I have the new userman working on my main gateway mt.

I get authentication error from the client and in the MT log it says: authentication fialed - radius timeout(6)

I had my radius working on IAS.

Can userman run on the same MT which is also authenticating pppoe?

Dolf

To answer my own question in case somebody else wondered about it.

I used the originating ip of the client MT, which wasn't on the same range but that wasn't the IP the user manager saw and didn't accept the requests.

I now use the ip of the interface the request will enter the subnet on.

It now works fine.

Dolf

Hi Dolf, I too am wondering how to get the user manager to authenticate PPPoE clients.

So far usermanager is radius based, i can test its access accept replys with NTradping (cool little utility), It seems that User managers access accept does not include "framed type ppp" in its response. This reply attribute is needed for PPPoE radius authentication yes?

ever closer to the answer.

我pppoe没问题,只是在ra中ppp盒子dius setup, but doesn't work with servicename!

Im confused,

My radius client settings are 127.0.0.1 , secret is correct, standard ports.

Usermanager has a "router" 127.0.0.1 with the secret.

My PPPoE server has a blank service name, and will work with radius as tested (steel belted radius) and by its own user list.

No matter what the username or password is of a user created in the manager, it always answers mikrotik radius client with a reject.

What have i missed?

I have now upgraded to a level 6 license, still no luck getting User manager to reply with access accept calls from the MT box its on, always rejects (connects to the radius IP on 127.0.0.1 ok but rejects the access call), The username/password entered into User Manager is correct. So PPPoE clients get "error 691..... Wrong username/password" (windows box)

The PPP>Secrets>AAA is ticked for Radius and Accounting, and the radius client (MT) is looking to 127.0.0.1 with PPP ticked.

If i print the userlist i get a date for 1970, as the credit till date. How do i change this, the internal clock is correct to UTC and our timezone +12:00

[admin@ATM Feilding] tool user-manager> user print
Flags: X - disabled, A - active
0 subscriber=admin username="test1" password="test1" first-name="Test"
last-name="User" pool-name="pool1" last-seen=never credit-count=0
credit-left=0s credit-duration=0s credit-price=0
credit-till-time=jan/01/1970 00:00:00 credit-time-added=0s

1 subscriber=admin username="test" password="test" pool-name="pool1"
last-seen=never credit-count=0 credit-left=0s credit-duration=0s
credit-price=0 credit-till-time=jan/01/1970 00:00:00
credit-time-added=0s

2 subscriber=useradmin username="test3" password="test3" pool-name="pool1"
last-seen=never credit-count=0 credit-left=0s credit-duration=0s
credit-price=0 credit-till-time=jan/01/1970 00:00:00
credit-time-added=0s
[admin@ATM Feilding] tool user-manager>


Any takers?

Cheers

I see you have 2 set of customers - as I understand then two different radius servers actually with thier own subscribers.

With wich one do you login to the webinterface? delete the other one and enter the users in the web interface.

I see my date is the same but it works, maybe it's a bug??

Does this pool1 you specifeid exist on the Local MT? Try removing it first. The pool entered there only works if the pppoe server is on the local MT. Mine doesn't want to authenticate remote MT's if I enter a local-pool.

Hope it works.

Hi Dolf,

I see you have 2 set of customers - as I understand then two different radius servers actually with thier own subscribers.

I started with just the one customer "admin" then had a try by adding another "useradmin"

With wich one do you login to the webinterface? delete the other one and enter the users in the web interface.

Have done this

Does this pool1 you specifeid exist on the Local MT? Try removing it first. The pool entered there only works if the pppoe server is on the local MT. Mine doesn't want to authenticate remote MT's if I enter a local-pool.

Yes the pool is an IP that is on the local MT machine (the same MT does PPPoE and has the user manager).

Here is the current setupIll have a fiddle with the pool settings and let you know.

Cheers for your advice

I picked a problem with MT 2.9.22 that doesn't want to work with usermanager as client. Similar problem as you described.

[SOLVED] I had same problem that "log" showed user xxx authentication failed-radius timeout! after many attempts I found that an unneeded NAT rule was set!

Radius client can not communicate with radius server aka (Userman) when general masquarading rule is applied.
exclude 127.0.0.1 from masquerading & use 127.0.0.1 as Radius client & User manager IP.
Use this code insteador you can also define masquerading rule separately for each subnet for added security.
Took me 2 hours to solve this issue. posting here to help others.

Radius client can not communicate with radius server aka (Userman) when general masquarading rule is applied.
exclude 127.0.0.1 from masquerading & use 127.0.0.1 as Radius client & User manager IP.
Use this code instead

Code:Select all

/ip/firewall/nat/add chain=srcnat action=masquerade src-address=!127.0.0.1 log=no

or you can also define masquerading rule separately for each subnet for added security.
Took me 2 hours to solve this issue. posting here to help others.

And help you did. Kudos. Found this thread while debugging timeout from LOG.