Mikrotik RouterOS 7.x Wireless Dynamic VLAN Assignment - Working Configuration ~ Vesselin Kolev's Tech Corner

Overview

This document provides the complete working configuration for dynamic VLAN assignment on Mikrotik RouterOS 7.x wireless access points using RADIUS authentication with EAP-TLS (certificate-based authentication).

Must Have RADIUS Attribute: RouterOS 7.x requires the Mikrotik-Wireless-VLANID RADIUS attribute for wireless dynamic VLAN assignment to work properly.

Authentication Method: EAP-TLS using client certificates with UPN (User Principal Name) in the Subject Alternative Name field.

Network Architecture: Mikrotik acts as a wireless access point only. DHCP services are provided by a remote server, not by the Mikrotik router.

X.509 Certificate User Identification

In modern PKI (Public Key Infrastructure) setups, X.509v3 certificates identify users through specific certificate fields that contain user identity information. The most common methods are:

Important Note: Using the Common Name (CN) or other X.500 subject fields for user identification is considered outdated and deprecated in modern PKI deployments. RFC 5280 and subsequent standards recommend using Subject Alternative Name (SAN) extensions for identity information.

Why CN is Deprecated: - Limited scope: CN can only contain a single identity value - Ambiguity: CN doesn’t specify the type of identity (user, host, service) - Security concerns: CN validation is less strict than SAN validation - Modern standards: RFC 5280, RFC 6125, and RFC 8399 mandate SAN usage - Browser deprecation: Modern browsers no longer trust CN for hostname validation

User Principal Name (UPN)

The User Principal Name (UPN) is the primary method for user identification in enterprise environments. It follows the format username@domain.com and is stored in the certificate’s Subject Alternative Name (SAN) extension.

Certificate Field Location:

Subject Alternative Name:
    otherName: 1.3.6.1.4.1.311.20.2.3 (UPN)
    Email: user@domain.com

Example UPN in Certificate:

X509v3 Subject Alternative Name:
    otherName: 1.3.6.1.4.1.311.20.2.3, SEQUENCE:UTF8String:userA@company.com

Email Address in Subject Alternative Name

Alternatively, user identification can be based on the email address field in the Subject Alternative Name extension.

Certificate Field Location:

Subject Alternative Name:
    Email: user@domain.com  ← Used for user identification

How RADIUS Uses Certificate Identity

During EAP-TLS authentication:

Client presents certificate to the RADIUS server
RADIUS extracts user identity from either:
- UPN in the SAN extension (preferred)
- Email address in the SAN extension (fallback)
RADIUS maps the identity to VLAN assignment rules
RADIUS returns VLAN attributes based on the user identity

Example RADIUS Processing:

Certificate UPN: userA@company.com
↓
RADIUS looks up userA@company.com in user database
↓
RADIUS finds VLAN assignment: VLAN 1812
↓
RADIUS returns: Tunnel-Private-Group-Id = 1812

Certificate Requirements for Dynamic VLAN Assignment

For proper dynamic VLAN assignment, client certificates must contain:

Valid UPN or email address in the Subject Alternative Name extension
Proper certificate chain trusted by the RADIUS server
Valid certificate dates (not expired, not future-dated)
Appropriate key usage (digital signature, key encipherment)

Comparison: Old vs Modern Certificate Identity

Old Approach (Deprecated):

Subject: CN=userA, OU=IT, O=Company, C=US

Uses Common Name (CN) from subject field
Limited to single identity value
No type specification
Not recommended for modern deployments

Modern Approach (Recommended):

Subject: CN=userA, OU=IT, O=Company, C=US
X509v3 Subject Alternative Name:
    otherName: 1.3.6.1.4.1.311.20.2.3, SEQUENCE:UTF8String:userA@company.com
    Email: userA@company.com

Uses Subject Alternative Name (SAN) extension
Supports multiple identity types
Clear type specification (UPN, email)
Compliant with modern PKI standards

