User Manager/QA/How to make HotSpot and User Manager on the same router

Introduction

First make sure that router has enough hardware resources to manage User Manager and HotSpot
on the same router. User manager requirements.

To accomplish HotSpot and User Manager on the same router scenario, we need to add the
following configuration:

HotSpot configuration
/ radius add service=hotspot address=127.0.0.1 secret=123456

We add radius client to consult User Manager server for appropriate service. 'address=127.0.0.1'
points RADIUS client to use local router as RADIUS server, 'secret' is shared secret to exchange
information between RADIUS server and client.

/ ip hotspot profile set hsprof1 use-radius=yes

To use RADIUS for HotSpot AAA.

Create first subscriber

First subscriber must be added using Mikrotik terminal (console). All the configuration is done
under the /tool user-manager menu.

To create a subscriber you should go to /tool user-manager customer menu and execute add
command. It will ask for the username which you will use.

or you can enter this into the command line:

[admin@USER_MAN] tool user-manager customer> add login="admin"

password="adminpassword" permissions=owner

After that you can use print command to see what you have added and you can also set the
password.

[admin@USER_MAN] tool user-manager customer> print

Flags: X - disabled
0 subscriber=admin login="admin" password="adminpassword" time-zone=
00:00
permissions=owner parent=admin

After that you can use the web interface.

[edit] Use web interface

To log on customer web interface type the following address in your web browser:
http://Router_IP_address/userman

where "Router_IP_address" must be replaced with IP address of your router.

Use login and password of the subscriber you have created in console.

User Manager configuration

• First we need to create subscriber.

/ tool user-manager customer add login="MikroTik" password="qwerty"

permissions=owner

• Then add router information to the User Manager configuration,

/ tool user-manager router add subscriber=MikroTik ip-address=127.0.0.1

shared-secret=123456

'ip-address' is the address of the RADIUS client router.

Note, 'shared-secret' should match on User Manager and RADIUS client.

Centralized Authentication for Hotspot user

Generally we are using external Radius servers for user authentication as MikroTik is not Radius
server. But here in this example we use the MikroTik User Manager which works as a Radius
server and does authentication and control of your Hotspot users.

[edit] Requirements

Central location: MikroTik OS with User Manager (suggested License is L6).

Hotspot: Mikrotik Routerboard with at least a L4 License

Network 192.168.1.0/24
R1-Hotspot Master
WAN IP- <Connected to Internet>
LAN IP – 192.168.1.1/24

R2-Hotspot IT Dept
WAN IP – 192.168.1.2/24
LAN IP – 10.10.10.1/24

R3-Hotspot Account Dept.

WAN IP – 192.168.1.3/24
LAN IP – 20.20.20.1/24

R4- Hotspot Purchase Dept

WAN IP – 192.168.1.4/24
LAN IP – 30.30.30.1/24

R5- Hotspot Sales Dept.

WAN IP – 192.168.1.5/24
LAN IP – 40.40.40.1/24

We assume that all the setup is ready and the hotspot is configured on R2, R3, R4, and R5 with
local authentication.

First, we will configure R2, R3, R4 & R5 to use MikroTik user manager as a Radius server.

/ip hotspot profile

use-radius=yes

/radius add
service=hotspot address=192.168.1.1 secret=123456

This configuration will apply to all the Hotspot router.

Now, we will configure R1-Hotspot Master.

/tool user-manager customer add

subscriber=mikrotik login="mikrotik" password="ashish" time-zone=+05:30
permissions=owner parent=mikrotik

/tool user-manager router add

subscriber=mikrotik name="R2" ip-address=192.168.1.2 shared-secret="123456"

subscriber=mikrotik name="R3" ip-address=192.168.1.3 shared-secret="123456"

subscriber=mikrotik name="R4" ip-address=192.168.1.4 shared-secret="123456"

subscriber=mikrotik name="R5" ip-address=192.168.1.5 shared-secret="123456"

and finally add the user on R1

/tool user-manager user add

username=ashish password=ashishpatel subscriber=mikrotik

The user name and password will work for all the remote hotspot router…a user can login from
any department of the company with same ID and password and we can have all the user data
centrally.

Now you can log into the User Manager web interface on the address http://192.168.1.1/userman
and start setting up your user accounts.