WiFi, WPA2 EAP and radius

RouterOS Wireless Networking
1

Hi!
I have this configuration:

[admin@NTP] > /interface wireless print detail 
Flags: X - disabled, R - running 
 0    name="wlan1" mtu=1500 l2mtu=1600 mac-address=D4:CA:6D:E1:01:11 arp=enabled interface-type=Atheros AR9300 mode=ap-bridge 
      ssid="MAG" frequency=2412 band=2ghz-b/g/n channel-width=20/40mhz-eC scan-list=default wireless-protocol=802.11 
      vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none wds-ignore-ssid=no bridge-mode=enabled 
      default-authentication=yes default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=no 
      security-profile=rad compression=no

security profile:

 1   name="rad" mode=dynamic-keys authentication-types=wpa2-eap unicast-ciphers=aes-ccm group-ciphers=aes-ccm 
     wpa-pre-shared-key="" wpa2-pre-shared-key="" supplicant-identity="" eap-methods=passthrough tls-mode=no-certificates 
     tls-certificate=none mschapv2-username="" mschapv2-password="" static-algo-0=none static-key-0="" static-algo-1=none 
     static-key-1="" static-algo-2=none static-key-2="" static-algo-3=none static-key-3="" static-transmit-key=key-0 
     static-sta-private-algo=none static-sta-private-key="" radius-mac-authentication=no radius-mac-accounting=no 
     radius-eap-accounting=no interim-update=1m radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username 
     radius-mac-caching=disabled group-key-update=5m management-protection=allowed management-protection-key=""

and Radius settings:

[admin@NTP] > /radius print detail 
Flags: X - disabled 
 0   service=wireless called-id="mag1" domain="" address=10.1.0.9 secret="wi" authentication-port=1812 
     accounting-port=1813 timeout=3s accounting-backup=no realm=""

When I tries connect to mikrotik from phone - I’m not see any attempt to communicate with radius, and see these messages in Log:

17:26:39 wireless,debug wlan1: 00:03:DA:FA:B6:5A attempts to associate 
17:26:39 wireless,debug wlan1: 00:03:DA:FA:B6:5A not in local ACL, by default accept 
17:26:39 wireless,info 00:03:DA:FA:B6:5A@wlan1: connected 
17:26:39 wireless,info 00:03:DA:FA:B6:5A@wlan1: disconnected, 802.1x authentication timeout

What I’m doing wrong?

RouterOS - 6.40.1

WBR,
Fyodor.

2

What exactly are you trying to do? Authentication using MAC or using MSCHAPv2 user/password?

For the latter we use this security profile:
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-eap eap-methods=
eap-tls,passthrough management-protection-key=xxxx mode=
dynamic-keys radius-eap-accounting=yes supplicant-identity=MikroTik

(this works with Ubiquiti clients and with MikroTik clients > 6.39)

3

I want connect from my phone to mikrotik access point using Radius name/password authentication.

BTW, your settings do not help - the same effect (no attempts to connect to radius server and instant message in log file about time-out).

4

I have no experience with a phone but we use this on outdoor links (client->access point) and it works perfectly.