Router OS 7.1.3 User Manager Issue

ddejager · February 24, 2022, 10:23pm

I’m running 7.1.3 hotspot on a test hAP ac3. I also have installed the new version 5 user manager. I’ve been able to configure the hotspot and user manager work work with one major issue outstanding. I can login to the hotspot successfully. The request gets sent to the manager. The manager approves the request and the login succeeds. I have a test limit set in UM of 100 kB for the user. I see interim accounting updates from the hotspot to the UM and the information displayed in the UM active sessions tab for the user gets update as expected. I then start a big speed test that will exceed the 100 KB limit. I see the next accounting update proceed. The UM tells the hotspot to close the connection. The hotspot ignores this request and and retries the accounting request. The UM forcibly closes the connection and the hotspot leaves the connection up and continues to get errors back from the UM. Here is the log showing this behavior:

 16:30:16 hotspot,debug test3 (10.5.50.254): sending RADIUS accounting Interim-Update request
 16:30:16 radius,debug new request 3f:5a code=Accounting-Request service=hotspot called-id=hotspot1
 16:30:16 radius,debug sending 3f:5a to 127.0.0.1:1813
 16:30:16 radius,debug,packet sending Accounting-Request with id 47 to 127.0.0.1:1813
 16:30:16 radius,debug,packet     Signature = 0x340644467f8810e273eecbb7ab05adc5
 16:30:16 radius,debug,packet     Acct-Status-Type = 3
 16:30:16 radius,debug,packet     NAS-Port-Type = 19
 16:30:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:30:16 radius,debug,packet     Called-Station-Id = "hotspot1"
 16:30:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:30:16 radius,debug,packet     User-Name = "test3"
 16:30:16 radius,debug,packet     NAS-Port = 2162163736
 16:30:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:30:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:30:16 radius,debug,packet     MT-Host-IP = 10.5.50.254
 16:30:16 radius,debug,packet     Event-Timestamp = 1645738216
 16:30:16 radius,debug,packet     Acct-Input-Octets = 25837
 16:30:16 radius,debug,packet     Acct-Output-Octets = 30833
 16:30:16 radius,debug,packet     Acct-Input-Gigawords = 0
 16:30:16 radius,debug,packet     Acct-Output-Gigawords = 0
 16:30:16 radius,debug,packet     Acct-Input-Packets = 171
 16:30:16 radius,debug,packet     Acct-Output-Packets = 116
 16:30:16 radius,debug,packet     Acct-Session-Time = 480
 16:30:16 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 16:30:16 radius,debug,packet     Acct-Delay-Time = 0
 16:30:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:30:16 manager,debug >>> rx Accounting-Request from [127.0.0.1]:49563, id: 47
 16:30:16 radius,debug,packet received Accounting-Response with id 47 from 127.0.0.1:1813
 16:30:16 radius,debug,packet     Signature = 0x12093089e19844ec23238faee40432ed
 16:30:16 radius,debug,packet     User-Name = "test3"
 16:30:16 radius,debug,packet     NAS-Port-Type = 19
 16:30:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:30:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:30:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:30:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:30:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:30:16 radius,debug received reply for 3f:5a
 16:30:16 radius,debug request 3f:5a processed
 16:30:16 manager,debug <<< tx Accounting-Response to [127.0.0.1]:49563, id: 47
 16:30:16 hotspot,debug test3 (10.5.50.254): RADIUS accounting request sent
 16:31:16 hotspot,debug test3 (10.5.50.254): sending RADIUS accounting Interim-Update request
 16:31:16 radius,debug new request 3f:5b code=Accounting-Request service=hotspot called-id=hotspot1
 16:31:16 radius,debug sending 3f:5b to 127.0.0.1:1813
 16:31:16 radius,debug,packet sending Accounting-Request with id 48 to 127.0.0.1:1813
 16:31:16 radius,debug,packet     Signature = 0x935c5206b91bcc0e996040eae1c68644
 16:31:16 radius,debug,packet     Acct-Status-Type = 3
 16:31:16 radius,debug,packet     NAS-Port-Type = 19
 16:31:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:31:16 radius,debug,packet     Called-Station-Id = "hotspot1"
