Mikrotik WIFI - Revision history

Administrator at 09:00, 31 July 2025

2025-07-31T09:00:30Z

← Older revision		Revision as of 09:00, 31 July 2025
Line 97:		Line 97:
	The Base32 code will then be used in Google Authenticator to generate a token.</br>		The Base32 code will then be used in Google Authenticator to generate a token.</br>
	Test login by accessing the console</br>		Test login by accessing the console</br>
			[[Category:2FA]][[Category:Mikrotik]][[Category:WIFI]]

Administrator: /* Basic Basic Configuration */

2025-07-23T13:15:39Z

Basic Basic Configuration

← Older revision		Revision as of 13:15, 23 July 2025
Line 13:		Line 13:

	<strike>'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</strike></br>		<strike>'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</strike></br>
	There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>		<strike>There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>
	This must also be done on the remote CAPs.</br>		This must also be done on the remote CAPs.</strike></br>
	'''WARNING3''': for some reason, bridges are created with the same MAC which causes conflicts between APs. Disable auto-mac and enable admin-mac with an assigned MAC address</br>		'''WARNING3''': for some reason, bridges are created with the same MAC which causes conflicts between APs. Disable auto-mac and enable admin-mac with an assigned MAC address</br>
	For deployment:		For deployment:

Administrator: /* Basic Basic Configuration */

2025-07-23T13:15:13Z

Basic Basic Configuration

← Older revision		Revision as of 13:15, 23 July 2025
Line 12:		Line 12:
	'''WARNING''': WiFi interfaces must be added to the main bridge</br>		'''WARNING''': WiFi interfaces must be added to the main bridge</br>

	~~'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</br>~~		<strike>'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</strike></br>
	There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>		There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>
	This must also be done on the remote CAPs.</br>		This must also be done on the remote CAPs.</br>

Administrator: /* Basic Basic Configuration */

2025-07-23T13:14:34Z

Basic Basic Configuration

← Older revision		Revision as of 13:14, 23 July 2025
Line 11:		Line 11:
	Select the WiFi interfaces and under CONFIGURATION, set CAPSman as the manager</br>		Select the WiFi interfaces and under CONFIGURATION, set CAPSman as the manager</br>
	'''WARNING''': WiFi interfaces must be added to the main bridge</br>		'''WARNING''': WiFi interfaces must be added to the main bridge</br>
	'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</br>
			~~'''WARNING2''': even the dynamic ones (automatically generated from slave interfaces) must be added to the main bridge. To do this automatically, you need to create a LIST of all interfaces (or at least the dynamic ones) and add them to the bridge, otherwise nothing works properly.</br>~~
	There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>		There may already be an "all" list ready for this purpose. I lost 2 hours figuring this out :(</br>
	This must also be done on the remote CAPs.</br>		This must also be done on the remote CAPs.</br>

Administrator: /* User Manager Configuration */

2025-07-22T07:36:58Z

User Manager Configuration

← Older revision		Revision as of 07:36, 22 July 2025
Line 74:		Line 74:
	===User Manager Configuration===		===User Manager Configuration===
	Create a certificate for User Manager (usage: tls-server) and sign it with a local CA.<br>		Create a certificate for User Manager (usage: tls-server) and sign it with a local CA.<br>
	Select it in \[settings].<br>		Select it in [settings].<br>
	Optional: import the local CA certificate on the PC. Otherwise, a trust confirmation will be requested during connection.</br>		Optional: import the local CA certificate on the PC. Otherwise, a trust confirmation will be requested during connection.</br>
	Create a group (to which users will be assigned) with outer auths: EAPxxxx (all) and inner auths: TTLS MSCHAP2 and PEAP MSCHAP2.		Create a group (to which users will be assigned) with outer auths: EAPxxxx (all) and inner auths: TTLS MSCHAP2 and PEAP MSCHAP2.
	Add users and assign them to the group.		Add users and assign them to the group.

	===WiFi or CAPSman Configuration===		===WiFi or CAPSman Configuration===
	Create a network profile as desired.<br>		Create a network profile as desired.<br>

Administrator: /* FAST ROAMING */

2025-07-21T09:18:55Z

FAST ROAMING

← Older revision		Revision as of 09:18, 21 July 2025
Line 33:		Line 33:

	== FAST ROAMING ==		== FAST ROAMING ==
	'''WARNING''': must be set in the security section</br>		'''WARNING''': must be set selecting [FT] flag in the security section</br>
	It has been verified that it doesn't work with WPA3 on some recent Android devices (it's an Android issue)		It has been verified that it doesn't work with WPA3 on some recent Android devices (it's an Android issue)

Administrator: /* Windows Client Configuration (tested with Windows 11) */

2025-07-21T09:16:06Z

Windows Client Configuration (tested with Windows 11)

← Older revision		Revision as of 09:16, 21 July 2025
Line 85:		Line 85:
	It should be enough to connect to the network: a prompt will appear to confirm the certificate (not issued by a trusted CA—see above) and then enter the username and password. It will take a while to verify and, if all goes well, it will connect.		It should be enough to connect to the network: a prompt will appear to confirm the certificate (not issued by a trusted CA—see above) and then enter the username and password. It will take a while to verify and, if all goes well, it will connect.

