Community discussions

MikroTik App
just joined
Topic Author
Posts: 11
Joined: Thu Nov 01, 2012 6:23 pm

EAP Configuration Problem

Mon Nov 16, 2020 9:33 am

I install a RADIUS Server Using Miktotik User Manager.
Then Configure a wAP to authenticate connected mobiles using this RADIUS Server
and create a wireless profile to authenticated users using EAP TLS without certificate verification.
Now, when I try to connect to Wireless router Using cellphone, the radius server successfully verify user authentication and authorization but the wAP getting @wlan1: disconnected, 802.1x authentication failed

This is wAP confiruation

[admin@MikroTik] > export
# nov/16/2020 10:52:05 by RouterOS 6.48beta48
# software id = PT7A-Z2FB
# model = RouterBOARD wAP 2nD
# serial number = 5D480548D374
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection-key=WiFiPr0tK3y mode=\
dynamic-keys name=WiFi radius-mac-mode=as-username-and-password \
supplicant-identity=MikroTik wpa2-pre-shared-key=Inf0rm^tikz
add authentication-types=wpa2-eap eap-methods=eap-tls interim-update=59s \
management-protection-key=WiFiPr0tK3y mode=dynamic-keys name=WiFi-EAP \
radius-called-format=mac radius-mac-accounting=yes \
radius-mac-authentication=yes supplicant-identity=MikroTik \
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
disabled=no distance=indoors frequency=auto installation=\
indoor mode=ap-bridge security-profile=WiFi-EAP ssid=WL-F1S-01 \
wireless-protocol=802.11 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=
/ip dhcp-server
add address-pool=dhcp disabled=no interface=wlan1 name=defconf
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add comment=defconf interface=wlan1 list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address= comment=defconf interface=wlan1 network=\
add address= interface=ether1 network=
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address= comment=defconf gateway=
/ip dns
set allow-remote-requests=yes servers=,
/ip dns static
add address= comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat
/ip route
add distance=1 gateway=
/ip service
set www-ssl disabled=no
add address= secret=WR@ut3nt service=wireless
/radius incoming
set accept=yes
/system logging
add topics=radius,wireless
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

and this is Radius Server configuration

[admin@radius] > export
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/queue interface
set ether1 queue=ethernet-default
/tool user-manager customer
set admin access=\
/tool user-manager profile
add name=Limited name-for-users="" override-shared-users=unlimited owner=admin \
price=0 starts-at=logon validity=0s
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip address
add address= interface=ether1 network=
/ip cloud
set update-time=no
/ip dns
set servers=
/ip ipsec policy
set 0 dst-address= src-address=
/ip route
add distance=1 gateway=
/system clock
set time-zone-autodetect=no
/system identity
set name=radius
/tool user-manager database
set db-path=primary-slave/user-manager2
/tool user-manager router
add coa-port=3799 customer=admin disabled=no ip-address= log=\
auth-ok,auth-fail,acct-ok,acct-fail name=Wireless shared-secret=WR@ut3nt \
/tool user-manager user
add customer=admin disabled=no ipv6-dns=:: password="" shared-users=\
unlimited username=XXXXXXXXXXXX wireless-enc-algo=none wireless-enc-key="" \

Who is online

Users browsing this forum: No registered users and 37 guests