Differences

This shows you the differences between two versions of the page.

--- user_guide:mikrotik:rb751 [2017/02/01 11:59] – [Prepare Mikrotik] admin
+++ user_guide:mikrotik:rb751 [2022/05/09 12:22] (current) – [Converting an Unknown client] admin
@@ Line 5: / Line 5: @@
 With this scenario we assume you have:
   * A recent installation of RADIUSdesk which includes Dynamic RADIUS Clients support.
-    * We will use our **Radiusdesk Hosted** server which has an IP Address of **178.32.59.137** in this document.
+    * We will use our **cloud.radiusdesk.com** demo server which has an IP Address of **164.160.89.129** in this document.
-    * Our **Radiusdesk Hosted** server has a site wide RADIUS shared secret of **RDhostedXYZ2525**.
+    * Our  **cloud.radiusdesk.com** demo server has a site wide RADIUS shared secret of **testing123**.
   * A new (or reset to defaults) Mikrotik RouterBOARD 751U which you will set up from scratch.
   * You want to run a Captive portal on the Mikrotik's WiFi interface.
@@ Line 15: / Line 15: @@
   * If you connect with a machine which has DHCP enabled; you will get a 192.168.88.x IP Address while the RouterBOARD 751U can be reached through 192.168.88.1.
   * The default username is **admin** with **no password**.
+  * Newer versions of ROS insist you set a password. If you never had password on the device specify the old password as blank text and specify the new value and confirm it to set the password on the device.
 ===== Our approach =====
 We will take the following configuration approach. This approach very common on the 751U.
-  * Ethernet port 1 (Marked PoE) will be used to connect the 751U to the Internet. (Typically a DSL router's Ethernet port)
+  * Ethernet port 1 (Marked PoE) will be used to connect the 751U to the Internet. (Typically a LTE router's Ethernet port)
   * Ethernet port 1 will be configured to be a **DCHP Client**.
   * Ethernet ports 2-5 will be used as a Ethernet switch which runs a DHCP Server and NAT traffic between Ethernet port 1 and Ethernet ports 2-5.
@@ Line 45: / Line 46: @@
 ===== Set the Mikrotik's identity =====
-  * We will use a fictional convention and assume that this Mikrotik is the first one deployed in the city of Pretoria, Gauteng province, South Africa.
+  * We will use a geographic naming convention and assume that this Mikrotik is the first one deployed in the city of Johannesburg, Gauteng province, South Africa.
-  * The systems identity will thus be **za-gp-pta-001**.
+  * The systems identity will thus be **za-gp-jhb-001**.
   * Connect to the Mikrotik's web interface and select **System** -> **Identity**.
-  * Specify the Identiry as **za-gp-pta-001** and click **Apply**
+  * Specify the Identity as **za-gp-jhb-001** and click **Apply**
 ===== Confirm Ethernet-1's status =====
   * Connect to the Mikrotik's web interface and select **IP** -> **DHCP Client**.
   * The **ether1-gateway** interface should be listed along with it's DHCP supplied IP Address.
-{{ :user_guide:mikrotik:ethernet1-dhcp.jpg |}}
+{{:user_guide:mikrotik:dhcp_client.png|}}
   * If this is not listed or the interface does not have an IP Address assigned to it; ensure that it is fixed before continuing.
@@ Line 59: / Line 60: @@
   * Connect to the Mikrotik's web interface and select **Bridge**.
   * Select the **Ports** sub-tab to see the list of ports and to which bridge they are assigned.
-  * By default **wlan1** and **ether2-master-local** will be members of the **bridge-local** bridge.
+  * By default **ether2-master**, **wlan1**, **ether3**, **ether4** and **ether5** will be members of the bridge named **bridge**.
-  * Remove **wlan1** from the list of ports (thus being a member of the **bridge-local** bridge.
+  * Remove **wlan1** from the list of ports.
-{{ :user_guide:mikrotik:bridge-local.jpg |}}
+{{:user_guide:mikrotik:bridge.png|}}
+  * To remove the interface click on the **-** button. The **D** button will simply disable it.
+{{:user_guide:mikrotik:bridge-no-wlan.png|}}
 ===== Add a RADIUS server =====
@@ Line 68: / Line 71: @@
   * Click the **Add new** button to add a RADIUS server.
     * Select the **Hotspot** service.
-    * Specify the IP Address of the RADIUSdesk server running FreeRADIUS.
+    * Specify the IP Address of the RADIUSdesk server running FreeRADIUS. (We use 164.160.89.129)
-    * Specify the shared secret.
+    * Specify the shared secret. (We use testing123)
-    * Since we have a VPS, we increase the timeout to 5000ms.
+    * Since our server is somewhere out on the Internet, we increase the timeout to 5000ms.
     * Leave **Accounting Backup** unchecked.
-{{:user_guide:mikrotik:mt-radius.jpg}}
+{{:user_guide:mikrotik:radius.png}}
   * Next we will set-up the hotspot
@@ Line 108: / Line 111: @@
 ==== Modify the created Server Profile ====
+<WRAP center round alert 100%>
+Be sure to do the following steps. Failing to do this will not allow the hotspot to use the RADIUS server.
+</WRAP>
   * We need to tel the **hsprof1** Server Profile to make sure it use RADIUS.
   * Connect to the Mikrotik's web interface and select **IP** -> **Hotspot**.
@@ Line 125: / Line 132: @@
 ===== Our situation =====
-  * With our setup in this document, we make use of a VPS server that runs RADIUSdesk somewhere in the cloud.
+  * The setup described here makes use of a VPS server that runs RADIUSdesk somewhere in the cloud. (We use cloud.radiusdesk.com)
