How to Authenticate with Radius Server on Mikrotik Router
We will use the Mikrotik device RB941-2nD model that we will use in this setup. We will proceed by installing Radius Server on Mikrotik RouterOS 6.46.2 version and Windows server 2008.
In the first step, after installing the radius server on Windows server 2008, we will configure it so that the users in the technical section in the environment can access it. Now let’s click on Add Roles under Rollers on the Windows server.
A setup wizard will open and click next in the first step. Now we will see the wizard install the program and we will click the next button as the first step.
In the server roles step, after selecting Network Policy and Access Services, we click Next.
We move on to the next window in the Introduction to Network Policy and Access Services section. We don’t need to make any settings here. We click directly.
The next step is to get more detailed information about the Network Policy Server the window will open. Here, after performing the necessary checks, the last you need to click next is Role Services.
The loading window is now available here.
Since the installation has been completed successfully here, we can now close the window.
From Windows Server, open Network Policy Server from the Start menu.
Expand Radius Client and Servers and right-click Radius clients and then select New Radius Client.
In the newly opened window, enter the device name you want, the IP address of the device we want to access, and its secret information.
In this tab, open policies and right-click on Network Policies, then click New.
First, give the policy a name and click the next button.
In the window that suggests terms, click Add, select the Windows Group option, and then add the user who can access the group devices.
According to this rule, it means that only the user in the Tech group can access our devices.
In the next step, we check the Access permission option and click Next.
In the Authentication Methods step, we will follow the EAP types, leave it blank and click Next.
In the next two steps, under Configure Restrictions and settings. we will leave them as default. From here go to the next one and click finish in the summary step.
We will continue our next settings in Mikrotik Router. Go to Mikrotik System> Users and click the AAA button
Check the Use RADIUS option and set the Default Group to full.
In the next step, we click RADIUS from the winbox menu and click the plus sign to add a new radius server.
Check the login option in the new window, enter the radius server address, and enter the same password. We leave everything else at default.
After that, you can log into your devices using your user credentials.
It is important to know your login credentials as a backup option when Radius is off.
Unlike Cisco, Mikrotik doesn’t have this option, but some workarounds can be done.
Since there is no option to disable the administrator user in RouterOS, if it is the only user with full permissions, we will create an additional user with full permissions and set some hard passwords on the system default user.
Next, we will create a script and set it to run every 10 seconds for example. The script pings the radius server and if the ping is successful, the additional username will be enabled if it is disabled.
Create additional users first
We will create some difficult passwords in the system default user “admin”. Now we are creating the second scenario, the script.
:local radius 10.200.0.20;
:local count 3;
:local user enadmin;
if ([ /ping $radius count=$count ]=0 ) do= {user enable $user } else={user disable $user}
And we make a schedule to be run every 10 seconds.
That is all.
I hope it has been a useful article.
