RADIUS Client Configuration

RADIUS Client Configuration

Version Info

RouterOS 7.16 | Min: v6.0+ | ⏱️ 15 minutes | 🟡 Intermediate

Tested on: 7.16 7.14

Version-specific notes

• v7.15: Added Message-Authenticator validation - may break some RadSec setups
• v7.0: Added RadSec (RADIUS over TLS) support
• v6.x: Same commands work on RouterOS 6.x

TL;DR (Quick Start)

For the impatient: add a RADIUS server and enable it for your service.

# Add RADIUS server
/radius add address=10.0.0.100 secret=YourSharedSecret service=ppp

# Enable RADIUS for PPP authentication
/ppp aaa set use-radius=yes accounting=yes

Verify with:

/radius monitor 0

Look for accepts incrementing when users authenticate.

Overview

What this does: RADIUS (Remote Authentication Dial-In User Service) Client enables MikroTik to authenticate users against an external RADIUS server instead of local user database. This centralizes user management across multiple routers and services.

When to use this:

• ISP environments with many PPPoE/HotSpot subscribers
• Enterprise networks requiring centralized authentication
• Wireless 802.1X/WPA-Enterprise deployments
• Multiple routers needing shared user database
• Integration with existing directory services (AD, LDAP via RADIUS)

Prerequisites:

• A RADIUS server (FreeRADIUS, Microsoft NPS, User Manager, etc.)
• Network connectivity to RADIUS server (UDP 1812/1813)
• Shared secret configured on both router and RADIUS server
• User accounts configured on RADIUS server

Configuration Steps

Step 1: Add RADIUS Server

Configure the router to communicate with your RADIUS server:

/radius add address=10.0.0.100 secret=YourSharedSecret service=ppp

Replace:

• 10.0.0.100 with your RADIUS server IP
• YourSharedSecret with the shared secret configured on your RADIUS server
• ppp with the service(s) you need: ppp, hotspot, wireless, login, dhcp, dot1x, ipsec

Step 2: Enable RADIUS for Your Service

RADIUS must be explicitly enabled for each service that should use it.

For PPP/PPPoE:

/ppp aaa set use-radius=yes accounting=yes

For HotSpot:

/ip hotspot profile set default use-radius=yes accounting=yes

For Router Login:

/user aaa set use-radius=yes

For DHCP:

/ip dhcp-server set dhcp1 use-radius=yes

Step 3: Verify Configuration

Monitor RADIUS communication:

/radius monitor 0

Expected output during authentication:

          pending: 0
         requests: 15
          accepts: 12
          rejects: 3
          resends: 0
         timeouts: 0
       bad-replies: 0
 last-request-rtt: 5ms

Key indicators:

• accepts incrementing = successful authentications
• rejects incrementing = authentication denied (check credentials)
• bad-replies incrementing = shared secret mismatch
• timeouts incrementing = server unreachable

Step 4: Configure Firewall (If Needed)

If your router has a restrictive firewall, allow RADIUS traffic:

/ip firewall filter add chain=input protocol=udp dst-port=1812-1813 \
    src-address=10.0.0.100 action=accept place-before=0

Common Scenarios

Scenario: Multiple RADIUS Servers (Failover)

Configure backup servers in priority order:

/radius add address=10.0.0.100 secret=Secret1 service=ppp timeout=500ms
/radius add address=10.0.0.101 secret=Secret2 service=ppp timeout=500ms

Servers are tried in list order. Reduce timeout for faster failover.

Scenario: RADIUS for Wireless 802.1X

For WPA2/WPA3-Enterprise authentication:

# Add RADIUS server for wireless
/radius add address=10.0.0.100 secret=YourSecret service=wireless

# Configure enterprise security profile
/interface wifi security add name=enterprise-security \
    authentication-types=wpa2-eap encryption=ccmp

/interface wifi aaa add name=radius-aaa

/interface wifi configuration add name=enterprise-config \
    ssid=CorpNetwork security=enterprise-security aaa=radius-aaa

Scenario: RADIUS for Wired 802.1X (Dot1X)

For port-based authentication on Ethernet:

# Add RADIUS server for dot1x
/radius add address=10.0.0.100 secret=YourSecret service=dot1x

# Enable dot1x on interface
/interface dot1x server add interface=ether2 auth-types=dot1x

Scenario: Accept Disconnect-Messages (CoA)

Allow RADIUS server to terminate sessions remotely:

# Enable incoming Disconnect-Messages
/radius incoming set accept=yes port=1700

# Allow in firewall
/ip firewall filter add chain=input protocol=udp dst-port=1700 \
    src-address=10.0.0.100 action=accept place-before=0

Scenario: RadSec (RADIUS over TLS)

For encrypted RADIUS communication:

# Import certificate
/certificate import file-name=radius-client.p12 passphrase=certpass

# Add RadSec server
/radius add address=10.0.0.100 secret=radsec protocol=radsec \
    certificate=radius-client.p12_0 service=ppp,hotspot

Note: With RadSec, the shared secret is forced to “radsec” per RFC 6614.

Scenario: Using MikroTik User Manager as RADIUS Server

If using RouterOS User Manager as your RADIUS server:

# On the router acting as RADIUS client
/radius add address=192.168.1.1 secret=testing123 service=hotspot

# Allow loopback if User Manager is on same router
/ip firewall filter add chain=input src-address=127.0.0.1 action=accept

Scenario: RADIUS with Specific Source Address

When router has multiple IPs and RADIUS server filters by source:

/radius set 0 src-address=192.168.1.1

Verification

Confirm your RADIUS client configuration is working:

Check 1: Verify RADIUS Server Entry

/radius print

Expected: Server listed with correct address and service.

