Use FreeRadius insted of L2TP connection?

RouterOS General
1

Hello
I have about 500 Routers I need to manage \ control \ support
up until now I have connected to them using L2TP - no problem there
wanted to know :

  1. Using FreeRadius will be better solution ? for mangmnet ?
  2. Can get more data\statistics?
  3. Can I make “scripts” for adding new routers?
    for example want to add new “group” of devices from 10.10.10.67-10.10.10.85
    or to give tag for all 10.10.10.X and then it will add automattecly to the next IP avaliable ?
  4. Is there a gui for it? so if I give access for someone to control it ? is it eaasy to use?

Thanks ,

2

Hello,
Correct me if I’m wrong, But does the dude or CAPsMAN do the same job?

3

FreeRADIUS doesn’t replace L2TP, it purely provides authentication, authorisation and accounting. You can use it instead of hard-coded usernames and passwords under System > Users > Users and/or PPP > Secrets to replace login and/or VPN access respectively.

There is no native GUI. There are various open source offerings, although many have not been updated in some considerable time, and some commercial ones too. If you run Windows servers it is possible to use NPS for RADIUS.

Remember that if your Mikrotik cannot communicate with the RADIUS server any login or VPN access which relies on it will no longer work.

4

I need them to connect to me and get an IP - so I will be able to mange them .

Remember that if your Mikrotik cannot communicate with the RADIUS server any login or VPN access which relies on it will no longer work.

if they can’t communicate - I know there is a problem , so this is part of the solution

jsut to understand (maybe this is my mistake )
if I setup radius server
it will give the router an andress, no? acoording to the user\pass I give him
and from the radius server I will be able to connect to him ?

5

From my understanding, you Still need a VPN connection to carry the AUTH over some protocols PPTP L2TP SSTP OpenVPN IKev2, etc…
You can set the IP pool in the Radius server. if that’s what you want but still have to connect to some sort of tunnel.

6

It depends on the service, for those which set use an IP address RADIUS can return an attribute with a specific address or the name of a pool on the Mikrotik to use. Overview https://mum.mikrotik.com/presentations/HU16/presentation_3856_1479300815.pdf and the list of attributes https://wiki.mikrotik.com/wiki/Manual:RADIUS_Client#Supported_RADIUS_Attributes shows what information is sent to the RADIUS server and what configuration can be returned.


and from the radius server I will be able to connect to him ?

No. The Mikrotik sends authentication requests to the RADIUS server, the RADIUS server accepts or denies the request. Communication between the Mikrotik and user does not involve the RADIUS server.

7

Zerotier could be a solution except that its CPU specific (not all MTs).