MikroTik
Please note that the below configuration was tested with RouterOS 6.47.4 and 6.49.11
Prepare Certificates
To establish a valid RadSec connection, your MikroTik Access Points must trust the RADIUS Server Certificate and your RADIUS server must trust your RadSec client certificate. To establish the server trust , follow these steps:
Download the root certificate of the CA that has issued your RADIUS server certificate as described here.
Log on to your MikroTik device, then upload the certificate from above to the MikroTik device using the Files menu on the left.
Once uploaded, switch to your Terminal tab on the top right and execute the following command to import this certificate to MikroTik's certificate store:
Ensure to monitor the expiry of your RadSec client certificate and renew it in due time to prevent service interruptions.
Example:
In the above example, the first line creates a root CA called myCa. The second line generates a client certificate for the MikroTik device, and the third line uses myCa (CA) to sign the mikrotik-client certificate generated in step 2. If all went well, you would end up with three certificates as shown below. Please ensure your MikroTik device trusts the relevant certificates (T flag in the green section). If that is not the case yet, set the flag using below command:
Export the root CA certificate (
myCa
) that has issued your RadSec client certificate above:
Download it from the Files menu and then upload the file to your RADIUSaaS instance as described here and select RadSec under Use for
MikroTik Configuration
Switch back to your WebFig, add a new RADIUS profile and enter the following information:
Use the IP address from your Server Settings page.
Protocol: radsec
Secret: radsec
Authentication Port: 2083
Accounting Port: 2083
Certificate: mikrotik-client (generated in step 4)
Go to Wireless add a new Security Profile and enter the following information:
Name: on your behalf
Mode: dynamic keys
EAP Methods: passthrough
TLS Mode: verify certificate
TLS Certificate: the imported RADIUS Server certificate
Switch to your WiFi Interfaces and apply your Security Profile to the interface.
Last updated