Was wanting to setup a simple radius profile for suspended users. The plan was to issue them an alternate IP pool called "suspend-pool", and then to redirect all HTTP requests(from the suspend-pool) to a "Pay your bill" web page.

The problem is that the "Framed-Pool" radius attribute (#88) is not choosing the specified pool. Currently we are running 3.30 on a RB532. The reply attribute is:

Framed-Pool="suspend-pool"

This is just a test system and pppoe server is running on the wlan1 card. It authenticates radius users correctly. I turned radius debugging on in the RouterOS logging and it correctly shows the attribute Framed-Pool="suspend-pool".

Currently I have the pool setup in the RB.
/ip pool
add name=pppoe-poool ranges=10.100.9.20-10.100.9.250
add name=suspend-pool ranges=10.199.199.2-10.199.199.254

There is a pppoe-profile that is on the server that tells it to use the regular ip pool "pppoe-pool". But when using the attribute I do not get an address from the "suspend-pool". Shouldn't the Framed-Pool attribute over-ride the default settings? Anyone know how I can make Framed-Pool work correctly?

Eric

hmmm... what if you remove 'Framed-Pool' attribure from RADIUS response? can you connect to pppoe server?

hmmm... what if you remove 'Framed-Pool' attribure from RADIUS response? can you connect to pppoe server?

Yes, either way, it connects. It just doesn't use the specified pool.

Eric

According to the manual that should work.
http://wiki.mikrotik.com/wiki/Manual:RA ... ess-Accept

Shot in the dark, are you using Framed-IP-Address? Probably not but that attribute is documented to void Framed-Pool.

Have you turned on PPPoE debugging to see if it throws any errors when being handed the pool name? I don't use PPPoE, but I do use Hotspots and it does log a line for each attribute taken from RADIUS.

Edit: if that still doesn't get you anywhere and no one else has any ideas, there's an undocumented RADIUS attribute Mikrotik-Address-List (number 19 in vendor 14988, type string) that at least for Hotspots adds the user's IP address to the address list specified in the attribute on logon, and removes the IP again on logoff. That might be an alternative way to identify users if it also works for PPPoE.

remove 'Remote Address' from pppoe profile. after that you should be able to login to VPN only is you set 'Framed-Pool' attribute

Ugh, I'm an idiot. Evidently, I did have a Framed-IP-Address value. I'm using Radiator radius server and didn't notice another field on the test account.

Anyway it works even with another value in "Remote Address" under pppoe-profile. So Framed-Pool is working exactly as it should; overriding the default value. Now to get the redirection working, which should be the easy part.

Eric

http://forum.mikrotik.com/viewtopic.php?f=2&t=39625

That thread contains a full solution.