Freeradius , AD and Mikrotik Integration
hello .i really need help .i have a Microsoft Active Directory in my network as a user database , and i installed freeradius as my radius server for wireless users and i have mikrotik router which i implement Nat ,Qos and Queue for bandwidth management .i integrate my freeradius with Active Directory so wireless user can authenticate via Active Directory. but my problem is how can i send user attributes to mikrotik for limiting RX and Tx bandwidth while users are not in Freeradius user file . how can i tell mikrotik to create a queue for that user which authenticates via Active Directory. thank you
On Sep 18, 2021, at 3:23 AM, ReZa Esfahani <esfahanii.reza@gmail.com> wrote:
.i really need help .i have a Microsoft Active Directory in my network as a user database , and i installed freeradius as my radius server for wireless users and i have mikrotik router which i implement Nat ,Qos and Queue for bandwidth management .i integrate my freeradius with Active Directory so wireless user can authenticate via Active Directory. but my problem is how can i send user attributes to mikrotik for limiting RX and Tx bandwidth while users are not in Freeradius user file . how can i tell mikrotik to create a queue for that user which authenticates via Active Directory.
You don't need to put everything in AD *or* everything in the "users" file. You can put user names and passwords in AD, and then put mikrotik rules into the "users" file. Or, put users and passwords into AD, and then the mikrotik rules into "unlang". It's up to you. Please explain WHAT you want to return, and WHEN you want to return it to the NAS. Are the rules the same for all users? Are they different for different user groups? Alan DeKok.
On 18.09.21 09:23, ReZa Esfahani wrote:
hello .i really need help .i have a Microsoft Active Directory in my network as a user database , and i installed freeradius as my radius server for wireless users and i have mikrotik router which i implement Nat ,Qos and Queue for bandwidth management .i integrate my freeradius with Active Directory so wireless user can authenticate via Active Directory. but my problem is how can i send user attributes to mikrotik for limiting RX and Tx bandwidth while users are not in Freeradius user file .
You have to find the according attributes in the microtik dictrionary and set these attributes in FR while it is processing the requests. This might be done in a users file or in unlang during athorization.
how can i tell mikrotik to create a queue for that user which authenticates via Active Directory.
Please see the microtik users or admin manual for the answer. Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein
Please explain WHAT you want to return, and WHEN you want to return it to the NAS. Are the rules the same for all users? Are they different for different user groups?
yes .the rules are different for different user groups. for example i have 15 different group in AD which i want to limit their tx and rx bandwidth based on the group they belong and if possible i want to limit their multi login session and even set a traffic quota for each user group. my questions is how AD retrieve Group information from AD and where should i mention AD group names in which file ? thank you On Sat, Sep 18, 2021 at 7:22 PM Michael Schwartzkopff <ms@sys4.de> wrote:
On 18.09.21 09:23, ReZa Esfahani wrote:
hello .i really need help .i have a Microsoft Active Directory in my network as a user database , and i installed freeradius as my radius server for wireless users and i have mikrotik router which i implement Nat ,Qos and Queue for bandwidth management .i integrate my freeradius with Active Directory so wireless user can authenticate via Active Directory. but my problem is how can i send user attributes to mikrotik for limiting RX and Tx bandwidth while users are not in Freeradius user file .
You have to find the according attributes in the microtik dictrionary and set these attributes in FR while it is processing the requests. This might be done in a users file or in unlang during athorization.
how can i tell mikrotik to create a queue for that user which authenticates via Active Directory.
Please see the microtik users or admin manual for the answer.
Mit freundlichen Grüßen,
--
[*] sys4 AG
https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 19, 2021, at 3:14 AM, ReZa Esfahani <esfahanii.reza@gmail.com> wrote:
yes .the rules are different for different user groups. for example i have 15 different group in AD which i want to limit their tx and rx bandwidth based on the group they belong
That's possible. Just check for LDAP groups, and then set the reply attributes.
and if possible i want to limit their multi login session and even set a traffic quota for each user group. my questions is how AD retrieve Group information from AD and where should i mention AD group names in which file ?
All of this is documented... See this page, which points to a "getting started" guide, among other things. https://freeradius.org/documentation/ See also the Wiki: http://wiki.freeradius.org You can search for terms such as "LDAP" or "group" to get specific documentation. You can also read the configuration files. Each file is *extensively* documented in the comments. Alan DeKok.
participants (3)
-
Alan DeKok -
Michael Schwartzkopff -
ReZa Esfahani