User Manager/QA/How to make HotSpot and User Manager on the same router

Introduction

First make sure that router has enough hardware resources to manage User Manager and HotSpot on the same router. User manager requirements.

To accomplish HotSpot and User Manager on the same router scenario, we need to add the following configuration:

HotSpot configuration / radius add service=hotspot address=127.0.0.1 secret=123456

We add radius client to consult User Manager server for appropriate service. 'address=127.0.0.1' points RADIUS client to use local router as RADIUS server, 'secret' is shared secret to exchange information between RADIUS server and client.

/ ip hotspot profile set hsprof1 use-radius=yes

To use RADIUS for HotSpot AAA.

Create first subscriber

First subscriber must be added using Mikrotik terminal (console). All the configuration is done under the /tool user-manager menu.

To create a subscriber you should go to /tool user-manager customer menu and execute add command. It will ask for the username which you will use.

or you can enter this into the command line:

[admin@USER_MAN] tool user-manager customer> add login="admin" password="adminpassword" permissions=owner

After that you can use print command to see what you have added and you can also set the password.

[admin@USER_MAN] tool user-manager customer> print Flags: X - disabled 0 subscriber=admin login="admin" password="adminpassword" time-zone= 00:00 permissions=owner parent=admin

After that you can use the web interface.

[edit] Use web interface

To log on customer web interface type the following address in your web browser: http://Router_IP_address/userman

where "Router_IP_address" must be replaced with IP address of your router.

Use login and password of the subscriber you have created in console.

User Manager configuration First we need to create subscriber.

/ tool user-manager customer add login="MikroTik" password="qwerty" permissions=owner

Then add router information to the User Manager configuration,

/ tool user-manager router add subscriber=MikroTik ip-address=127.0.0.1 shared-secret=123456

'ip-address' is the address of the RADIUS client router.

Note, 'shared-secret' should match on User Manager and RADIUS client.

Centralized Authentication for Hotspot user

Generally we are using external Radius servers for user authentication as MikroTik is not Radius server. But here in this example we use the MikroTik User Manager which works as a Radius server and does authentication and control of your Hotspot users.

[edit] Requirements

Central location: MikroTik OS with User Manager (suggested License is L6).

Hotspot: Mikrotik Routerboard with at least a L4 License

Network 192.168.1.0/24

R1-Hotspot MasterWAN IP- <Connected to Internet>LAN IP – 192.168.1.1/24

R2-Hotspot IT Dept WAN IP – 192.168.1.2/24LAN IP – 10.10.10.1/24

R3-Hotspot Account Dept.WAN IP – 192.168.1.3/24LAN IP – 20.20.20.1/24

R4- Hotspot Purchase DeptWAN IP – 192.168.1.4/24LAN IP – 30.30.30.1/24

R5- Hotspot Sales Dept.WAN IP – 192.168.1.5/24LAN IP – 40.40.40.1/24

We assume that all the setup is ready and the hotspot is configured on R2, R3, R4, and R5 with local authentication.

First, we will configure R2, R3, R4 & R5 to use MikroTik user manager as a Radius server.

/ip hotspot profileuse-radius=yes

/radius addservice=hotspot address=192.168.1.1 secret=123456

This configuration will apply to all the Hotspot router.

Now, we will configure R1-Hotspot Master.

/tool user-manager customer addsubscriber=mikrotik login="mikrotik" password="ashish" time-zone=+05:30

permissions=owner parent=mikrotik

/tool user-manager router addsubscriber=mikrotik name="R2" ip-address=192.168.1.2 shared-secret="123456"

subscriber=mikrotik name="R3" ip-address=192.168.1.3 shared-secret="123456"

subscriber=mikrotik name="R4" ip-address=192.168.1.4 shared-secret="123456"

subscriber=mikrotik name="R5" ip-address=192.168.1.5 shared-secret="123456"

and finally add the user on R1

/tool user-manager user addusername=ashish password=ashishpatel subscriber=mikrotik

The user name and password will work for all the remote hotspot router…a user can login from any department of the company with same ID and password and we can have all the user data centrally.

Now you can log into the User Manager web interface on the address http://192.168.1.1/userman and start setting up your user accounts.