Network Architecture Diagram

┌─────────────────────────────────────────────────────────┐
│                    CLIENT A PATH (VLAN 1812)            │
└─────────────────────────────────────────────────────────┘

┌─────────────┐
│  Client A   │
│(EAP-TLS)    │
│userA@...    │
└─────┬───────┘
      │ 802.11
      ▼
┌─────────────┐
│ Mikrotik AP │
│RouterOS 7.x │
│ ┌─────────┐ │ ← RADIUS assigns VLAN 1812
│ │ wlan1/2 │ │   based on userA@domain.com
│ └───┬─────┘ │
│ ┌───▼─────┐ │ ← VLAN filtering enabled
│ │ bridge  │ │   ingress-filtering=no
│ └───┬─────┘ │
└─────┼───────┘
      │ 802.1Q VLAN 1812
      ▼
┌─────────────┐
│  Upstream   │
│Switch/Router│
│(Trunk Port) │
└─────┬───────┘
      │ VLAN 1812
      ▼
┌─────────────┐
│ Remote DHCP │
│Server VLAN  │
│192.168.44.x │
└─────────────┘

┌─────────────────────────────────────────────────────────┐
│                    CLIENT B PATH (VLAN 2000)            │
└─────────────────────────────────────────────────────────┘

┌─────────────┐
│  Client B   │
│(EAP-TLS)    │
│userB@...    │
└─────┬───────┘
      │ 802.11
      ▼
┌─────────────┐
│ Mikrotik AP │
│RouterOS 7.x │
│ ┌─────────┐ │ ← RADIUS assigns VLAN 2000
│ │ wlan1/2 │ │   based on userB@domain.com
│ └───┬─────┘ │
│ ┌───▼─────┐ │ ← VLAN filtering enabled
│ │ bridge  │ │   ingress-filtering=no
│ └───┬─────┘ │
└─────┼───────┘
      │ 802.1Q VLAN 2000
      ▼
┌─────────────┐
│  Upstream   │
│Switch/Router│
│(Trunk Port) │
└─────┬───────┘
      │ VLAN 2000
      ▼
┌─────────────┐
│ Remote DHCP │
│Server VLAN  │
│192.168.55.x │
└─────────────┘

┌─────────────────────────────────────────────────────────┐
│                  SHARED INFRASTRUCTURE                  │
└─────────────────────────────────────────────────────────┘

                ┌─────────────┐
                │ FreeRADIUS  │
                │   Server    │
                │ ┌─────────┐ │ ← Processes certificate UPN
                │ │ EAP-TLS │ │   Returns VLAN attributes
                │ └─────────┘ │
                │ ┌─────────┐ │ ← Adds Mikrotik-Wireless-VLANID
                │ │Post-Auth│ │   attribute for RouterOS 7.x
                │ └─────────┘ │
                └─────────────┘

VLAN Assignment Flow

Client A (userA@domain.com):
1. Client A connects with EAP-TLS certificate
   └── Certificate contains UPN: userA@domain.com

2. Mikrotik sends RADIUS request to FreeRADIUS
   └── Includes certificate UPN: userA@domain.com

3. FreeRADIUS processes UPN and returns:
   └── Tunnel-Type = VLAN
   └── Tunnel-Medium-Type = IEEE-802  
   └── Tunnel-Private-Group-Id = 1812
   └── Mikrotik-Wireless-VLANID = 1812  ← REQUIRED for RouterOS 7.x

4. Mikrotik assigns Client A to VLAN 1812
   └── Client A traffic is tagged with VLAN 1812
   └── Sent to upstream switch via trunk port

5. Upstream switch routes VLAN 1812 traffic
   └── To remote DHCP server for VLAN 1812
   └── Client A gets IP from 192.168.44.x subnet

Client B (userB@domain.com):
1. Client B connects with EAP-TLS certificate
   └── Certificate contains UPN: userB@domain.com

