Community discussions

MikroTik App
 
tohidianh
just joined
Topic Author
Posts: 11
Joined: Thu Nov 01, 2012 6:23 pm

EAP Configuration Problem

Mon Nov 16, 2020 9:33 am

Hello.
I install a RADIUS Server Using Miktotik User Manager.
Then Configure a wAP to authenticate connected mobiles using this RADIUS Server
and create a wireless profile to authenticated users using EAP TLS without certificate verification.
Now, when I try to connect to Wireless router Using cellphone, the radius server successfully verify user authentication and authorization but the wAP getting @wlan1: disconnected, 802.1x authentication failed


This is wAP confiruation

[admin@MikroTik] > export
# nov/16/2020 10:52:05 by RouterOS 6.48beta48
# software id = PT7A-Z2FB
#
# model = RouterBOARD wAP 2nD
# serial number = 5D480548D374
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection-key=WiFiPr0tK3y mode=\
dynamic-keys name=WiFi radius-mac-mode=as-username-and-password \
supplicant-identity=MikroTik wpa2-pre-shared-key=Inf0rm^tikz
add authentication-types=wpa2-eap eap-methods=eap-tls interim-update=59s \
management-protection-key=WiFiPr0tK3y mode=dynamic-keys name=WiFi-EAP \
radius-called-format=mac radius-mac-accounting=yes \
radius-mac-authentication=yes supplicant-identity=MikroTik \
wpa2-pre-shared-key=Inf0rm^tikz
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=\
indoor mode=ap-bridge security-profile=WiFi-EAP ssid=WL-F1S-01 \
wireless-protocol=802.11 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=wlan1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add comment=defconf interface=wlan1 list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=wlan1 network=\
192.168.88.0
add address=172.17.0.100/22 interface=ether1 network=172.17.0.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,4.2.2.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat
/ip route
add distance=1 gateway=172.17.1.60
/ip service
set www-ssl disabled=no
/radius
add address=172.17.0.101 secret=WR@ut3nt service=wireless
/radius incoming
set accept=yes
/system logging
add topics=radius,wireless
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

and this is Radius Server configuration

[admin@radius] > export
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/queue interface
set ether1 queue=ethernet-default
/tool user-manager customer
set admin access=\
own-routers,own-users,own-profiles,own-limits,config-payment-gw
/tool user-manager profile
add name=Limited name-for-users="" override-shared-users=unlimited owner=admin \
price=0 starts-at=logon validity=0s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address=172.17.0.101/22 interface=ether1 network=172.17.0.0
/ip cloud
set update-time=no
/ip dns
set servers=8.8.8.8
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/ip route
add distance=1 gateway=172.17.1.60
/system clock
set time-zone-autodetect=no
/system identity
set name=radius
/tool user-manager database
set db-path=primary-slave/user-manager2
/tool user-manager router
add coa-port=3799 customer=admin disabled=no ip-address=172.17.0.100 log=\
auth-ok,auth-fail,acct-ok,acct-fail name=Wireless shared-secret=WR@ut3nt \
use-coa=yes
/tool user-manager user
add customer=admin disabled=no ipv6-dns=:: password="" shared-users=\
unlimited username=XXXXXXXXXXXX wireless-enc-algo=none wireless-enc-key="" \
wireless-psk=""

Who is online

Users browsing this forum: Bing [Bot], r00t and 42 guests