	\===Android Client Configuration===		===Android Client Configuration===
	CA certificate: trusted on first use.</br>		CA certificate: trusted on first use.</br>
	Enter username and password.<br>		Enter username and password.<br>
	Confirm certificate trust when prompted.<br>		Confirm certificate trust when prompted.<br>

	\===2FA Authentication (untested)===		===2FA Authentication (untested)===
	In the OTP Secret field, insert a Base32 HASH. You can generate one here: [https://emn178.github.io/online-tools/base32\_encode.html](https://emn178.github.io/online-tools/base32_encode.html) <br>		In the OTP Secret field, insert a Base32 HASH. You can generate one here: [https://emn178.github.io/online-tools/base32\_encode.html](https://emn178.github.io/online-tools/base32_encode.html) <br>
	For example, inserting `giovanni12` gives `M5UW65TBNZXGSMJS`.</br>		For example, inserting `giovanni12` gives `M5UW65TBNZXGSMJS`.</br>
	The Base32 code will then be used in Google Authenticator to generate a token.</br>		The Base32 code will then be used in Google Authenticator to generate a token.</br>
	Test login by accessing the console</br>		Test login by accessing the console</br>

Administrator: /* Generate Certificates on CAPSman */

2025-07-21T09:15:47Z

Generate Certificates on CAPSman

← Older revision		Revision as of 09:15, 21 July 2025
Line 51:		Line 51:

	To generate the CA (only once; used to sign certificates):		To generate the CA (only once; used to sign certificates):
	/certificate		/certificate add name=radius-ca common-name="RADIUS CA" key-size=secp384r1 digest-algorithm=sha384 days-valid=1825 key-usage=key-cert- sign,crl-sign
	add name=radius-ca common-name="RADIUS CA" key-size=secp384r1 digest-algorithm=sha384 days-valid=1825 key-usage=key-cert-sign,crl-sign		sign radius-ca
	sign radius-ca

	To generate a user certificate:		To generate a user certificate:
	add name=fvettore-client-cert common-name=[fvettore@cifarelli.loc](mailto:fvettore@cifarelli.loc) key-usage=tls-client days-valid=800 key-size=secp384r1 digest-algorithm=sha384		add name=fvettore-client-cert common-name=[fvettore@cifarelli.loc](mailto:fvettore@cifarelli.loc) key-usage=tls-client days-valid=800 key-size=secp384r1 digest-algorithm=sha384
	sign fvettore-client-cert ca=radius-ca		sign fvettore-client-cert ca=radius-ca

	To export the certificates:		To export the certificates:
	export-certificate radius-ca file-name=radius-ca		export-certificate radius-ca file-name=radius-ca
	export-certificate fvettore-client-cert type=pkcs12 export-passphrase="\\\\\\\\\\"		export-certificate fvettore-client-cert type=pkcs12 export-passphrase="\\\\\\\\\\"
	Exported certificates can be downloaded from the Files menu.</br>		Exported certificates can be downloaded from the Files menu.</br>
	To import into Windows, double-click on the certificates (more or less default options)		To import into Windows, double-click on the certificates (more or less default options)

Administrator: /* FAST ROAMING */

2025-07-21T09:14:59Z

FAST ROAMING

← Older revision		Revision as of 09:14, 21 July 2025
Line 33:		Line 33:

	== FAST ROAMING ==		== FAST ROAMING ==
	'''WARNING''': must be set in the security section</br>		'''WARNING''': must be set in the security section</br>
	It has been verified that it doesn't work with WPA3 on some recent Android devices (it's an Android issue)		It has been verified that it doesn't work with WPA3 on some recent Android devices (it's an Android issue)

	== Enterprise WPA2 EAP - Certificate Authentication ==		== Enterprise WPA2 EAP - Certificate Authentication ==

Administrator: /* VLAN */

2025-07-21T09:14:45Z

VLAN

← Older revision		Revision as of 09:14, 21 July 2025
Line 29:		Line 29:
	* If the network needs to go out to the internet, create a srcnat rule with masquerade in the firewall		* If the network needs to go out to the internet, create a srcnat rule with masquerade in the firewall
	* VERY IMPORTANT: in bridge->ports, add the created VLAN interface and set the PVID in the VLAN tab, otherwise nothing will work</br>		* VERY IMPORTANT: in bridge->ports, add the created VLAN interface and set the PVID in the VLAN tab, otherwise nothing will work</br>
	'''Warning''': if the ALL group is active on the interfaces auto-added to bridge1, this operation cannot be performed because the interface already belongs to it. Temporarily disable the rule		'''Warning''': if the ALL group is active on the interfaces auto-added to bridge1, this operation cannot be performed because the interface already belongs to it. Temporarily disable the rule
	* in the WiFi configuration, insert the correct PVID		* in the WiFi configuration, insert the correct PVID