HotSpot dengan radius server di mikrotik dengan authentifikasi MAC

Dari judulnya mungkin isi artikel berikut bukanlah barang yang baru karena sudah banyak tapi bagi yang belum pernah baca semoga ini bermaanfaat.

Gambar topologi yang akan kita bangun adalah seperti berikut :

[LAN Wireless]----[AP (access Point) Brigde mode]-----[mikrotik (router dan radius server)]-------[WAN]

Usahakan kita menggunakan access point yang dapat digunakan dengan mode AP bridge agar ip address dan MAC dari client dapat dibaca oleh mikrotik router, hal ini tidak dapat dilakukan jika AP dalam mode router. Karena kalau AP dalam mode router maka biasanya dia akan melakukan NAT terhadap network di LAN sehingga oleh mikrotik router hanya akan dikenali 1 IP address dan mac addres yaitu ip address dan mac address AP pada sisi WAN.

misal kita asumsikan network LAN adalah 192.168.0.0/24 dengan ip address mikrotik pada sisi LAN adalah 192.168.0.254 dan hotspot dah ter-setup dengan profile "hsprof1".

HotSpot configuration

/ radius add service=hotspot address=127.0.0.1 secret=123456

We add radius client to consult User Manager server for appropriate service. 'address=127.0.0.1' points RADIUS client to use local router as RADIUS server, 'secret' is shared secret to exchange information between RADIUS server and client.

/ ip hotspot profile set hsprof1 use-radius=yes

To use RADIUS for HotSpot AAA.
[edit] User Manager configuration

* First we need to create subscriber.

/ tool user-manager customer add login="MikroTik" password="qwerty" permissions=owner

* Then add router information to the User Manager configuration,

/ tool user-manager router add subscriber=MikroTik ip-address=127.0.0.1 shared-secret=123456

'ip-address' is the address of the RADIUS client router.

Note, 'shared-secret' should match on User Manager and RADIUS client.

User Manager/QA/How to make MAC authentication

Let's consider configuration scenario, when we need HotSpot users MAC authentication trough User Manager. HotSpot MAC authentication method allows to authenticate clients as soon as they appear in the hosts list, using client's MAC address as username. We assume that User Manager already provides AAA for HotSpot router.

Configuration required on HotSpot server router:

/ip hotspot profile set hsprof1 login-by=mac use-radius=yes

Command enables MAC authentication for the particular profile and forces to use RADIUS for AAA. Note, first local HotSpot database is consulted, then User Manager database.

User Manager configuration (for each mac-address):

/too user-manager user add username=XX:XX:XX:XX:XX:XX subscriber=MikroTik

We add user information belonging to the particular subscriber, it allows HotSpot user with MAC-address XX:XX:XX:XX:XX:XX to authenticate in HotSpot without prompting login/password.