2. Mikrotik sends RADIUS request to FreeRADIUS
   └── Includes certificate UPN: userB@domain.com

3. FreeRADIUS processes UPN and returns:
   └── Tunnel-Type = VLAN
   └── Tunnel-Medium-Type = IEEE-802  
   └── Tunnel-Private-Group-Id = 2000
   └── Mikrotik-Wireless-VLANID = 2000  ← REQUIRED for RouterOS 7.x

4. Mikrotik assigns Client B to VLAN 2000
   └── Client B traffic is tagged with VLAN 2000
   └── Sent to upstream switch via trunk port

5. Upstream switch routes VLAN 2000 traffic
   └── To remote DHCP server for VLAN 2000
   └── Client B gets IP from 192.168.55.x subnet

Prerequisites

RouterOS 7.x with classic wireless package (not wifiwave2)
FreeRADIUS server configured for EAP-TLS authentication
Client certificates properly configured and trusted by RADIUS server
RADIUS server must send Mikrotik-Wireless-VLANID attribute
Upstream switch/router with VLAN trunking configured
Remote DHCP server (not local to Mikrotik) configured for each VLAN subnet

Complete RouterOS Configuration

1. Bridge Configuration

/interface bridge
add admin-mac=AA:BB:CC:DD:EE:FF auto-mac=no comment=defconf name=bridge vlan-filtering=yes ingress-filtering=no

Critical Settings: - vlan-filtering=yes - Enables VLAN filtering - ingress-filtering=no - REQUIRED for dynamic VLAN assignment in RouterOS 7.x - frame-types=admit-all - Allows all frame types

2. VLAN Interfaces

/interface vlan
add interface=bridge name=vlan1812 vlan-id=1812
add interface=bridge name=vlan2000 vlan-id=2000

3. Wireless Security Profile

/interface wireless security-profiles
add authentication-types=wpa2-eap,wpa3-eap comment=EAP-RADIUS-SECURITY disabled=no encryption=tkip,gcmp,gcmp-256 name=EAP-RADIUS-SECURITY

4. Wireless Interfaces

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX comment=wpa-enterprise-2GHz country=bulgaria disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=EAP-RADIUS-SECURITY ssid=wpa-enterprise vlan-mode=use-tag wireless-protocol=802.11 wps-mode=disabled

set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX comment=wpa-enterprise-5GHz country=bulgaria disabled=no distance=indoors frequency=auto installation=outdoor mode=ap-bridge security-profile=EAP-RADIUS-SECURITY ssid=wpa-enterprise vlan-mode=use-tag wireless-protocol=802.11 wps-mode=disabled

Critical Settings: - vlan-mode=use-tag - Enables dynamic VLAN assignment - security-profile=EAP-RADIUS-SECURITY - Uses EAP-RADIUS authentication

5. Bridge Ports

/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=wpa-enterprise-2GHz interface=wlan1
add bridge=bridge comment=wpa-enterprise-5GHz interface=wlan2
add bridge=bridge comment=ether1/upstream interface=ether1

6. Bridge VLAN Table

/interface bridge vlan
add bridge=bridge tagged=ether1,bridge,wlan1,wlan2 vlan-ids=1812
add bridge=bridge tagged=ether1,bridge,wlan1,wlan2 vlan-ids=2000

Critical Settings: - Wireless interfaces (wlan1, wlan2) must be tagged (not untagged) - All interfaces that need dynamic VLAN assignment must be in the tagged list

7. RADIUS Configuration

/radius
add address=192.168.0.254 comment=192.168.0.254 service=wireless

Critical Settings: - service=wireless - Required for wireless VLAN assignment - Ensure RADIUS secret matches on both sides

8. Bridge Port Settings (Automatic)

The bridge ports will automatically have these settings: - pvid=1 - Default VLAN ID - frame-types=admit-all - Allows all frame types - ingress-filtering=yes - Per-port ingress filtering

