MikroTik

rdelacruz

When using hotspot+radius and PPPoE+radius, the Mikrotik returns Class attribute in Accounting-Request, but when using DHCP+radius, it does not.

What's the alternative for it? I want to use it to filter accounting requests from suspended or unauthorized devices.

rdelacruz

Same question here. Were you able to resolve this issue?

rdelacruz

Hi Guys,

If this RADIUS attribute creates the following simple queue. Is it possible to add or specify the value for the parent queue?

Mikrotik-Rate-Limit := "10M/5M 15M/7M"

rdelacruz

The accounting only works during interim updates; not during accounting start and stop. It also requires a simple queue, as data will be coming from simple queue statistics.

rdelacruz

I am having the same issue? Have you resolved this problem?

rdelacruz

Interim update accounting request contains the following attribute
http://prntscr.com/p4rbxx

However, the stop doesn't provide the accounting data. Any thoughts or suggestions? Is this a bug?
http://prntscr.com/p4rc7q

rdelacruz

You can also try using Carrier-Grade NAT (100.64.0.0/10) on your network. I believe there's another DHCP server on the Dlink device causing the routing and NAT to not work because the same addresses occur on both inside and outside network interfaces.

rdelacruz

rdelacruz - Please note that accounting will work only for those users which has a queue. Data for accounting is taken from queue statistics Yes, I'm aware of it. Are you referring to this queue? http://i66.tinypic.com/14x16b8.png If yes, can you please confirm that this added feature will work if ...

rdelacruz

rdelacruz - Please note that accounting will work only for those users which has a queue. Data for accounting is taken from queue statistics Yes, I'm aware of it. Are you referring to this queue? http://i66.tinypic.com/14x16b8.png If yes, can you please confirm that this added feature will work if ...

rdelacruz

rdelacruz - Please note that accounting will work only for those users which has a queue. Data for accounting is taken from queue statistics Yes, I'm aware of it. Are you referring to this queue? http://i66.tinypic.com/14x16b8.png If yes, can you please confirm that this added feature will work if ...

rdelacruz

We ask, We hope, but MiktoTik... is silent...

+1

rdelacruz

rdelacruz - Please note that accounting will work only for those users which has a queue. Data for accounting is taken from queue statistics Yes, I'm aware of it. Are you referring to this queue? http://i66.tinypic.com/14x16b8.png If yes, can you please confirm that this added feature will work if ...

rdelacruz

*) dhcpv4-server - added RADIUS accounting support with queue based statistics;

I tried to test it, but it's not working yet. Is it an added feature that works if we use RADIUS for accounting and lease?

Please confirm this. Thanks

rdelacruz

*) dhcpv4-server - added RADIUS accounting support with queue based statistics;

I tried to test it, but it's not working yet. Is it an added feature that works if we use RADIUS for accounting and lease?

rdelacruz

What's new in 6.45beta42 (2019-May-08 12:44): MAJOR CHANGES IN v6.45: ---------------------- !) dot1x - added support for IEEE 802.1X Port-Based Network Access Control (CLI only); !) ike2 - added support for EAP authentication methods (eap-tls, eap-ttls, eap-peap) as initiator (CLI only); ----------...

rdelacruz

Yes, I believe there are many people interested in this topic. Any response would be pleased. "We plan to implement" or "We don't plan to implement" would be sufficient .

+1

rdelacruz

We are using DHCP-RADIUS authentication, unfortunately, accounting doesn't provide all necessary attributes to the RADIUS server.

How can we send these accounting data to the RADIUS every time the device disconnects from the network.

rdelacruz

Some Facts about HTTPS redirection Hotspot does not redirect SSL 443 sites , unless you enable HTTPS redirection and use a signed or self-signed certificate. By using self signed certificate, SSL redirect warnings will still be present. As part of SSL protocol, cause hotspot captive portal will be ...

rdelacruz

How do i set the router to bypass a WiFi repeater from hotspot login page. >for clarity.. i am using xiaomi mi WiFi repeater 2 which doesn't have a browser interface... Is the device MAC address available on the "hosts" tab of the hotspot server? If yes, you can create a binding rule for ...

rdelacruz

You can use IP Bindings. It allows you to block all unknown addresses, and allow only the hotspot network to authenticate to your Hotspot server.

rdelacruz

It would be best if Mikrotik can send these accounting data to the RADIUS every time the device disconnected or through interim updates.

rdelacruz

It would be best if Mikrotik can send these accounting data to the RADIUS when using DHCP+RADIUS authentication.

rdelacruz

How did you get the accounting data from simple queue with api?

rdelacruz

What's the best way to get the accounting data ( Acct-Input-Octets and Acct-Output-Octets) when using DHCP auth without relying on Mikrotik?

