I am evaluating MikroTik/RouterOS for use in our organization at sites that do not have the budget for full enterprise gear (HPE Aruba is our standard). I got a CRS328-24P-4S+RM switch and I was able to get it up and running within our network, successfully tagging/untagging VLANs.
We use ClearPass for authenticating to the network. I have not had much luck finding resources for anyone who has tried to use ClearPass with RouterOS. I was able to set up the RADIUS server, however I am not sure how to configure my access ports to point to ClearPass for authentication and correct VLAN assignment. The furthest I’ve gotten is to pass creds when attempting to sign into the switch itself. The MikroTik documentation shows client supplicant configuration settings, but it’s almost as if it wants me to prefill the details that the device connecting to the port should be supplying… https://help.mikrotik.com/docs/display/ROS/Dot1X Any guidance on this subject? I feel like I just need to configure the ports properly.
[admin@MikroTik] > export
# 2024-01-09 12:54:56 by RouterOS 7.13.1
# software id = T0G4-BFMH
#
# model = CRS328-24P-4S+
# serial number = [REDACTED]
/interface bridge
add ingress-filtering=no name=MGMT port-cost-mode=short pvid=[REDACTED] \
vlan-filtering=yes
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/port
set 0 name=serial0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=MGMT ingress-filtering=no interface=sfp-sfpplus1 internal-path-cost=\
10 path-cost=10 pvid=[REDACTED]
add bridge=MGMT ingress-filtering=no interface=ether2 internal-path-cost=10 \
path-cost=10 pvid=[REDACTED]
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=MGMT untagged=sfp-sfpplus1 vlan-ids=[REDACTED]
add bridge=MGMT tagged=sfp-sfpplus1 vlan-ids=[REDACTED]
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=[REDACTED] interface=MGMT network=[REDACTED]
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=[REDACTED]
/radius
add address=[REDACTED] service=login,dot1x
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=America/New_York
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=[REDACTED]
/system routerboard settings
set boot-os=router-os
/user aaa
set use-radius=yes