User Firewall Rules with Road Warrior IKEv2 and RADIUS

RouterOS General
1

Hi Mikrotik Community,

we use Road Warrior VPN using IKEv2 with EAP-MSCHAPv2 with Microsoft NPS Server and Active Directory Users.

Users are Authenticated with their Domain User and Password if they are in the VPN Group defined in the NPS Policy.

We want to create Firewall Rules which allow User_A to Server-A and User_B to Server-B.

My first idea was to assign static IP in the AD-Dail-in Settings to pass “Framed-IP” over to the Mikrotik.
But it didn’t work. Mikrotik still assign Addresses from his pool to the Clients.

Any idea how Mikrotik will use the Framed-IP Attribute (not sure if the Dail-in AD Setting is the Framed-IP) or how i can create used defined rules? Maybe based on the defined Active Directory Group?

Best Regards,

YAN

2

If i set in the AD Dial-in a static IP for the User

image
image600×571 101 KB

the Mikrotik recieves 255.255.255.255 as Framed-IP

2026-01-14 09:10:26 radius,debug,packet     Signature = 0xa9a6912aed5f01778ba80cee9658c240 
2026-01-14 09:10:26 radius,debug,packet     Acct-Status-Type = 2 
2026-01-14 09:10:26 radius,debug,packet     Acct-Session-Time = 145 
2026-01-14 09:10:26 radius,debug,packet     Acct-Session-Id = "85e0003a" 
2026-01-14 09:10:26 radius,debug,packet     Acct-Authentic = 1 
2026-01-14 09:10:26 radius,debug,packet     User-Name = "systest@ad.test.test" 
2026-01-14 09:10:26 radius,debug,packet     Called-Station-Id = "" 
2026-01-14 09:10:26 radius,debug,packet     Calling-Station-Id = "" 
2026-01-14 09:10:26 radius,debug,packet     NAS-Port-Id = 0x0000000c 
2026-01-14 09:10:26 radius,debug,packet     NAS-Port-Type = 5 
2026-01-14 09:10:26 radius,debug,packet     Service-Type = 2 
2026-01-14 09:10:26 radius,debug,packet     Event-Timestamp = 1768378226 
2026-01-14 09:10:26 radius,debug,packet     MS-CHAP-Domain = "ad.test.test" 
2026-01-14 09:10:26 radius,debug,packet     Framed-IP-Address = 255.255.255.255 
2026-01-14 09:10:26 radius,debug,packet     Acct-Input-Octets = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Input-Gigawords = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Input-Packets = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Output-Octets = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Output-Gigawords = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Output-Packets = 0 
2026-01-14 09:10:26 radius,debug,packet     Acct-Terminate-Cause = 4 
2026-01-14 09:10:26 radius,debug,packet     NAS-Identifier = "ccr1.test.test" 
2026-01-14 09:10:26 radius,debug,packet     Acct-Delay-Time = 0 
2026-01-14 09:10:26 radius,debug,packet     MT-Realm = 0x61642e73617a7572652e6465 
2026-01-14 09:10:26 radius,debug,packet     NAS-IP-Address = 172.24.21.254

image
image955×928 173 KB

Red Arrow, the 255.255.255.255 is recieved by Mikrotik

Yellow Arrow, Mikrotik will assign from the IP-Pool in the IPsec Mode Config

Green Arrow, this works, if the IPsec Mode Config Pool is removed. But then i have to create a Policy for every user in the NPS? Feels wrong.

3

Solution :white_check_mark:

This Checkbox has to be clear - then everything works as expected.

Maybe you have to Adjust your IPsec Policy in Mikrotik to match the Assigment in the AD Dial in User Attribute.

image
image1279×1025 252 KB

From the oreilly RADIUS Book:

There are two specific IP values reserved for use by RADIUS. The address 255.255.255.255 is used when the client computer negotiates for the IP it uses. This may be when the user has an assigned static IP address and needs to communicate directly with the IP provisioning equipment in order to get this address. The address 255.255.255.254 is used when the RADIUS client issues the IP address.