 16:31:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:31:16 radius,debug,packet     User-Name = "test3"
 16:31:16 radius,debug,packet     NAS-Port = 2162163736
 16:31:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:31:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:31:16 radius,debug,packet     MT-Host-IP = 10.5.50.254
 16:31:16 radius,debug,packet     Event-Timestamp = 1645738276
 16:31:16 radius,debug,packet     Acct-Input-Octets = 198195
 16:31:16 radius,debug,packet     Acct-Output-Octets = 3392154
 16:31:16 radius,debug,packet     Acct-Input-Gigawords = 0
 16:31:16 radius,debug,packet     Acct-Output-Gigawords = 0
 16:31:16 radius,debug,packet     Acct-Input-Packets = 1492
 16:31:16 radius,debug,packet     Acct-Output-Packets = 2666
 16:31:16 radius,debug,packet     Acct-Session-Time = 540
 16:31:16 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 16:31:16 radius,debug,packet     Acct-Delay-Time = 0
 16:31:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:31:16 manager,debug >>> rx Accounting-Request from [127.0.0.1]:52413, id: 48
 16:31:16 manager,debug Disconnecting all active sess for: test3
 16:31:16 radius,debug,packet received Accounting-Response with id 48 from 127.0.0.1:1813
 16:31:16 radius,debug,packet     Signature = 0x0ac87bd6a6960cc5c0afe3635b671a3f
 16:31:16 radius,debug,packet     User-Name = "test3"
 16:31:16 radius,debug,packet     NAS-Port-Type = 19
 16:31:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:31:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:31:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:31:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:31:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:31:16 radius,debug received reply for 3f:5b
 16:31:16 radius,debug request 3f:5b processed
 16:31:16 manager,debug <<< tx Accounting-Response to [127.0.0.1]:52413, id: 48
 16:31:16 manager,debug <<< tx Disconnect-Request 35 [sid = 6] to [127.0.0.1]:3799
 16:31:16 hotspot,debug test3 (10.5.50.254): RADIUS accounting request sent
 16:31:16 manager,debug <<< RE-tx Disconnect-Request 35 [sid = 6] to [127.0.0.1]:3799
 16:31:16 manager,debug <<< RE-tx Disconnect-Request 35 [sid = 6] to [127.0.0.1]:3799
 16:31:16 manager,debug Can't disconnect session. NAS not responding. Closing session anyway with reqId: 35
 16:31:16 manager,debug Now user test3 has active session count: 0
 16:32:16 hotspot,debug test3 (10.5.50.254): sending RADIUS accounting Interim-Update request
 16:32:16 radius,debug new request 3f:5c code=Accounting-Request service=hotspot called-id=hotspot1
 16:32:16 radius,debug sending 3f:5c to 127.0.0.1:1813
 16:32:16 radius,debug,packet sending Accounting-Request with id 49 to 127.0.0.1:1813
 16:32:16 radius,debug,packet     Signature = 0xebabe9152638284937723e1ae13d0aa0
 16:32:16 radius,debug,packet     Acct-Status-Type = 3
 16:32:16 radius,debug,packet     NAS-Port-Type = 19
 16:32:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:32:16 radius,debug,packet     Called-Station-Id = "hotspot1"
 16:32:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:32:16 radius,debug,packet     User-Name = "test3"
 16:32:16 radius,debug,packet     NAS-Port = 2162163736
 16:32:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:32:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:32:16 radius,debug,packet     MT-Host-IP = 10.5.50.254
 16:32:16 radius,debug,packet     Event-Timestamp = 1645738336
 16:32:16 radius,debug,packet     Acct-Input-Octets = 201444
 16:32:16 radius,debug,packet     Acct-Output-Octets = 3393573
 16:32:16 radius,debug,packet     Acct-Input-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Output-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Input-Packets = 1514
 16:32:16 radius,debug,packet     Acct-Output-Packets = 2689
 16:32:16 radius,debug,packet     Acct-Session-Time = 599
 16:32:16 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 16:32:16 radius,debug,packet     Acct-Delay-Time = 0
 16:32:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:32:16 manager,debug >>> rx Accounting-Request from [127.0.0.1]:59385, id: 49