rdelacruz

What's new with the https-redirect? I haven't found any changes on the interface?

rdelacruz

Update: The answer is no, and I opted using the Called-Station-Id.

rdelacruz

Yes, you should update the login.html file, this is how it should look likes.

rdelacruz

Hi, I have several DHCP servers; I have a separate DHCP server for management and customer's devices. Management devices are on VLAN interface. All the devices are authenticating on the RADIUS servers. Now, I want to assign an IP address based on the interface where the equipment is connected. I am ...

rdelacruz

Another solution is a script to kick any host that is not authorized that runs every 10-30 seconds. Maybe combine this with a delayed redirect of equal time. This can be done with login time-out. However, 10-30 seconds would cause "Already Authorizing, retry later error" if the RADIUS is ...

rdelacruz

Maybe you can use framed-pool to attribute. Suspended subscriber will still be authenticated, but will be using a different subnet. Create some firewall rules to redirect them to a specific page where they have the option to reactivate their device after paying their bills. This can be done by using...

rdelacruz

Framed-pool is available in freeRadius. It's the attribute which contains the name of an assigned address pool that should be used to assign an address for the user.

https://freeradius.org/rfc/rfc2869.html#Framed-Pool

I am not so familiar with DaloRADIUS.

rdelacruz

Hey Why not just "Your MAC is not yet registered. Please log in to save the new MAC address." The registration is on another page, so the info will be lost anyway and needs to be input by user... It would be best if the MAC address is available on the page, as some users are not techy eno...

rdelacruz

Hello, I wanted to implement DHCP-Radius, and redirect unknown devices to a website through a firewall rule and web proxy. However, as opposed to Hotspot, I cannot get the user's MAC address or IP address programmatically into the redirection URL of the Web proxy. I know that RADIUS can get the mac ...

rdelacruz

Make sure that you have "dhcp_wifi-guests" address pool on your Mikrotik router.

rdelacruz

The login timeout is the best solution for it; however, 3 seconds is too short. Try setting it into 5 minutes.

rdelacruz

You can set the RADIUS to send a Framed-Pool attribute to any unknown devices. Make sure to have such address pool on the Mikrotik router, so the DHCP will use that address pool for unregistered devices.

rdelacruz

Unfortunately, the address pool on IP/HotSpot/Servers is already set to none.

With this issue, what's the best way to assign static IP for Hotspot clients?

rdelacruz

I don't think that it has something to do with the address pool. I am trying to figure this out with only one client.
And please also note that on the "Leases" tab of DHCP server, the active IP address is the same with the Address on the Hotspot server.

rdelacruz

I am having the same issue. Any updates about it?

Search found 39 matches

Class attribute in Accounting-Request

Re: Dynamic Simple Queue Parent Assignment

Parent Queue through RADIUS

Re: DHCP accounting and RADIUS packets

Re: Format of Option 82

Re: DHCP-RADIUS Accounting packets

Re: Problem with DHCP

Re: DHCP accounting and RADIUS packets

Re: DHCP accounting and RADIUS packets

Re: v6.45beta [testing] is released!

Re: v6.45beta [testing] is released!

Re: v6.45beta [testing] is released!

Re: v6.45beta [testing] is released!

Re: v6.45beta [testing] is released!

Re: DHCP accounting and RADIUS packets

Re: DHCP accounting and RADIUS packets

DHCP-RADIUS Accounting packets

Re: HOTSPOT login https error

Re: Hotspot Bypass [SOLVED]

Re: IP lease not the same on the Hotspot

Re: DHCP accounting and RADIUS packets

Re: v6.45beta [testing] is released!

Re: Get bytes (stats) from simple queue with api; dhcp + freeradius

Re: DHCP accounting and RADIUS packets

hotspot - added "https-redirect" under server profiles

Re: Mikrotik Access-Request for VLAN [SOLVED]

Re: Create a Hotspot server profile

Mikrotik Access-Request for VLAN [SOLVED]

Re: Hotspot with mac-login, external captive portal and RADIUS auth - How to force a second auth request

Re: Hotspot with mac-login, external captive portal and RADIUS auth - How to force a second auth request

Re: MAC Authentication + DHCP + Radius

Re: Adding variable to the Web proxy redirection URL

Adding variable to the Web proxy redirection URL

Re: RADIUS - Framed-Pool

Re: Hotspot with mac-login, external captive portal and RADIUS auth - How to force a second auth request

Re: MAC Authentication + DHCP + Radius

Re: IP lease not the same on the Hotspot

Re: IP lease not the same on the Hotspot

Re: IP lease not the same on the Hotspot