[SOLVED] RADIUS on RouterOS: "unknown-Attribute (vendor=MT,type=...)

RouterOS Wireless Networking
1

I still have problems getting the “Mikrotik_Wireless_VLANID” and “Mikrotik_Wireless_VLANIDtype” recognized by RouterOS.

  • I have an Microsoft server which sends the user defined attributes / custom VSAs with "type 26 and type 27) to a freeradius server

  • On the freeradius within /etc/raddb/mods-config/attr_filter/post-proxy I added:

Mikrotik_Wireless_VLANID =* ANY,
Mikrotik_Wireless_VLANIDtype =* ANY
  • Let´s look at the Access-Accept on the freeradius: cat /var/log/radius/radacct/…/post-proxy-detail-20160209
Tue Feb  9 08:58:53 2016
Packet-Type = Access-Accept
Proxy-State = 0x313839
Mikrotik_Wireless_VLANID = 743
Mikrotik_Wireless_VLANIDtype = 0
[...]

=> This looks fine. Freeradius recognizes the attributes.


\

  • What does RouterOS receive:
received Access-Accept with id 189 from [...]
Unknown-Attribute(vendor=MT, type=26) = 0x000002e7 
Unknown-Attribute(vendor=MT, type=27) = 0x00000000
Signatue = [...]
Framed-MTU = 1300
EAP-Message = [...]
MS-MPPE-Send-Key = [...]
MS-MPPE-Recv-Key = [...]
Message-Authenticator = [...]

=> Unknown attributes? Why doesn´t recognize RouterOS its own Mikrotik attributes at all? Do I have to import the dictionary file into RouterOS like I did on the freeradius server?

2

No, AFAIK ROS doesn’t offer the possibility of importing third party dictionaries.

Could it be that ROS expects an integer value, and is being passed a string?

A full debug while running radiusd -X will also help.

3

FYI, according to http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless#VLAN_tagging :

You can configure your RADIUS authentication server to assign users or groups of users to a specific VLAN when they authenticate to the network. To use this option you will need to use RADIUS attributes.

Note: In case to use this option you must enable > wireless-fp or wireless-cm2 > package.

Maybe that (wireless package used) is related to the unknown attribute.

4

That´s it I had to use wireless-cm2 package, i.e. CAPSMAN2
(It works, but still shows unknown-Attribute (vendor=MT,type=…))

Thanks!

5

Glad it helped! :smiley:

If debugging is still showing “unknown parameter”, generate a supout in the system while such radius transaction is happening, and send it to support at mikrotik attaching it and pointing to this post (or including the info you already posted) with a subject like “Cosmetic Radius Bug” or alike.