which nas_type for Mikrotik WiFi AP NAS ?
Hello, I'm trying FreeRadius with Mikrotik WiFi AP and EAP-PEAP/MSCHAPv2 authentication, so far with a user in mods-config/files/authorize and a cleartext password. So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix. One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"? The original clients.conf template in the paragraph "The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are" lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik". From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them? -- Thanks in advance, Franta Hanzlik
On Oct 2, 2025, at 6:13 AM, Franta Hanzlík via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix.
It's best to make one small change, test it, and then commit it to a local git repository. If you're making 15 changes at the same time, then it will be almost impossible to debug them all.
One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"?
Are you using the checkrad.pl script? If not, then the NAS type doesn't matter.
The original clients.conf template in the paragraph
"The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are"
lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik".
From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them?
They use different methods to check if the user is still online. See the source in checkrad.pl Alan DeKok.
If you use VSA the , the NAS type is very important, as no 2 vendors translate/use a COA response in the same way Hans Peter Randløv Senior Engineer Sites & Remote Connectivity Mobile +4520121370 E-mail hans.randlov@LEGO.com<mailto:hans.randlov@LEGO.com> From: Freeradius-Users <freeradius-users-bounces+hans.randlov=lego.com@lists.freeradius.org> on behalf of Alan DeKok via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 2 October 2025 at 13.48 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Alan DeKok <alan.dekok@inkbridge.io> Subject: Re: which nas_type for Mikrotik WiFi AP NAS ? CAUTION: This email originated from outside of your organization. On Oct 2, 2025, at 6:13 AM, Franta Hanzlík via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix.
It's best to make one small change, test it, and then commit it to a local git repository. If you're making 15 changes at the same time, then it will be almost impossible to debug them all.
One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"?
Are you using the checkrad.pl script? If not, then the NAS type doesn't matter.
The original clients.conf template in the paragraph
"The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are"
lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik".
From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them?
They use different methods to check if the user is still online. See the source in checkrad.pl Alan DeKok. - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C02%7Chans.randlov%40lego.com%7Cc1d6907a7441471b1dec08de01a99153%7C1d0635156cad41959486ea65df456faa%7C0%7C0%7C638950024960035697%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=8neup6YrrdYV0HJK%2F84yq8KpJA0s2c%2F3OgP7mFBANq8%3D&reserved=0<http://www.freeradius.org/list/users.html>
Hi Hans and Alan, thanks for help! On Thu, 2 Oct 2025 11:59:14 +0000 Hans Peter Randløv via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
If you use VSA the , the NAS type is very important, as no 2 vendors translate/use a COA response in the same way
Hans Peter Randløv
If I manage to set it up, I would like to use dynamic VLAN based on the logged in client (or its group). But it probably won't work for some sophisticated COA, IMO it just need to send to Mikrotik the 'Mikrotik-Wireless-VLANID' attribute with the VLAN number in response to the authentication request. I have found the attribute "manually" and I want to "manually" set it - I don't know if it can be called COA... I'll try to find some example/instructions on the internet on how to set this up. And if someone could send me a link, I'd be very grateful, that would be great.
From: Freeradius-Users <freeradius-users-bounces+hans.randlov=lego.com@lists.freeradius.org> on behalf of Alan DeKok via Freeradius-Users <freeradius-users@lists.freeradius.org> Date: Thursday, 2 October 2025 at 13.48 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: Alan DeKok <alan.dekok@inkbridge.io> Subject: Re: which nas_type for Mikrotik WiFi AP NAS ? CAUTION: This email originated from outside of your organization.
On Oct 2, 2025, at 6:13 AM, Franta Hanzlík via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix.
It's best to make one small change, test it, and then commit it to a local git repository. If you're making 15 changes at the same time, then it will be almost impossible to debug them all.
Yeah, I'm strive for it, but it's quite a complex thing and the path is not well-trodden on my side... ;)
One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"?
Are you using the checkrad.pl script? If not, then the NAS type doesn't matter.
I'm not using it and quick grep over FreeRadius 3.2.8 (which I'm using) sources show that "mikrotik[_snmp]" is used only in checkrad - but checkrad man page says "checkrad is used by the radius server to check ...". Thus it seems as Freeradius uses the Mikrotik nas_type indirectly, when is calling the checkrad.
The original clients.conf template in the paragraph
"The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are"
lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik".
From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them?
