RADIUS and Wireless Authentication

What it is

Authentication proves who a client is before it may use the wireless network, and RADIUS lets a central server decide.

On a small network the access point can hold the secret itself. On a larger network, it is better to keep users and devices in one place, so that a change is made once.

RADIUS is the protocol for that. The access point asks a RADIUS server whether the client may join, and the server answers.

How it works

A security profile holds the authentication choices, and RADIUS adds a central decision.

The security profile

Authentication settings live in a security profile, which an interface then uses:

/interface wireless security-profiles add name=staff mode=dynamic-keys authentication-types=wpa2-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa2-pre-shared-key=ChangeThisKey
/interface wireless set wlan1 security-profile=staff

With mode=dynamic-keys, the access point and client negotiate fresh keys for each session, which is the modern approach.

Pre shared key authentication

With PSK, every client uses the same passphrase. It is simple, and it suits small networks. The weakness is that anyone who knows the key can join, and changing it means changing every client.

A private key per client, set in the access list, reduces that problem.

MAC authentication with RADIUS

An access point can ask a RADIUS server about the MAC address of each client:

/interface wireless security-profiles set staff radius-mac-authentication=yes radius-mac-format=XX:XX:XX:XX:XX:XX

The properties involved are these:

The local access list and the RADIUS server can both take part in the decision about a client, so test the combined result on a lab device.

The RADIUS client

For any RADIUS use, the router needs the server defined:

/radius add service=wireless address=192.168.88.10 secret=SharedSecret

• service=wireless says the server is used for wireless clients.
• address is the server.
• secret is the shared secret that both sides use to protect messages.

The server must also list the router as a client with the same secret. If the secrets differ, requests are dropped.

What the server can send back

A RADIUS reply can include extra information that RouterOS understands. Examples are attributes that give a client its own key, or turn forwarding on or off for a client. This gives central control over per client behaviour.

Accounting

RADIUS also supports accounting, which means records of when each client connected, how long it stayed and how much data it sent. You can turn it on for MAC authenticated clients and for EAP clients. Accounting is useful for billing and for audit logs.

Authentication flow

The order of events is:

• A client sends an association request.
• The access point checks its access list, and asks the RADIUS server too if MAC authentication is on.
• The client and access point run the key exchange, or the EAP exchange.
• Encrypted traffic starts.

Testing

Check the logs and the registration table when something fails:

/log print where topics~"radius"
/interface wireless registration-table print

The log shows whether the router could reach the server and whether a request was rejected.