 16:32:16 manager,debug Invalid ACCOUNTING data: Interim/Stop received for unkown session. Ignore and disconnect.
 16:32:16 manager,debug <<< tx Disconnect-Request 36 [sid = (empty)] to [127.0.0.1]:3799
 16:32:16 manager,debug <<< RE-tx Disconnect-Request 36 [sid = (empty)] to [127.0.0.1]:3799
 16:32:16 radius,debug resending 3f:5c
 16:32:16 radius,debug,packet sending Accounting-Request with id 49 to 127.0.0.1:1813
 16:32:16 radius,debug,packet     Signature = 0xebabe9152638284937723e1ae13d0aa0
 16:32:16 radius,debug,packet     Acct-Status-Type = 3
 16:32:16 radius,debug,packet     NAS-Port-Type = 19
 16:32:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:32:16 radius,debug,packet     Called-Station-Id = "hotspot1"
 16:32:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:32:16 radius,debug,packet     User-Name = "test3"
 16:32:16 radius,debug,packet     NAS-Port = 2162163736
 16:32:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:32:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:32:16 radius,debug,packet     MT-Host-IP = 10.5.50.254
 16:32:16 radius,debug,packet     Event-Timestamp = 1645738336
 16:32:16 radius,debug,packet     Acct-Input-Octets = 201444
 16:32:16 radius,debug,packet     Acct-Output-Octets = 3393573
 16:32:16 radius,debug,packet     Acct-Input-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Output-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Input-Packets = 1514
 16:32:16 radius,debug,packet     Acct-Output-Packets = 2689
 16:32:16 radius,debug,packet     Acct-Session-Time = 599
 16:32:16 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 16:32:16 radius,debug,packet     Acct-Delay-Time = 0
 16:32:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:32:16 manager,debug <<< RE-tx Disconnect-Request 36 [sid = (empty)] to [127.0.0.1]:3799
 16:32:16 radius,debug resending 3f:5c
 16:32:16 radius,debug,packet sending Accounting-Request with id 49 to 127.0.0.1:1813
 16:32:16 radius,debug,packet     Signature = 0xf9a3765ea2b93fa3966bd7db4e859e70
 16:32:16 radius,debug,packet     Acct-Status-Type = 3
 16:32:16 radius,debug,packet     NAS-Port-Type = 19
 16:32:16 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 16:32:16 radius,debug,packet     Called-Station-Id = "hotspot1"
 16:32:16 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 16:32:16 radius,debug,packet     User-Name = "test3"
 16:32:16 radius,debug,packet     NAS-Port = 2162163736
 16:32:16 radius,debug,packet     Acct-Session-Id = "80e00018"
 16:32:16 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 16:32:16 radius,debug,packet     MT-Host-IP = 10.5.50.254
 16:32:16 radius,debug,packet     Event-Timestamp = 1645738336
 16:32:16 radius,debug,packet     Acct-Input-Octets = 201444
 16:32:16 radius,debug,packet     Acct-Output-Octets = 3393573
 16:32:16 radius,debug,packet     Acct-Input-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Output-Gigawords = 0
 16:32:16 radius,debug,packet     Acct-Input-Packets = 1514
 16:32:16 radius,debug,packet     Acct-Output-Packets = 2689
 16:32:16 radius,debug,packet     Acct-Session-Time = 599
 16:32:16 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 16:32:16 radius,debug,packet     Acct-Delay-Time = 1
 16:32:16 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 16:32:16 manager,debug Can't disconnect session. NAS not responding. Closing session anyway with reqId: 36
 16:32:16 manager,debug >>> rx Accounting-Request from [127.0.0.1]:59385, id: 49
 16:32:16 manager,debug Invalid ACCOUNTING data: Interim/Stop received for unkown session. Ignore and disconnect.
 16:32:16 manager,debug <<< tx Disconnect-Request 37 [sid = (empty)] to [127.0.0.1]:3799
 16:32:16 manager,debug <<< RE-tx Disconnect-Request 37 [sid = (empty)] to [127.0.0.1]:3799
 16:32:17 radius,debug timeout for 3f:5c
 16:32:17 hotspot,warning,debug test3 (10.5.50.254): RADIUS accounting request not sent: no response
 16:32:17 manager,debug <<< RE-tx Disconnect-Request 37 [sid = (empty)] to [127.0.0.1]:3799
 16:32:17 manager,debug Can't disconnect session. NAS not responding. Closing session anyway with reqId: 37