-  * Since the Mikrotik NAS devices will be behind a NAT firewall we will make use of FreeRADIUS that is patched with the rlm_raw patch to allow Dynamic Clients.
+  * RADIUSdesk makes it super easy to add a RADIUS client to the FreeRADIUS server.
-  * Patching the FreeRADIUS server with the rlm_raw patch is in the installation instructions of FreeRADIUS.
+  * Simply take care of the following items when you are pointing a RADIUS client to the RADIUSdesk server:
-  * Alternatively you can simply run the VM images since this already incorporates this patch.
+    * Public IP Address of the RADIUSdesk server.
+    * Ensure the site wide shared secret is correct. (Check this with the person who configured the RADIUSdesk server)
+    * Ensure there is a unique identifier the RADIUS client can identify itself with to the server. (We did this by setting the **Identity** of the Mikrotik router.)
+  * After you took care of that simply reboot the Mikrotik router while it has an active Internet connection.
+  * It should then be reported under the **Unknown Clients** list of the **RADIUS -> RADIUS Clients** applet.
+  * The **Unknown Clients** tab is closed by default. To launch it, click the **Unknown Clients** button in the **RADIUS Clients**  applet. (Last button on the right of the toolbar)
+{{ :user_guide:mikrotik:unknown_clients.png?nolink |}}
+===== Converting An Unknown Client  =====
+  * After the Mikrotik appeared under the **Unknown clients** tab we can convert it to a known client.
+  * Select the unknown client you want to convert and click on the  **Attach** button.
+  * This will bring up a window where you can select the owner (if there are sub-providers belonging to the user who logged in)
+  * Next you can give it a name:
+{{ :user_guide:mikrotik:dynamic_clients_attach_basic.png?nolink |}}
+  * The **Monitor** and **Maps** sub-tabs you can leave as default.
+  * The **Enhancements** tab has some handy enhancements. You are also advised to leave the defaults.
+{{ :user_guide:mikrotik:dynamic_clients_attach_enhancements.png?nolink |}}
+  * Finally select some realms who you want to allow to use this RADIUS Client. If the list is empty, click on the **Make available to sub-providers** checkbox to give a list of realms belonging to sub-providers.
+{{ :user_guide:mikrotik:dynamic_clients_attach_realms.png?nolink |}}
+  * After you click the **Next** button this item will be moved to the list of known Dynamic Radius Clients. As you can see this item indicates that it never contacted the RADIUSdesk server.
+{{ :user_guide:mikrotik:radius_client.png |}}
+  * Simply reboot the Mikrotik to confirm that contact is now established:
+{{ :user_guide:mikrotik:radius_client_online.png |}}
+  * This brings us to the end of this section
-===== Our actions =====
-  * We will add a NAS device of **Connection type** -> **Dynamic client**.
-<WRAP center round tip 60%>
-If the **Connection type** -> **Dynamic client** is not available form the list, confirm it is activated in the //<webroot>/cake2/rd_cake/Config/RadusDesk.php// file.
-</WRAP>
-  * The value of NAS-Identifier (on the Mikrotik => System -> Identification) will be crucial when adding a new NAS device. This value will have to be defined in <wrap em>three places</wrap>, where each place should contain the value of the Mikrotik system identifier. (**za-gp-pta-001** in our case)
-    * The **Dynamic AVP detail** sub-tab in the add wizard will specify
-      * Attribute = NAS Identifier
-      * Value = za-gp-pta-001
-    * The **NAS** sub-tab in the add wizard will specify
-      * Name = za-gp-pta-001
-    * After the NAS device has been added; you need to edit the NAS device. Select the **NAS** -> **Optional info** sub tab and make sure the value of **NAS Identifier** is specified as **za-gp-pta-001**.
-  * Log into the RADIUSdesk webtop as either an Access Provider or the root user.
-  * Select **Menu** -> **NAS Devices** -> **NAS Devices** to open the **NAS Devices** applet.
-  * An optional start screen may ask you to specify the owner of this NAS device.
-  * Select **Next** to continue.
-  * Select the **Dynamic client** connection type.
-  * Select **Next** to continue.
-  * Specify the **Attribute** and **NAS-Identifier** and the **Value** as **za-gp-pta-001** in the **Dynamic AVP Detail** sub-tab
-  * Specify the **Name** as **za-gp-pta-001** and specify a secret in the **NAS** sub-tab.
-  * Specify the realms who will be able to use this NAS device in the **Realms** sub-tab.
-  * Select **Next** to complete the action.
-  * Once the NAS device has been added; edit it and select the **NAS** -> **Optional info** sub tab.
-    * Specify the **NAS-Identifier** as **za-gp-pta-001**.
-    * Also select the type as **Mikrotik**
-  * Save the changes.
-  * Wait at least ten minutes to allow **FreeRADIUS** to go thorough an auto restart cycle in order to activate the changes.
-  * Alternatively you can (only as root user) go **Menu** -> **Tools** -> **Logfile Viewer** and **Stop**; **Start** in the Logfile viewer applet's toolbar.
 --------------
@@ Line 174: / Line 177: @@
 ====== What next ======
 Although your system is up and running now you may want to do the following advanced configurations
-  * Incorporate a heartbeat system to sent heartbeats from the Mikrotik to the RADIUSdesk server for monitor purposes.
   * Introduce central managed Dynamic Login Pages for Mikrotik.
 The Advanced setup page will cover these topics.

RADIUSdesk

Page Tools

Site Tools

User Tools

Differences