MikroTik

Posted: **Thu Oct 17, 2013 6:36 am**

Hello. I have installed User Manager on a centrally located RouterBoard and I'm using it for RADIUS authentication for some APs (see the attached screen shot which is an L3 topology - User Manager is on device "sdpb-rb2011-usa-rm-L3"). The APs are reachable from the User Manager RB via multiple interfaces and in some cases the same AP is reachable via multiple interfaces. The issue is that the reply packets from User Manager have the source address of the outgoing interface. In my APs, if I put the IP that is on the outgoing interface of the User Manager's RB that the AP is reachable through as the RADIUS server, everything works find, but if I put the loopback (/32 on bridge I/F) IP as the RADIUS server, the APs ignore the responses because they came from the outgoing I/F IP and not the bridge/loopback IP. This creates a problem because I have to choose a specific I/F IP on the RB as the RADIUS server, but if that path is down and it uses an alternate path, the RADIUS replies will be ignored by the AP.
What I'd like to do is SRC-NAT the replies from User Manager RB so that the the replies are translated from whatever interface IP they're using to the bridge/loopback IP, but I can't seem to get the NAT to work.
I've tried many things (simple SRC-NAT on specific packets leaving a specific interface, connection/packet marking and SRC-NAT on marked packets), but no avail. The connection/packet marking is working, but the NAT doesn't seem to be.
Can this be done? Any better solutions? I may have to use a separate RB running just User Manager so that it only has a single path to all APs...

Posted: **Thu Oct 17, 2013 1:13 pm**

You can maybe create some L2TP tunnels from the devices to the central user manager machine; you will have a "central unique IP"

on user manager machine:
/ppp profile
add change-tcp-mss=default local-address=10.94.254.254 name=profil_l2tp_aps \
    only-one=default use-compression=yes use-encryption=default use-mpls=\
    default use-vj-compression=yes

/ppp secret add name=device1 password=device1 profile=profil_l2tp_aps remote-address=10.94.1.1 service=l2tp
/ppp secret add name=device2 password=device2 profile=profil_l2tp_aps remote-address=10.94.1.2 service=l2tp
/ppp secret add name=device3 password=device3 profile=profil_l2tp_aps remote-address=10.94.1.3 service=l2tp
/ppp secret add name=device4 password=device4 profile=profil_l2tp_aps remote-address=10.94.1.4 service=l2tp
etc..

On AP1:
/interface l2tp-client
add connect-to=USER_MANAGER_IP disabled=no name=l2tp-Radius password=device1 user=device1

Then you will be able to access your radius server on 10.94.254.254 from every AP

MikroTik

NAT Help

NAT Help

Re: NAT Help