• hotspot - HotSpot authentication service
• login - router's local user authentication
• ppp - Point-to-Point clients authentication
• telephony - IP telephony accounting
• wireless - wireless client authentication (client's MAC address is sent as User-Name)
• dhcp - DHCP protocol client authentication (client's MAC address is sent as User-Name)
timeout ( time ; default: 100ms ) - timeout after which the request should be resend
Notes
The order of the items in this list is significant.
Microsoft Windows clients send their usernames in form domain\username
When RADIUS server is authenticating user with CHAP, MS-CHAPv1, MS-CHAPv2, it is not
using shared secret, secret is used only in authentication reply, and router is verifying it. So if you
have wrong shared secret, RADIUS server will accept request, but router won't accept reply. You
can see that with /radius monitor command, "bad-replies" number should increase whenever
somebody tries to connect.
Example
To set a RADIUS server for HotSpot and PPP services that has 10.0.0.3 IP address and ex shared
secret, you need to do the following:
[admin@MikroTik] radius> add service=hotspot,ppp address=10.0.0.3 secret=ex
[admin@MikroTik] radius> print
Flags: X - disabled
# SERVICE CALLED-ID DOMAIN ADDRESS SECRET
0 ppp,hotspot 10.0.0.3 ex
[admin@MikroTik] radius>
AAA for the respective services should be enabled too:
[admin@MikroTik] radius> /ppp aaa set use-radius=yes
[admin@MikroTik] radius> /ip hotspot profile set default use-radius=yes
To view some statistics for a client:
[admin@MikroTik] radius> monitor 0
pending: 0
requests: 10
accepts: 4
rejects: 1
resends: 15
timeouts: 5
bad-replies: 0
last-request-rtt: 0s
[admin@MikroTik] radius>
Connection Terminating from RADIUS
Home menu level: /radius incoming
Description
This facility supports unsolicited messages sent from RADIUS server. Unsolicited messages extend
RADIUS protocol commands, that allow to terminate a session which has already been connected
from RADIUS server. For this purpose DM (Disconnect-Messages) are used. Disconnect messages
Page 383 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
To Next Page
Loading...
General