Another (related?) problem: When I attempt to login from the hotspot to a user that has exceeded its limit, the UM tells the hotspot that the limit is exceeded. The hotspot ignores this and repeats the login attempt, eventually timing out and telling the user the the radius server timed out. It did NOT timeout, the hotspot simply ignored the response from the UM. Note also that the hotspot first ignores the rejected response the the attempt to login via MAC address. See log below:

17:11:27 hotspot,debug hotspot1: new host detected 7E:52:A2:F0:66:08/10.5.50.254 by TCP :38130 -> 10.5.50.1:853
 17:11:27 hotspot,info,debug 7E:52:A2:F0:66:08 (10.5.50.254): trying to log in by mac
 17:11:27 hotspot,debug 7E:52:A2:F0:66:08 (10.5.50.254): local user not found
 17:11:27 hotspot,debug 7E:52:A2:F0:66:08 (10.5.50.254): sending RADIUS authentication request
 17:11:27 hotspot,debug hotspot1: dhcp host 7E:52:A2:F0:66:08/10.5.50.254 added, ip 10.5.50.254
 17:11:27 radius,debug new request 3f:64 code=Access-Request service=hotspot called-id=hotspot1
 17:11:27 radius,debug sending 3f:64 to 127.0.0.1:1812
 17:11:27 radius,debug,packet sending Access-Request with id 56 to 127.0.0.1:1812
 17:11:27 radius,debug,packet     Signature = 0xa817cb1e31d5a3232297d3356e6dd8a7
 17:11:27 radius,debug,packet     NAS-Port-Type = 19
 17:11:27 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:27 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:27 radius,debug,packet     User-Name = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     NAS-Port = 2162163737
 17:11:27 radius,debug,packet     Acct-Session-Id = "80e00019"
 17:11:27 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:27 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:27 radius,debug,packet     CHAP-Challenge = 0x77643adf57032534528d2f0d95bd29e5
 17:11:27 radius,debug,packet     CHAP-Password = 0xfa542ab42257449ecedab897c8bea61d
 17:11:27 radius,debug,packet       b8
 17:11:27 radius,debug,packet     Service-Type = 1
 17:11:27 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:27 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:27 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:27 manager,debug >>> rx Access-Request from [127.0.0.1]:50743, id: 56
 17:11:27 manager,debug rejected for user: "" username doesn't exist: 7E:52:A2:F0:66:08
 17:11:27 radius,debug resending 3f:64
 17:11:27 radius,debug,packet sending Access-Request with id 56 to 127.0.0.1:1812
 17:11:27 radius,debug,packet     Signature = 0xa817cb1e31d5a3232297d3356e6dd8a7
 17:11:27 radius,debug,packet     NAS-Port-Type = 19
 17:11:27 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:27 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:27 radius,debug,packet     User-Name = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     NAS-Port = 2162163737
 17:11:27 radius,debug,packet     Acct-Session-Id = "80e00019"
 17:11:27 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:27 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:27 radius,debug,packet     CHAP-Challenge = 0x77643adf57032534528d2f0d95bd29e5
 17:11:27 radius,debug,packet     CHAP-Password = 0xfa542ab42257449ecedab897c8bea61d
 17:11:27 radius,debug,packet       b8
 17:11:27 radius,debug,packet     Service-Type = 1
 17:11:27 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:27 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:27 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:27 radius,debug resending 3f:64
 17:11:27 radius,debug,packet sending Access-Request with id 56 to 127.0.0.1:1812
 17:11:27 radius,debug,packet     Signature = 0xa817cb1e31d5a3232297d3356e6dd8a7
 17:11:27 radius,debug,packet     NAS-Port-Type = 19
 17:11:27 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:27 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:27 radius,debug,packet     User-Name = "7E:52:A2:F0:66:08"
 17:11:27 radius,debug,packet     NAS-Port = 2162163737
 17:11:27 radius,debug,packet     Acct-Session-Id = "80e00019"
 17:11:27 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:27 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:27 radius,debug,packet     CHAP-Challenge = 0x77643adf57032534528d2f0d95bd29e5
 17:11:27 radius,debug,packet     CHAP-Password = 0xfa542ab42257449ecedab897c8bea61d
 17:11:27 radius,debug,packet       b8
 17:11:27 radius,debug,packet     Service-Type = 1
 17:11:27 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:27 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:27 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:28 radius,debug timeout for 3f:64
