Skip to main contentSkip to search
Skip to main content

MikroTik ROS v7 - OpenRoaming with RadSec

Configure RadSec (RADIUS over TLS) on MikroTik RouterOS v7 for secure OpenRoaming authentication with IronWiFi. This guide provides detailed instructions for certificate installation, RadSec RADIUS configuration with TLS encryption, wireless security profiles, and Hotspot 2.0 interworking setup.

Quick Start​

  1. Enable RadSec and OpenRoaming in IronWiFi Console
  2. Download certificate bundle (4 files)
  3. Upload and import certificates to MikroTik, mark CAs as trusted
  4. Create RadSec RADIUS with 
    radsec.ironwifi.com:2083
  5. Create security and interworking profiles
  6. Apply to wireless interface with Hotspot 2.0 enabled

Prerequisites​

In MikroTik:​

  • MikroTik device with RouterOS 7.x
  • Device supports 802.11u/Hotspot 2.0
  • Wireless interface configured and operational

In IronWiFi Console (complete these first):​

  1. Create or select a Network in the IronWiFi Console
  2. Enable OpenRoaming from the dropdown menu
  3. Enable RadSec from the dropdown menu
  4. Download the certificate bundle (ZIP file containing 4 files: Root CA, Intermediate CA, client certificate, and private key)

Certificate Installation​

Upload Certificates to MikroTik​

  1. Connect to MikroTik via WinBox or web interface
  2. Go to Files
  3. Upload all 4 files from the certificate bundle: 
    • iw-rsa-root-ca.cert.pem
    • iw-rsa-radsec-signing-ca.cert.pem
    • client.cert.pem
    • client.key.pem

Import Certificates​

Via WinBox/WebFig:

  1. Go to System > Certificates
  2. Click Import
  3. Import 
    iw-rsa-root-ca.cert.pem
    :
    • Select file
    • Click Import
    • Mark as Trusted
  4. Import 
    iw-rsa-radsec-signing-ca.cert.pem
    :
    • Select file
    • Click Import
    • Mark as Trusted
  5. Import 
    client.cert.pem
    :
    • Select file
    • Click Import
  6. Import 
    client.key.pem
    :
    • Select file
    • Passphrase: (leave empty or enter if set)
    • Click Import
    • This associates the key with the client certificate

Via CLI:

Set Certificates as Trusted​

Verify Certificates​

/certificate print

You should see all certificates with the client certificate showing 

KT
flags (Key + Trusted chain).

RadSec Configuration​

Create RadSec RADIUS Profile​

Via CLI:

Key Parameters:

  • address
    : IronWiFi RadSec server
  • certificate
    : Your client certificate name (check exact name with 
    /certificate print
    )
  • protocol
    : Must be 
    radsec
  • secret
    : Empty for RadSec (uses certificates)

Configure AAA​

/radius incoming set accept=yes

Wireless Configuration​

Create Security Profile​

Create Interworking Profile (802.11u)​

Configure Hotspot 2.0 (Passpoint)​

Create Wireless Interface​

Complete Configuration Example​

Here's a complete CLI configuration:

Verification​

Check RadSec Connection​

Check Certificate Status​

/certificate print detail

Enable Debug Logging​

/system logging add topics=radius,debug,packet

View logs:

/log print where topics~"radius"

Test Authentication​

  1. Connect a Passpoint-enabled device
  2. Check authentication in IronWiFi Console
  3. Monitor MikroTik logs for RADIUS exchanges

Troubleshooting​

RadSec Connection Failed​

  1. Verify certificates imported correctly

    /certificate print

    Client cert should show 

    KT
    flags

  2. Check certificate trust

    /certificate print detail where trusted=yes

  3. Verify network connectivity

    /tool ping radsec.ironwifi.com

  4. Check port 2083 is open

Authentication Failures​

  1. Check RADIUS configuration

    /radius print

  2. Review debug logs

    /log print where topics~"radius"

  3. Verify interworking profile

    /interface wireless interworking-profiles print

Common Errors​

ErrorCauseSolution
"certificate verify failed"CA not trustedSet CA certificates as trusted
"connection refused"Port blockedCheck firewall for port 2083
"no suitable certificate"Wrong cert nameVerify certificate name in RADIUS config
"TLS handshake failed"Certificate mismatchRe-download and import certificates

Best Practices​

  1. Use RouterOS 7.x - Required for proper RadSec support
  2. Keep certificates secure - Protect private key
  3. Monitor expiration - Certificates expire, plan renewal
  4. Test thoroughly - Verify with multiple devices
  5. Enable logging - For troubleshooting during setup
  6. Backup configuration - Save working config

Same vendor

Standards & reference

Was this page helpful?