather than these 2 ways, I’d appreciate it if someone could point me in the direction of the right way to go about this.
thank you
Also, very new to radius setup here but if doing mac authentication, is your mikrotik router the radius server? Then the usermanager authenticates based on the mac addresses set as the users?
There is no reason that I know of why you can’t run the NSP server in the cloud as long as it can bind to an Active Directory server. I don’t know if NSP can bind directly to Azure AD but you could always set the NSP server up as an AD server and sync it to Azure AD if you had to.
–
Backups are your friend. Always make a backup!
/system backup save encryption=aes-sha256 name=MyBackup
Please, export and attach your current config to your post if you want help with a config issue:
/export hide-sensitive file=MyConfig/export file=MyConfig
By NSP, do you mean the Network Policy Server? I don’t think that using an NPS is going to be an option where we are moving to a not on premise site. Is there a way to set this up using user manager and if we have multiple locations where going off of mac address we wouldn’t have to change the list of users for each router’s list of users?
thank you
Yes, NSP should be NPS (Network Policy Server) – my bad 
I haven’t used the MikroTik User Manager for this sort of thing so can’t help you there.
–
Backups are your friend. Always make a backup!
/system backup save encryption=aes-sha256 name=MyBackup
Please, export and attach your current config to your post if you want help with a config issue:
/export hide-sensitive file=MyConfig/export file=MyConfig
thanks for the reply…aside from using user manager what would be the best way to accomplish this? Scenario is we’re wanting to limit the devices which have access to our wireless AP’s in multiple locations, but if that device has access in one location and they travel to another, it will automatically connect to the access point there.
thanks again.
Set up your own RADIUS server & frontend on-prem or hosted elsewhere / subscribe to a cloud-based service (e.g. CloudRADIUS, JumpCloud, Foxpass) and use WPA2-Enterprise for wireless / 802.1X for wired authentication with username/password and/or certificates.
All locations should use this data/service, onboarding and revoking each users credentials only has to be done in one place. Using the MAC address is not authentication, just authorisation - anyone can spoof it and gain access.
so do we still setup the radius server on windows? I don’t believe we can go this route where the radius server is setup on windows. Is there a way to setup a radius server where its not on a ddomain controller? What is the radius menu for in router OS on the mikrotik? Sorry really new doing it this way. Basically what is my radius server? Currently I have a mikrotik router that I have hooked up to my laptop and that is all. Initially want to get this router setup so that I can allow authentication to different devices to it.
Then have the same profile and set it on other routers we have in different locations in other offices so that when one of the allowed devices is in that location it will auto authenticate and connect.
thanks for your help
which would be the better route to set this up? Through User Manager or something like freeradius being that going the route through active directory doesn’t appear to be an option for us. Is there an option using freeradius that incorporates a GUI as well?
Also, I’m on router os version 6.49.8 and can access user manager from the web but its not showing up in winbox. Is there something else which needs to be done so that it can be viewed within Winbox as well? Also could someone point me in the direction of setting up Radius using usermanager or would freeradius be the better route?
I have my radius server setup now using ubuntu and freeradius and have added one of my radius clients(routers) into NAS…what needs to be done on the mikrotik itself?