They use different methods to check if the user is still online. See the source in checkrad.pl
It seems as one is using SNMP and other Telnet protocol. And both have some limitations due to the characteristics of the NAS. Anyway, from all this it seems... I don't know if, when and how much FreeRadius needs to call checkrad, but if it does, then in clients.conf one of the Mikrotik types should be specified and not "other".
Alan DeKok. - -- Thanks, Franta Hanzlik
On Oct 2, 2025, at 9:36 AM, Franta Hanzlík via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
If I manage to set it up, I would like to use dynamic VLAN based on the logged in client (or its group).
That should work. And doesn't need checkrad.pl
But it probably won't work for some sophisticated COA, IMO it just need to send to Mikrotik the 'Mikrotik-Wireless-VLANID' attribute with the VLAN number in response to the authentication request. I have found the attribute "manually" and I want to "manually" set it - I don't know if it can be called COA...
That's not CoA. It's just adding an attribute to the reply. There's lots of documentation and examples for adding attributes to the reply.
I'll try to find some example/instructions on the internet on how to set this up. And if someone could send me a link, I'd be very grateful, that would be great.
You don't need the Internet. The server comes with many examples. See sites-available/default. There are lots of example of adding attributes to the reply. If you want full online documentation, see https://www.freeradius.org/documentation/freeradius-server/3.2.8/
I'm not using it and quick grep over FreeRadius 3.2.8 (which I'm using) sources show that "mikrotik[_snmp]" is used only in checkrad - but checkrad man page says "checkrad is used by the radius server to check ...". Thus it seems as Freeradius uses the Mikrotik nas_type indirectly, when is calling the checkrad.
Yes, it only uses checkrad, but only when you're using Simultaneous-Use. If that doesn't mean anything to you, then you can ignore checkrad and nas_type Alan DeKok.
On Thu, 2 Oct 2025 10:56:17 -0400 Alan DeKok <alan.dekok@inkbridge.io> wrote:
On Oct 2, 2025, at 9:36 AM, Franta Hanzlík via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
If I manage to set it up, I would like to use dynamic VLAN based on the logged in client (or its group).
That should work. And doesn't need checkrad.pl
But it probably won't work for some sophisticated COA, IMO it just need to send to Mikrotik the 'Mikrotik-Wireless-VLANID' attribute with the VLAN number in response to the authentication request. I have found the attribute "manually" and I want to "manually" set it - I don't know if it can be called COA...
That's not CoA. It's just adding an attribute to the reply. There's lots of documentation and examples for adding attributes to the reply.
I'll try to find some example/instructions on the internet on how to set this up. And if someone could send me a link, I'd be very grateful, that would be great.
You don't need the Internet. The server comes with many examples. See sites-available/default. There are lots of example of adding attributes to the reply.
If you want full online documentation, see https://www.freeradius.org/documentation/freeradius-server/3.2.8/
I'm not using it and quick grep over FreeRadius 3.2.8 (which I'm using) sources show that "mikrotik[_snmp]" is used only in checkrad - but checkrad man page says "checkrad is used by the radius server to check ...". Thus it seems as Freeradius uses the Mikrotik nas_type indirectly, when is calling the checkrad.
Yes, it only uses checkrad, but only when you're using Simultaneous-Use. If that doesn't mean anything to you, then you can ignore checkrad and nas_type
Alan DeKok.
Alan, thanks for the valuable advice. In my case, although I will be connected multiple times (e.g. with a tablet and a laptop at the same time), limiting the number of connections per user makes no sense - the WiFi network is small and the number of users is too. So I will not use the "Simultaneous-Use" parameter at all, let it be the number of simultaneous user connections unlimited. In fact, until now I had no idea about the existence of the "Simultaneous-Use" parameter, it does not appear in the installed configuration files. ;) (if I needed to limit the number of simultaneous connections, it would probably be more appropriate to limit the number of user connections per individual VLANs - which is probably a completely different level, with a different method of limitation) -- František Hanzlík Luční 502 Linux/Unix/LAN/Internet Tel: +420-372-222302 33209 Štěnovice e-mail:franta@hanzlici.cz Fax: +420-372-222302 Czech Republic http://hanzlici.cz/ GSM: +420-604-117319 Tento mail neobsahuje viry, byl odeslán z operačního systému Linux
participants (3)
-
Alan DeKok -
Franta Hanzlík -
Hans Peter Randløv