I registered here after experiencing an issue following the upgrade to 7.15. I had recently managed to get a working dot1x setup using freeradius. I have several Mikrotik switches connecting to it using radsec. Today, I upgraded one of these switches, a CRS312-4C+8XG, to 7.15, which broke something in the communication. The TLS handshake works as normal, then the initial Access-Request is sent and received by freeradius. And no matter which response is sent in return, the switch is not apparently seeing it.
I have temporarily fixed this by downgrading to an unsecured connection. Since I didn't see anyone reporting a similar issue, I figured I should write about it, in case it affects other people.
Some relevant bits of my configuration:
Code: Select all
# 2024-06-02 20:37:52 by RouterOS 7.15
# software id = H9BC-RUMQ
#
# model = CRS312-4C+8XG
/radius
add address=192.168.0.1 certificate=radius_client protocol=radsec require-message-auth=no service=wireless,dot1x timeout=10s
/interface dot1x server
add auth-types=dot1x,mac-auth interface=dot1x radius-mac-format=XX-XX-XX-XX-XX-XX
/interface list
add name=dot1x
/interface list member
add interface=ether4 list=dot1x
add interface=ether5 list=dot1x
add interface=ether6 list=dot1x
add interface=ether7 list=dot1x
add interface=ether3 list=dot1x
add interface=ether2 list=dot1x
add interface=combo1 list=dot1x
add interface=combo2 list=dot1x
add interface=combo3 list=dot1x
add interface=combo4 list=dot1x
add interface=ether8 list=dot1x
Code: Select all
17:12:10 dot1x,packet s ether3 rx EAPOL-Start
17:12:10 dot1x,packet s ether3 tx EAPOL-Packet EAP-Request id:0 method:IDENTITY
17:12:10 radius,debug new request 82:09 code=Access-Request service=dot1x called-id=12-34-56-78-90-AB
17:12:10 radius,debug sending 82:09 to 192.168.0.1:2083
17:12:10 radius,debug,packet sending Access-Request with id 2 to 192.168.0.1:2083
17:12:10 radius,debug,packet Signature = *************
17:12:10 radius,debug,packet Framed-MTU = 1400
17:12:10 radius,debug,packet NAS-Port-Type = 15
17:12:10 radius,debug,packet Called-Station-Id = "12-34-56-78-90-AB"
17:12:10 radius,debug,packet Calling-Station-Id = "FE-DC-BA-09-87-65"
17:12:10 radius,debug,packet Service-Type = 2
17:12:10 radius,debug,packet EAP-Message = 0x0200000a017661726469
17:12:10 radius,debug,packet User-Name = "host"
17:12:10 radius,debug,packet Acct-Session-Id = "86300003"
17:12:10 radius,debug,packet NAS-Port-Id = "ether3"
17:12:10 radius,debug,packet Unknown-Attribute(type=102) = 0x00
17:12:10 radius,debug,packet NAS-Identifier = "nas"
17:12:10 radius,debug,packet NAS-IP-Address = 192.168.0.2
17:12:10 radius,debug,packet Message-Authenticator = ************
17:12:10 dot1x,packet s ether3 rx EAPOL-Packet EAP-Response id:0 method:IDENTITY
17:12:20 radius,debug timeout for 82:09
