Skip to main content

MikroTik - Passpoint Configuration

Configure Passpoint (Hotspot 2.0) on MikroTik RouterOS devices to enable automatic WiFi authentication through IronWifi's cloud RADIUS service. This provides seamless WPA2/WPA3-Enterprise connections without manual network selection or splash pages.

Prerequisites​

In MikroTik:​

  • MikroTik device with wireless capability supporting 802.11u
  • RouterOS 6.47.10+ or 6.48.3+ (for GUI support)
  • RouterOS 7.x recommended for latest features

In IronWifi Console (complete these first):​

  1. Sign in to the IronWifi Management Console
  2. Go to Networks and select your network
  3. Enable Passpoint from the dropdown
  4. Note the following values:
    • RADIUS server IP
    • RADIUS port
    • RADIUS secret
    • Realm (e.g., ironwifi.com)

RouterOS Version Requirements​

FeatureMinimum Version
802.11u basicRouterOS 6.0+
Interworking GUIRouterOS 6.47.10+
Full PasspointRouterOS 7.x

RADIUS Configuration​

Configure the RADIUS server in RouterOS:

/radius
add address=<RADIUS_IP> authentication-port=1812 accounting-port=1813 \
    secret=<RADIUS_SECRET> service=wireless

Replace:

  • <RADIUS_IP> - IronWifi RADIUS server address
  • <RADIUS_SECRET> - Your RADIUS shared secret

Wireless Security Profile​

Create a security profile for WPA2-Enterprise:

/interface wireless security-profiles
add name=passpoint-profile authentication-types=wpa2-eap \
    mode=dynamic-keys eap-methods=passthrough \
    tls-mode=no-certificates

802.11u / Interworking Configuration​

RouterOS 7.x (CLI)​

/interface wireless interworking-profile
add name=passpoint-profile \
    access-network-type=free-public-network \
    internet=yes \
    asra=no \
    esr=no \
    uesa=no \
    venue-group=business \
    venue-type=unspecified-business \
    hessid=auto \
    network-auth-type=acceptance-of-terms-and-conditions \
    ipv4-availability=public \
    ipv6-availability=not-available

Hotspot 2.0 (HS2.0) Settings​

/interface wireless hs20-profile
add name=hs20-profile \
    domain-names=ironwifi.net \
    operator-names="IronWifi:eng" \
    wan-metrics="symmetric,1,50000,50000,0,0" \
    connection-capabilities="1:0:6,17:5060:0,50:0:0"

NAI Realm Configuration​

Configure the NAI Realm for authentication:

/interface wireless nai-realm
add profile=passpoint-profile \
    realm=ironwifi.com \
    eap-methods="eap-ttls:non-eap-pap,non-eap-mschapv2;eap-tls:"

Roaming Consortium (OIs)​

Add Roaming Consortium Organization Identifiers for OpenRoaming:

/interface wireless roaming-oi
add profile=passpoint-profile oi=5A03BA0000
add profile=passpoint-profile oi=004096

For OpenRoaming, add these OIs:

  • 5A03BA0000 - WBA OpenRoaming
  • 004096 - Cisco OpenRoaming
  • Standard IronWifi OI as provided in console

Apply to Wireless Interface​

Apply the configuration to your wireless interface:

/interface wireless
set wlan1 security-profile=passpoint-profile \
    interworking-profile=passpoint-profile \
    ssid="IronWifi-Passpoint"

Complete Configuration Example​

# RADIUS Server
/radius
add address=us-east1.ironwifi.com authentication-port=1812 \
    accounting-port=1813 secret=your-secret service=wireless

# Security Profile
/interface wireless security-profiles
add name=passpoint-profile authentication-types=wpa2-eap \
    mode=dynamic-keys eap-methods=passthrough

# Interworking Profile
/interface wireless interworking-profile
add name=passpoint-profile access-network-type=free-public-network \
    internet=yes venue-group=business venue-type=unspecified-business

# HS2.0 Profile
/interface wireless hs20-profile
add name=hs20-profile domain-names=ironwifi.net

# NAI Realm
/interface wireless nai-realm
add profile=passpoint-profile realm=ironwifi.com \
    eap-methods="eap-ttls:non-eap-pap;eap-tls:"

# Roaming OIs
/interface wireless roaming-oi
add profile=passpoint-profile oi=5A03BA0000

# Apply to interface
/interface wireless
set wlan1 mode=ap-bridge ssid="Passpoint-Network" \
    security-profile=passpoint-profile \
    interworking-profile=passpoint-profile

GUI Configuration (WinBox)​

For RouterOS versions with GUI support:

  1. Open WinBox and connect to your router
  2. Go to Wireless > Security Profiles
  3. Create new profile with WPA2-EAP settings
  4. Go to Wireless > Interworking Profiles
  5. Create new interworking profile
  6. Configure 802.11u settings
  7. Apply profiles to your wireless interface

Verification​

Check the configuration:

# View interworking profile
/interface wireless interworking-profile print

# View wireless interface status
/interface wireless print detail

# Check connected clients
/interface wireless registration-table print

# View RADIUS statistics
/radius print stats

Troubleshooting​

Clients Don't Discover Network​

  1. Verify 802.11u is enabled
  2. Check interworking profile is applied
  3. Ensure SSID is broadcasting
  4. Verify client supports Passpoint

Authentication Fails​

  1. Check RADIUS server connectivity
  2. Verify shared secret matches
  3. Review IronWifi authentication logs
  4. Ensure NAI realm is correct

Roaming Not Working​

  1. Verify roaming consortium OIs
  2. Check domain names match
  3. Ensure consistent configuration across APs