*Sorry I posted this in the wrong microtik forum before here viewtopic.php?f=13&t=143620&p=821127#p821127
this should be here)
OMG guys, I posted several days before.I am very novice in this, however, I tried so much that somehow I have make the supplicant method work using the RB4011GS+RM . I know there is an issue about the VLAN not been able to handle VLAN 0 tags or something like this. However, I want to share exactly what I did so that it might help people struggling as much as I did. I will try to explain even the most simple staff that people take for granted that others people know, but like in my case we have no idea, when we start...
The router I used was the RB4011GS+RM. Please help me polish this instructions as simple and as much as possible so that anyone that uses it even a noob like myself would have been able to accomplish the task. Thanks to anyone that helps.
Before anything for the supplicant method you need to extract the certificates of your ATT RG (this is the big box usually black and that has 4 Ethernet ports, and not the one that is small that only have one Ethernet port(how exactly this is done with the BG210-700 is explained in this following link https://www.dupuis.xyz/bgw210-700-root-and-certs/
. If they take down the website try to look for a copy of the instruction on Reddit or somewhere else (you can also buy them in eBay but I do not know how reliable this is so I do not recommend it).
A summary you need to extract 6 public certificates from your modem(or these public ones can be even found on the internet and it would work if they are the authentic ones of course) and then you need to extract a file called mfg.dat. This is a encrypted file that contains your private certificate key for your ATT RG. After you have extracted those files from your ATT RG you need to use a program made by devicelocksmith that can be found in this following website https://www.devicelocksmith.com/2018/12
to convert those files into 3 .pem certificate files that you will then use to import to the Microtik router (make sure you put all the 6 public certificates and the mfg.dat in the same folder of the devicelocksmith program to covert this certificate correctly)
After you have the certificates and from a fresh configuration ( go to system reset configuration dont check anything and apply):
1. Manually Set the System Clock: A note about setting the clock time using the winbox there is two tabs time and manual time zone. In the tab time, first make sure that the time and date are correct with your zone. I have clicked time zone auto-detect and DTS active,however, make sure that the time and date of your computer are also correctly adjusted to your zone. Now in the manual time zone also adjust the time as you just did with the last tab where its says time zone it should be exactly the same as what is in the GMT offset of your time tab.
2. Import Certificate Files: A note about importing the certificates. First upload them with the winbox to the Microtik router. Then, import them by going to system then certificates then import. Follow the order that this step says. First import the ca.xxxxx.pem certificate when you import this certificate alone you will see that 4 other certificate show up in the certificates. You should have a T initial letter at the beginning of all this certificates meaning they are trusted. if you dont get the T which means trusted something is off and you should see if may be you did not extracted the certificates correctly or anything else. Then, import the clientcertificate.pem when you import this you only get one certificate however instead of a T you should have a KT as an initial so you know you are going in the right direction(between the way this is the certificate that you will later use in the DOTx1 for authentication. Last, import the Privatekey.pem certificate and you will get one more certificate this one also should have a initial T at the beginning. In summary you should end up with 6 certificates when you import the 3 .pem certificates keys and 5 of them should have a T initial at the beginning and one of them a KT initial at the beginning. After, importing them click on setting in the same certificates section ad make sure that both CRL Donwload and USE CRL are uncheked hit apply and then ok and move to the next step.
3. Configure your WAN port: A note here first I did a notepad file and I copied the most basic settings I do not set up firewall or anything so that is a short and clean as possible. After you successfully connect to the internet then you can set up other things like firewall etc. you can name the file whatever you want in the file I have the following: (simply replace the mac address xx:xx:xx:xx:xx:xx with the mac address of your ATT RG in the 3 fields below, and use the exact name that is in your Microtik certificate section for the client.pem file). Save this file. now go to system scripts and hit the blue + tab and in name put anything you want leave the other fields as they are, and in the withe box at the end where it says source copy and paste the settings just below changing what I already noted. Now hit apply then ok then you can close it. You do not need to hit run script.
Code: Select all
set [ find default-name=ether1 ] mac-address=xx:xx:xx:xx:xx:xx
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
/interface dot1x client
add anon-identity=xx:xx:xx:xx:xx:xx certificate=\
Client_xxxxxx-xxxxxxxxxxxxxx.pem_0 eap-methods=eap-tls identity=\
add disabled=no interface=ether1
/interface ethernet switch port set ether1 vlan-mode=fallback
4. Configure the Dot1x interface: Notes about this. although you can see I added the dot1x in the script in the last step I also used the GUI. So go to winbox then dot1x hit the blue + sign and select interface ether1, then in the identity and anon.identity again put the same mac adress of the ATT RG as you used in the last step. yes the same in both, now in certificate select the certificate that says client.xxxx.xxxxx.pem_0, and lastly in the EAP Methods select EAP TLS . lastly hit apply then OK. Now connect the ONT cable that goes directly from the small box that only have one Ethernet port to the port Ethernet one of the Microtik and connect your PC to any of the other ports. You should get authenticated fairly quickly you dont even have to reboot. If the authentication is trapped in authenticated then connecting loop something is wrong, if the authentication says authenticated without a server something is wrong.
About the speed issue I posted in the last forum I have already resolved. I am getting an average of 750mbs and the adpater display correctly that is capable of 1GB. The issue was that the lapto I was using has a very old NIC card that is only capable of 100mbs and it was nothing to do with the set up or the router. Now the issue remain is that I am pretty sure that I am getting only up to 750mbs is because my ISP is limiting my configuration file to that. If I pay for 1GB should I called and argue with the ISP to be able to at least get to 900mbs or is this speed the throughput usually people with 1GB receive. Is 250mbs to me I think is a lot anyhow I would like to know if this is something that most people get... I think I should call. Advice will be welcome.
Isuued posted in the last post, aLreay solved (Now the only problem I have right now is that although I have 1GB of internet speed I am only getting 100, however, I know is something in the configuration that I did because when I plug it in the PC the maximum speed it says is 100mbs unlike a 1GB when is connected the other way. Now I know the RB4011GS+RM is capable of 1GB speed or so I read in the description when I bought the product. Can someone be so gentle and help me adjust this setting so I can get the full speed I am paying for.)
I would greatly appreciate any help with this. Also, how do I set a good secure firewall. I do not plan on using IPv6. However, how would you set up IPv6 is something that some people is asking about and I also do not know how to do.
Hope this guide help someone and also people help to improve it, and I hope someone can help me adjust the setting so I can get the full speed of 1GB.