 17:11:28 hotspot,info,debug 7E:52:A2:F0:66:08 (10.5.50.254): login failed: RADIUS server is not responding
 17:11:28 manager,debug <<< tx Access-Reject to [127.0.0.1]:50743, id: 56
 17:11:45 hotspot,info,debug test2 (10.5.50.254): trying to log in by http-chap
 17:11:45 hotspot,debug test2 (10.5.50.254): local user not found
 17:11:45 hotspot,debug test2 (10.5.50.254): sending RADIUS authentication request
 17:11:45 radius,debug new request 3f:65 code=Access-Request service=hotspot called-id=hotspot1
 17:11:45 radius,debug sending 3f:65 to 127.0.0.1:1812
 17:11:45 radius,debug,packet sending Access-Request with id 57 to 127.0.0.1:1812
 17:11:45 radius,debug,packet     Signature = 0xed75f3d6621ab721ea126986b057f566
 17:11:45 radius,debug,packet     NAS-Port-Type = 19
 17:11:45 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:45 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:45 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:45 radius,debug,packet     User-Name = "test2"
 17:11:45 radius,debug,packet     NAS-Port = 2162163738
 17:11:45 radius,debug,packet     Acct-Session-Id = "80e0001a"
 17:11:45 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:45 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:45 radius,debug,packet     CHAP-Challenge = 0x863fb20d2c611e160008568664f5694f
 17:11:45 radius,debug,packet     CHAP-Password = 0xe3f7f0c87be54487773702de10aa1e71
 17:11:45 radius,debug,packet       ae
 17:11:45 radius,debug,packet     Service-Type = 1
 17:11:45 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:45 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:45 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:45 manager,debug >>> rx Access-Request from [127.0.0.1]:44978, id: 57
 17:11:45 manager,debug rejected for user: <test2> Transfer limit reached
 17:11:45 radius,debug resending 3f:65
 17:11:45 radius,debug,packet sending Access-Request with id 57 to 127.0.0.1:1812
 17:11:45 radius,debug,packet     Signature = 0xed75f3d6621ab721ea126986b057f566
 17:11:45 radius,debug,packet     NAS-Port-Type = 19
 17:11:45 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:45 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:45 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:45 radius,debug,packet     User-Name = "test2"
 17:11:45 radius,debug,packet     NAS-Port = 2162163738
 17:11:45 radius,debug,packet     Acct-Session-Id = "80e0001a"
 17:11:45 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:45 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:45 radius,debug,packet     CHAP-Challenge = 0x863fb20d2c611e160008568664f5694f
 17:11:45 radius,debug,packet     CHAP-Password = 0xe3f7f0c87be54487773702de10aa1e71
 17:11:45 radius,debug,packet       ae
 17:11:45 radius,debug,packet     Service-Type = 1
 17:11:45 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:45 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:45 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:45 radius,debug resending 3f:65
 17:11:45 radius,debug,packet sending Access-Request with id 57 to 127.0.0.1:1812
 17:11:45 radius,debug,packet     Signature = 0xed75f3d6621ab721ea126986b057f566
 17:11:45 radius,debug,packet     NAS-Port-Type = 19
 17:11:45 radius,debug,packet     Calling-Station-Id = "7E:52:A2:F0:66:08"
 17:11:45 radius,debug,packet     Called-Station-Id = "hotspot1"
 17:11:45 radius,debug,packet     NAS-Port-Id = "bridge-hotspot"
 17:11:45 radius,debug,packet     User-Name = "test2"
 17:11:45 radius,debug,packet     NAS-Port = 2162163738
 17:11:45 radius,debug,packet     Acct-Session-Id = "80e0001a"
 17:11:45 radius,debug,packet     Framed-IP-Address = 10.5.50.254
 17:11:45 radius,debug,packet     MT-Host-IP = 10.5.50.254
 17:11:45 radius,debug,packet     CHAP-Challenge = 0x863fb20d2c611e160008568664f5694f
 17:11:45 radius,debug,packet     CHAP-Password = 0xe3f7f0c87be54487773702de10aa1e71
 17:11:45 radius,debug,packet       ae
 17:11:45 radius,debug,packet     Service-Type = 1
 17:11:45 radius,debug,packet     WISPr-Logoff-URL = "http://10.5.50.1/logout"
 17:11:45 radius,debug,packet     NAS-Identifier = "MikroTik hAP ac3"
 17:11:45 radius,debug,packet     NAS-IP-Address = 127.0.0.1
 17:11:45 radius,debug timeout for 3f:65
 17:11:46 manager,debug <<< tx Access-Reject to [127.0.0.1]:44978, id: 57
 17:11:47 hotspot,info,debug test2 (10.5.50.254): login failed: RADIUS server is not responding

