which nas_type for Mikrotik WiFi AP NAS ?

[Franta Hanzlík]

Hi Hans and Alan, thanks for help!

On Thu, 2 Oct 2025 11:59:14 +0000
Hans Peter Randløv via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:

> If you use VSA the , the NAS type is very important, as no 2 vendors
> translate/use a COA response in the same way
> 
> Hans Peter Randløv

If I manage to set it up, I would like to use dynamic VLAN based on 
the logged in client (or its group).
But it probably won't work for some sophisticated COA, IMO it just need 
to send to Mikrotik the 'Mikrotik-Wireless-VLANID' attribute with 
the VLAN number in response to the authentication request.
I have found the attribute "manually" and I want to "manually" set it
 - I don't know if it can be called COA...

I'll try to find some example/instructions on the internet on how to 
set this up. And if someone could send me a link, I'd be very grateful, 
that would be great.


> From: Freeradius-Users <freeradius-users-bounces+hans.randlov=lego.com at lists.freeradius.org> on behalf of Alan DeKok via Freeradius-Users <freeradius-users at lists.freeradius.org>
> Date: Thursday, 2 October 2025 at 13.48
> To: FreeRadius users mailing list <freeradius-users at lists.freeradius.org>
> Cc: Alan DeKok <alan.dekok at inkbridge.io>
> Subject: Re: which nas_type for Mikrotik WiFi AP NAS ?
> CAUTION: This email originated from outside of your organization.
> 
> On Oct 2, 2025, at 6:13 AM, Franta Hanzlík via Freeradius-Users <freeradius-users at lists.freeradius.org> wrote:
> > So far unsuccessfully, I probably have more errors in the configuration
> > that I'm trying to fix.  
> 
>   It's best to make one small change, test it, and then commit it to a
> local git repository.  If you're making 15 changes at the same time, then
> it will be almost impossible to debug them all.

Yeah, I'm strive for it, but it's quite a complex thing and the path 
is not well-trodden on my side... ;)

> > One specific ambiguity: which NAS type should be listed in the NAS
> > specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"?  
> 
>   Are you using the checkrad.pl script?  If not, then the NAS type doesn't matter.

I'm not using it and quick grep over FreeRadius 3.2.8 (which I'm using) 
sources show that "mikrotik[_snmp]" is used only in checkrad - but checkrad 
man page says 
"checkrad is used by the radius server to check ...".
Thus it seems as Freeradius uses the Mikrotik nas_type indirectly, when is
calling the checkrad.

> > The original clients.conf template in the paragraph
> >
> > "The nas_type tells 'checkrad.pl' which NAS-specific method to use to
> > query the NAS for simultaneous use. Permitted NAS types are"
> >
> > lists 13 types incl. "other", "mikrotik" is not among them.
> > But the checkrad man page lists 25 types, including "mikrotik_snmp" and
> > "mikrotik".
> >
> > From this it seems to me that nas_type should not be "other", but
> > "mikrotik" or "mikrotik_snmp".
> > Can anyone advise which one and what is the difference between them?  
> 
>   They use different methods to check if the user is still online.  See
> the source in checkrad.pl

It seems as one is using SNMP and other Telnet protocol. And both have 
some limitations due to the characteristics of the NAS.
Anyway, from all this it seems... I don't know if, when and how much 
FreeRadius needs to call checkrad, but if it does, then in clients.conf 
one of the Mikrotik types should be specified and not "other".

>   Alan DeKok.
> -
-- 
Thanks, Franta Hanzlik