Skip to main contentSkip to search
Skip to main content

MikroTik ROS v7 OpenRoaming with RadSec

Configure OpenRoaming on MikroTik devices running RouterOS v7 with IronWiFi RadSec authentication. This guide covers certificate import and trust configuration, RadSec RADIUS setup, wireless security profiles, interworking (802.11u) configuration, and Hotspot 2.0 deployment for global WiFi roaming.

Quick Start​

  1. Enable OpenRoaming and RadSec in IronWiFi Console
  2. Download and import certificate bundle to MikroTik
  3. Create RadSec RADIUS profile pointing to 
    radsec.ironwifi.com:2083
  4. Create security profile with WPA2-EAP
  5. Configure interworking profile with OIs: 
    5A03BA0000
    , 
    5A03BA0200
    , 
    004096
  6. Apply profiles to wireless interface

Prerequisites​

In MikroTik:​

  • MikroTik device with wireless capability
  • RouterOS 7.x (7.1+ recommended)
  • Wireless interface configured and operational

In IronWiFi Console (complete these first):​

  1. Create or select a Network in the IronWiFi Console
  2. Enable OpenRoaming from the dropdown menu
  3. Enable RadSec from the dropdown menu
  4. Download the certificate bundle (contains Root CA, Intermediate CA, client certificate, and private key)

Upload Certificates to MikroTik​

Upload the certificates to your MikroTik device:

Via WinBox/WebFig​

  1. Go to Files
  2. Upload all 4 certificate files from the bundle

Via CLI​

Import Certificates​

The certificate bundle contains:

  • iw-rsa-root-ca.cert.pem
    - Root CA certificate
  • iw-rsa-radsec-signing-ca.cert.pem
    - Intermediate CA certificate
  • client.cert.pem
    - Client certificate
  • client.key.pem
    - Private key

Verify certificates:

/certificate print

Configure RadSec​

Replace 

radsec.ironwifi.com
with the RadSec server from your IronWiFi console.

Wireless Security Profile​

Interworking Profile (802.11u)​

Hotspot 2.0 Profile​

NAI Realm Configuration​

Add additional realms for OpenRoaming identity providers:

Roaming Consortium OIs​

Add OpenRoaming Organization Identifiers:

OI descriptions:

  • 5A03BA0000
    - WBA OpenRoaming Settlement-free
  • BAA2D00000
    - WBA OpenRoaming Settled
  • 004096
    - Cisco OpenRoaming

Apply Configuration to Wireless Interface​

Complete Configuration Script​

Verification​

Check RadSec connection:

/radius print stats

Check wireless status:

/interface wireless print detail where name=wlan1

Check connected clients:

/interface wireless registration-table print

Troubleshooting​

RadSec Connection Failed​

  1. Verify certificates are correctly imported
  2. Check certificate validity dates
  3. Ensure port 2083 is not blocked
  4. Verify RadSec server hostname

Clients Don't Connect​

  1. Verify 802.11u settings
  2. Check roaming consortium OIs
  3. Ensure client has valid OpenRoaming credentials
  4. Test with manual EAP configuration first

Authentication Fails​

  1. Check IronWiFi authentication logs
  2. Verify NAI realm configuration
  3. Ensure user exists or auto-creation is enabled

Same vendor

Standards & reference

Was this page helpful?