Member Avatar for Samerases

Hello,,,,,,

I'm a new member, recorded good hope in you, to solve this big problem,,,,,
I have a network of which it is a Server 2003 Active Directory
And we have ISA Server

It is important there is a line Internet Mikrotik been prepared and connecting Mikrotik Active Direcory
I mean take the names of users from ActiveDirectory,,

Important to have worked in the Active Directory service Radius and finished the settings and went to surfer Mikrotik and operated Radius Client

And been created the HotSpot Server Radius .....
Connector on the device opened Mikrotik and put the user name of the active Directory and managed to log on ...
But the Internet does not open ... logically because he did not enter the name in the user profile
The question how to get into the profile or find solution ....

And I'm very sorry for the my weak language>>>>

  • 2 Contributors
  • 3 Replies
  • 199 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by BigPaw

Dani AI

Generated

For — short diagnosis and a safe checklist. The HotSpot login succeeding (AD credentials accepted) but no Internet normally means one of three things: the router accepted the RADIUS Access-Accept but never got usable session/profile attributes from IAS, the HotSpot network lacks NAT/DNS/routing so authenticated clients cannot reach the Internet, or an upstream proxy/firewall (ISA) is blocking traffic from the HotSpot subnet. The MikroTik HotSpot uses its NAT/firewall rules and (if configured) RADIUS-returned attributes to build the client session; if those attributes are missing the router will fall back to the HotSpot profile defaults. (wiki.mikrotik.com)

Immediate MikroTik checks (quick commands to run on the router to see what’s happening and watch RADIUS exchanges):

/radius monitor 0
/system logging add topics=radius,hotspot action=memory
/log print follow where topics~"radius"
/ip hotspot active print
/ip hotspot profile set default use-radius=yes

Look for Access-Accept messages and whether the active list shows a client IP and login-by value. If the router shows the user as active with an IP but ping to 8.8.8.8 fails, the problem is NAT/routing; if there is no active entry after the Access-Accept, the router likely didn’t receive required attributes. (wiki.mikrotik.com)

Windows IAS side: confirm the RADIUS client entry (correct IP + shared secret), enable IAS authentication/accounting logging, and verify that the user’s request is matched to a Remote Access Policy that either grants access or returns the vendor-specific attributes MikroTik expects (MikroTik VSAs such as rate-limit, framed-ip, session-timeout can be added in the policy profile as Vendor‑Specific attributes). If AD user dial-in permissions are used, either set them appropriately or configure the policy to ignore user dial‑in properties for wireless/hotspot scenarios. (flylib.com)

Practical isolation workflow: 1) Create a local HotSpot user on the router and confirm Internet — if local works, focus on RADIUS attributes and IAS profile. 2) If local fails, fix NAT/DNS (example NAT rule):

/ip firewall nat add chain=srcnat out-interface=<WAN-IF> action=masquerade src-address=<hotspot-subnet>
  1. If an ISA/proxy is upstream, allow the HotSpot subnet through the proxy (or bypass for that subnet) because captive-portal clients won’t present proxy credentials. Record exact IAS logs and MikroTik radius logs before changing attributes — that makes pinpointing the failure fast. @BigPaw’s suggestion to “bypass” authentication isn’t applicable to fixing the integration; the goal is correct attribute/route/policy mapping so AD logins receive full network access.

Recommended Answers

All 3 Replies

Member Avatar for BigPaw

If you would like to bypass authentication you would need to ask the Administrator. I'm not sure he/she would be in a big rush to help you with this though.

Member Avatar for Samerases

UP

Member Avatar for BigPaw

UP

I don't know what that means, sorry.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.