ddejager · February 26, 2022, 3:16pm

I don’t know the exact cause of this yet, but have determined that the problem is in the new user manager. If I use the old user manager (routerOS 6.x) with a routerOS 7.1.3 hotspot, the system works.

ddejager · February 28, 2022, 12:50am

From experimenting with the new user manager, I notice at least three issues: 1) the default radius timeout of 300 msec seems too, short. Timeouts occur unless I set it above 1000 msec. This results in dropped responses such as a reject to a login attempt. 2) the user manager does not send an attribute “Mikrotik-Total-Limit” (if one is set in the data for the user in the user manager). This results in the hotspot not cutting the user off at the limit. The old user manager DOES send this to the hotspot with the remaining limit for the user. 3) with the old user manager there were automatic interim reports requested. With the new one, none are. If you configure the hotspot server profile to provide an update every minute, when the user manager reports that the limit has been exceeded, the hotspot does not understand the response.

Am I missing some configuration options in the new user manager? Hard to tell with no significant documentation. Any suggestions or is the new UM just not ready yet if you want to limit the user by total bytes?

ddejager · March 4, 2022, 10:52pm

I opened a ticket with support and discovered the following:

with User Manager v5 (part of Router OS 7.x) it is necessary to manually allow incoming radius requests (/radius/incoming/set accept=yes)
It is also necessary manually enable and set a value for interim updates. This was hard coded in in v4.
v5 does not automatically provide a total byte limit to the hotspot like v4 did. This means that if you want to limit the hotspot by bytes, you must do the above two steps. In v4, the total byte limit was provided to the hotspot by the user manager automatically, so the hotspot could cut the user off when the limit was reached. Now the radius server will issue a disconnect request in response to an interim update when the limit is reached. This seems less efficient and less accurate to me than the v4 operation.
If you want to rate limit hotspot connections, make sure to disable fasttrack for the hotspot or rate limiting queues will not work.

bpwl · September 4, 2024, 4:23pm

Volume limits consumed for the user are somewhere in “User Profiles”, but not visible or reachable.

How to get there ?

Limts to check are set in Limitations. These limts can have a ‘reset counters’ start and interval (daily,weekly, …)
Limitations are linked with Profiles with “Profile Limitations” table/TAB
Users get one or multiple profiles and are granted their limitations in the “Users Profiles” table/TAB

http://forum.mikrotik.com/t/hotspot-and-radius-volume-limit-doesnt-work/153558/1