RADIUS · Topic 2 of 3
RADIUS Server and User Manager
Learn what a RADIUS server does for RouterOS routers, how User Manager acts as one, how to register a router as a client and how v6 and v7 differ.
- 5 min
- A RADIUS server holds accounts, answers requests and stores accounting.
- The server must list each router with its address and shared secret.
- MikroTik defines its own attributes, such as the rate limit.
What it is
A RADIUS server holds the user accounts and answers the requests that routers send, and User Manager is MikroTik's own server.
The server decides whether a user may log in, and it can return limits for the session. It also stores the accounting records that the routers report.
User Manager is a package for RouterOS that turns a router into a RADIUS server with its own user database. Other servers, such as FreeRADIUS or a Windows server, also work with MikroTik routers.
How it works
The server must know each router, and then it matches users to profiles and limits.
What a RADIUS server needs
A RADIUS server needs three kinds of information:
- the routers it will answer, each with an address and a shared secret
- the user accounts, with passwords
- the rules that decide what each user gets, such as speed or time
A router that is not listed on the server is ignored. This is a common reason for silent failures.
Vendor specific attributes
A RADIUS reply can carry attributes. MikroTik defines its own, such as a rate limit for the session and a group for router login. A non MikroTik server needs the MikroTik attribute dictionary to send them.
User Manager already knows these attributes, which is one reason to choose it for a MikroTik network.
User Manager
User Manager is installed as its own package, and it must be enabled before it answers requests.
/user-manager set enabled=yes
/user-manager router add name=nas1 address=192.168.88.1 shared-secret=RadiusKey1
/user-manager user add name=guest1 password=Pass123The router entry represents a RADIUS client. Its address and shared secret must match the /radius entry on that router. The user entry is an account.
The pieces of User Manager
| Piece | What it does |
|---|---|
| Router | A router that is allowed to send requests, with its secret. |
| User | An account with a name and password. |
| Profile | A named package of service, for example a speed or a validity period. |
| Limitation | The limits inside a profile, such as rate or transfer. |
| Session | A record of one login, used for accounting. |
Users receive profiles, and profiles use limitations. Changing a limitation changes every user that holds the profile.
Version differences
User Manager changed a great deal between RouterOS v6 and v7. In v6, the package is managed mainly through its own web page, with customers, routers, users and profiles. In v7, the package has a new design with a console menu at /user-manager.
The commands above are the v7 form. If you work on v6, expect a different layout and different menu names. Do not copy commands between versions.
Connecting a router to the server
On the router that serves users, add a RADIUS client entry that points at the server.
/radius add service=hotspot address=192.168.88.10 secret=RadiusKey1
/ip hotspot profile set hsprof1 use-radius=yesIf User Manager runs on the same router, the RADIUS entry points at that router's own address. The router still needs its own router entry in User Manager.
Other RADIUS servers
Any standards based server works. The router needs only the address, the ports and the shared secret. To use MikroTik attributes, the server needs the MikroTik dictionary.
Troubleshooting
Check three things when logins fail.
- The shared secret is identical on the client and in the server's router entry.
- The router address on the server is the address the router sends from, so set
src-addresson the client if there are several. - The user exists and has a valid profile on the server.
The /radius monitor 0 command on the router shows whether requests are answered, accepted or rejected.
What to remember for the exam
Seven facts cover most server questions.
- A RADIUS server holds accounts, answers requests and stores accounting.
- The server must list each router with its address and shared secret.
- MikroTik defines its own attributes, such as the rate limit.
- User Manager is a RouterOS package that works as a RADIUS server.
- Users receive profiles, and profiles use limitations.
- The
routerentry in User Manager must match the/radiusentry on the router. - User Manager differs between v6 and v7, so do not mix their commands.
If the router sends requests but gets no answer, check that the server lists the router with the right address and secret.
Common mistakes
These four errors appear again and again.
Forgetting to list the router on the server. The server ignores requests from unknown routers.
Mismatched secrets. The two ends must hold the same shared secret.
Mixing v6 and v7 User Manager instructions. The menus and the design differ.
Not enabling the package. User Manager does not answer until it is enabled.
A server with the right users but the wrong router address on its router entry still rejects every request.
Check yourself
Work through these three questions.
What does a RADIUS server need to know about each router?
It needs the router address and the shared secret, so it can accept the router's requests.
How are users, profiles and limitations related in User Manager?
Users receive profiles, and profiles use limitations. Changing a limitation changes every user with that profile.
Why should you avoid copying User Manager commands between v6 and v7?
The package was redesigned, so the menus and layout differ.
Topic 2 of 3 in RADIUS
Test yourself on RADIUS
The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.