Verification Commands

1. Check Bridge Configuration

/interface bridge print detail

Expected Output:

name="bridge" vlan-filtering=yes ingress-filtering=no frame-types=admit-all

2. Check Bridge VLAN Table

/interface bridge vlan print

Expected Output:

#   BRIDGE  VLAN-IDS  CURRENT-TAGGED         CURRENT-UNTAGGED
1   bridge  1812      bridge,ether1,wlan1,wlan2
2   bridge  2000      bridge,ether1,wlan1,wlan2

3. Check Wireless Registration Table

/interface wireless registration-table print

Expected Output:

Columns: INTERFACE, MAC-ADDRESS, AP, SIGNAL-STRENGTH, TX-RATE, UPTIME
#  INTERFACE  MAC-ADDRESS        AP  SIGNAL-STRENGTH  TX-RATE  UPTIME
0  wlan1      9C:EF:D5:FB:DB:62  no  -27dBm@HT20-0    1Mbps    7s

Important: This command shows connected clients but does NOT display VLAN assignment information. The VLAN assignment happens transparently in the background. Do not expect to see a VLAN-ID column or VLAN information in this output - this is normal behavior for RouterOS 7.x.

4. Check RADIUS Configuration

/radius print

Expected Output:

# SERVICE   ADDRESS        SECRET
0 wireless  192.168.0.254  test123

5. Verify Dynamic VLAN Assignment

Important: The /interface wireless registration-table print command does NOT show VLAN information in RouterOS 7.x. This is normal behavior - do not expect to see VLAN-ID columns or VLAN assignment details in this output.

To verify dynamic VLAN assignment is working:

Check client IP address - Client should get IP from the assigned VLAN subnet (provided by remote DHCP server)
Check upstream switch/router - Verify traffic is tagged with correct VLAN
Monitor FreeRADIUS logs - Confirm Mikrotik-Wireless-VLANID is being sent
Test connectivity - Client should only reach resources in assigned VLAN

Troubleshooting

Issue: Client Gets IP from Wrong VLAN

Symptoms: Client connects successfully but gets IP from default VLAN instead of assigned VLAN.

Solution: Ensure RADIUS is sending Mikrotik-Wireless-VLANID attribute and check upstream switch port trunking configuration.

Issue: DHCP Server Not Responding

Symptoms: Client connects but cannot get an IP address.

Solution: Check upstream switch port trunking and remote DHCP server configuration for the assigned VLAN. Verify the remote DHCP server is listening on the correct VLAN and has available IP addresses.

Issue: Authentication Fails

Symptoms: Client cannot authenticate at all.

Solution: Check RADIUS server connectivity and EAP-TLS certificate configuration. Verify client certificates are valid and trusted by the RADIUS server.

Common Mistakes

Missing ingress-filtering=no on bridge - Required for dynamic VLANs
Wireless interfaces as untagged in bridge VLAN table - Must be tagged
Missing Mikrotik-Wireless-VLANID in RADIUS reply - Required for RouterOS 7.x
Wrong RADIUS service - Must be service=wireless
Wrong vlan-mode - Must be vlan-mode=use-tag

RouterOS Version Compatibility

RouterOS 6.x: Works with standard RADIUS attributes only
RouterOS 7.x: Requires Mikrotik-Wireless-VLANID attribute
wifiwave2 package: Does not support dynamic VLAN assignment

Summary

The key to making wireless dynamic VLAN assignment work in RouterOS 7.x is:

Correct bridge configuration with ingress-filtering=no
Wireless interfaces as tagged in bridge VLAN table
RADIUS sending Mikrotik-Wireless-VLANID attribute
Proper wireless interface configuration with vlan-mode=use-tag

This configuration has been tested and verified to work with RouterOS 7.19.2 and FreeRADIUS with EAP-TLS authentication.

Categories: 802.1x, EAP-TLS, Mikrotik, Mikrotik-Wireless-VLANID, RADIUS, RouterOS, SubjectAlternativeName, UPN, VLAN ID, WiFi, X.509v3

Vesselin Kolev's Tech Corner

About

Categories