Check 2: Monitor Statistics

/radius monitor 0

Expected: accepts count increases with successful logins.

Check 3: Check for Errors

/radius monitor 0

Watch for:

• bad-replies > 0 = shared secret mismatch
• timeouts > 0 = server unreachable
• rejects = authentication denied

Check 4: Test Authentication

Attempt a login with a RADIUS user and verify:

# For PPP, check active sessions
/ppp active print

# For HotSpot, check active users
/ip hotspot active print

Troubleshooting

Symptom	Cause	Solution
bad-replies incrementing	Shared secret mismatch	Verify secret matches on both router and RADIUS server exactly
timeouts incrementing	Server unreachable	Check network connectivity, firewall rules for UDP 1812/1813
rejects incrementing	Invalid credentials	Verify username/password on RADIUS server
RADIUS not queried at all	Service not enabled	Enable RADIUS for specific service (/ppp aaa, /ip hotspot profile, etc.)
RADIUS not queried at all	Local user exists	Local users are checked first; remove local user to use RADIUS
SSH works but Winbox fails (or vice versa)	Different auth protocols	SSH uses PAP, Winbox uses CHAP - enable both on RADIUS server
RadSec fails after 7.15 upgrade	Message-Authenticator changes	Set require-message-auth=no or downgrade to 7.14.3
”RADIUS server not responding”	Firewall blocking	Add rules for UDP 1812/1813 from RADIUS server IP
CoA/Disconnect not working	Incoming not enabled	Set /radius incoming set accept=yes and allow port 1700

Debug: Test RADIUS Server Connectivity

# Verify network path
/tool ping 10.0.0.100 count=3

# Check if ports are open (from router perspective)
# Note: RADIUS won't respond to arbitrary packets, but this confirms routing

Debug: Check Bad Replies

/radius monitor 0
# If bad-replies keeps incrementing:
# 1. Verify shared secret character-by-character
# 2. Check for trailing spaces or special characters
# 3. For RadSec, ensure server uses "radsec" as shared secret

Common Mistakes

• Don’t forget to enable RADIUS per service - Adding a RADIUS server isn’t enough; each service needs use-radius=yes
• Local users take precedence - If a local user exists, RADIUS is never queried for that username
• Shared secrets must match exactly - Including case and special characters
• RadSec requires “radsec” as secret on server - RouterOS enforces this per RFC 6614
• Firewall rules needed for User Manager on same router - Allow loopback (127.0.0.1) traffic

Community Tips

Testing RADIUS: Use radtest from FreeRADIUS tools to verify server is working before configuring MikroTik.

Multiple Services: You can specify multiple services per RADIUS entry:

/radius add address=10.0.0.100 secret=Secret service=ppp,hotspot,login

Accounting: Enable accounting to track session usage:

/ppp aaa set accounting=yes interim-update=5m

Failover Pattern: For reliable failover, add servers multiple times with short timeouts:

/radius add address=10.0.0.100 secret=Secret service=ppp timeout=500ms
/radius add address=10.0.0.101 secret=Secret service=ppp timeout=500ms
/radius add address=10.0.0.100 secret=Secret service=ppp timeout=500ms

RADIUS Monitor Fields Reference

Field	Description
pending	Active requests awaiting response
requests	Total requests sent
accepts	Successful authentications (Access-Accept received)
rejects	Denied authentications (Access-Reject received)
resends	Retry attempts after timeout
timeouts	Requests that never received response
bad-replies	Responses with invalid signature (wrong secret)
last-request-rtt	Round-trip time of most recent request

Related Topics

Authentication Use Cases

• L2TP VPN Server - RADIUS for VPN authentication
• PPPoE Server - RADIUS for PPPoE subscriber management
• Hotspot - RADIUS for captive portal authentication
• CAPsMAN - RADIUS for enterprise WiFi (WPA2/WPA3-Enterprise)

Related Topics

• User Management - local user accounts (alternative to RADIUS)
• 802.1X - port-based network access control with RADIUS
• IP Pool - address pools assigned via RADIUS

Security

• Firewall Basics - protect RADIUS ports (1812, 1813)

Reference

• MikroTik RADIUS Documentation
• Version changes:
  • v7.15: Message-Authenticator validation changes
  • v7.0: RadSec support added

Key Properties Reference

Property	Type	Default	Description
address	IP	0.0.0.0	RADIUS server address
secret	string	""	Shared secret for authentication
service	enum	""	Services: ppp, login, hotspot, wireless, dhcp, ipsec, dot1x
authentication-port	integer	1812	Authentication port
accounting-port	integer	1813	Accounting port
timeout	time	1100ms	Request timeout before retry
protocol	udp/radsec	udp	Communication protocol
certificate	string	-	Certificate for RadSec
src-address	IP	0.0.0.0	Source IP for RADIUS packets
disabled	yes/no	no	Enable/disable this entry

Service-Specific RADIUS Enablement

Service	Enable Command
PPP/PPPoE	/ppp aaa set use-radius=yes
HotSpot	/ip hotspot profile set [find] use-radius=yes
Router Login	/user aaa set use-radius=yes
DHCP	/ip dhcp-server set [find] use-radius=yes
Wireless	Configure WPA-EAP security profile
Dot1X	/interface dot1x server add interface=ethX