Community discussions

MikroTik App
 
aussiewan
newbie
Topic Author
Posts: 26
Joined: Wed Sep 07, 2011 5:28 am

DHCP + RADIUS Framed-Route behaviour

Wed Feb 28, 2018 7:22 am

We have a system where we authenticate DHCP clients based on DHCP option 82. This allows us to set a static IP for a service, which is not reliant on the CPE MAC or some other value which might change.

On our RADIUS server, we have taken advantage of the Framed-Route value so that we can assign additional subnets to be routed to the customer. The Mikrotik DHCP server takes the Framed-Route value and creates a "dynamic active static" route for those subnets with a gateway of the DHCP client IP. It's a fantastic feature that makes for less manual configuration.

But only for non-Mikrotik CPEs. Mikrotik CPEs lose their default route, and only add routes for those Framed-Route values.

As far as I can gather/remember (it's been a while since I investigated), the Mikrotik DHCP server also sends those Framed-Route values on to the client in the DHCP offer, as part of DHCP Option 121. As Chupaka eloquently stated in another post:
The issue is that 'other brands' does not follow RFC. RFC3442 clearly states: "If the DHCP server returns both a Classless Static Routes option and a Router option, the DHCP client MUST ignore the Router option."

From what I have seen, an all Mikrotik environment would end up with those additional routes being routed to the CPE, and the CPE would only add (broken) routes for those subnets.

My apologies if I have made any mistakes in amongst this - it's been a while since I investigated this behaviour, and only thought to post here after discussing a recent RouterOS release.

Has anyone else seen this behaviour, or gotten this working the way we intend to make it work?
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: DHCP + RADIUS Framed-Route behaviour

Wed Feb 28, 2018 8:00 am

Well, as for me, the problem is that Framed-Route value is used in Option121 (as well as in router's dynamic routes), because those routes shouldn't be 'symmetric'.

According to the docs https://wiki.mikrotik.com/wiki/Manual:I ... er#Summary, it's undocumented behaviour :) So I think you should write to support@mikrotik.com if the situation with adding the same routes to both dhcp server and client is actual for recent version of RouterOS.
 
aussiewan
newbie
Topic Author
Posts: 26
Joined: Wed Sep 07, 2011 5:28 am

Re: DHCP + RADIUS Framed-Route behaviour

Wed Feb 28, 2018 8:49 am

Agreed, using the same RADIUS response value for those 2 behaviours seems like an unwanted "feature".

I'll lab it up and check the most recent bugfix release first to ensure it's still showing the same behaviour - I'm seeing it on 6.39.3, the last bugfix release.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: DHCP + RADIUS Framed-Route behaviour

Wed Feb 28, 2018 9:19 am

Well, to be sure you should use current release (rc is desirable but not mandatory) - if it's already fixed, it should be backported, not fixed again :)
 
aussiewan
newbie
Topic Author
Posts: 26
Joined: Wed Sep 07, 2011 5:28 am

Re: DHCP + RADIUS Framed-Route behaviour

Wed Feb 28, 2018 10:47 pm

Well, to be sure you should use current release (rc is desirable but not mandatory) - if it's already fixed, it should be backported, not fixed again :)
Fair point :) I'll lab it up and go from there.
 
whitestargh
newbie
Posts: 28
Joined: Tue Feb 08, 2011 2:48 pm

Re: DHCP + RADIUS Framed-Route behaviour

Sun Apr 21, 2019 10:20 am

The issue persists. Framed-routes (dst-addresses with gateway as leased client ip address) sent by Radius Server to DHCP-SERVER to be dynamically installed on router are also sent via option 121 to dhcp-client which gets installed. This drops default-routes pushed to clients.

AS at ROS 6.44.2

Mikrotik fix this bug. Its becoming a nuisance.
 
sup5
Member
Member
Posts: 359
Joined: Sat Jul 10, 2010 12:37 am

Re: DHCP + RADIUS Framed-Route behaviour

Sun Apr 21, 2019 11:52 am

Try this on DHCP-Client:

special-classless - adds both classless route if received and default route (MS style)
 
aussiewan
newbie
Topic Author
Posts: 26
Joined: Wed Sep 07, 2011 5:28 am

Re: DHCP + RADIUS Framed-Route behaviour

Thu May 23, 2019 5:08 am

Try this on DHCP-Client:

special-classless - adds both classless route if received and default route (MS style)
This is only possible if you control the CPE, which is quite often not the case.
 
User avatar
petrb
Member Candidate
Member Candidate
Posts: 100
Joined: Thu Jan 26, 2017 4:17 pm

Re: DHCP + RADIUS Framed-Route behaviour

Sat Jun 29, 2019 12:44 am

up ..... framed-route from dhcp+radius not installed :(
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8709
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: DHCP + RADIUS Framed-Route behaviour

Sat Jun 29, 2019 7:52 am

Not installed where? As above it's told that it's installed and pushed via DHCP :)
 
User avatar
petrb
Member Candidate
Member Candidate
Posts: 100
Joined: Thu Jan 26, 2017 4:17 pm

Re: DHCP + RADIUS Framed-Route behaviour

Sat Jun 29, 2019 2:07 pm

for an example:
device 1: linux - freeradius server with user, framed-ip, framed-route and delegated-ipv6-prefix
device 2: mikrotik RB - DHCP server with access to the freeradius
device 3: CPE dhcp client

- CPE device successfully get framed-ip, network, mask, gateway
- CPE device successfully receive delegated-ipv6-prefix and via ND get IPv6 WAN ip and gefault GW
- MK DHCP server successfully add delegated-ipv6-prefix route into ipv6 routing table

- MK DHCP server not add framed-route into ipv4 routing table (for PPPoE framed-route is installed in MK "device 2")

what is wrong?
 
User avatar
petrb
Member Candidate
Member Candidate
Posts: 100
Joined: Thu Jan 26, 2017 4:17 pm

Re: DHCP + RADIUS Framed-Route behaviour

Sat Jun 29, 2019 3:00 pm

DONE, it works ... my mistake.

it works, but it was so funny for me :) ...

- for pppoe the declaration is Framed-Route = "192.168.99.0/24"
- for dhcp the declaration must be Framed-Route = "192.168.99.0/24 FRAMED-IP-ADDRESS 1"

Who is online

Users browsing this forum: Bing [Bot] and 97 guests