MikroTik Wi‑Fi6 Interworking (Hotspot 2.0) sozlamasi

⏱ O‘qish vaqti: 2 daqiqa

Qisqacha

CA sertifikatini import qilasiz
Server sertifikati va kalitini yuklaysiz
RADIUS serverini qo‘shib, Wi‑Fi xavfsizlik profilini yaratishingiz
Interworking profilini sozlab, Wi‑Fi interfeysiga biriktirasiz
Sozlamalar to‘g‘ri ishlashini tekshirasiz

Wi‑Fi6 tarmoqlarida foydalanuvchilar ko‘proq ma’lumotga asoslangan AP tanlashni xohlashadi. IEEE 802.11u va Hotspot 2.0 standartlari bu maqsadga erishish uchun interworking elementlarini qo‘llab‑quvvatlaydi. MikroTik RouterOS’da bu funksiyalarni to‘liq yoqish uchun bir necha bosqichli konfiguratsiya kerak.

Talablar

MikroTik routerda wifi‑qcom paketi o‘rnatilgan
RADIUS serverga ulanish uchun sertifikat fayllari mavjud
RouterOS’da administrator huquqi

Sozlash bosqichlari

1. CA sertifikatini import qilish

CA sertifikatini tizimga kiritish uchun quyidagi buyruqni bajarish kifoya. Bu sertifikat RADIUS serveri bilan TLS aloqasini ta’minlaydi.

/certificate import file-name=bw.radsec.cacert.pem passphrase=""

2. Server sertifikati va kalitini import qilish

Server sertifikati va uning maxfiy kalitini alohida import qilamiz. Sertifikat va kalit mos kelishi muhim, aks holda RADIUS autentifikatsiyasi muvaffaqiyatsiz bo‘ladi.

/certificate import file-name=cert.pem passphrase=""

3. Kalitni import qilish

Server kalitini import qilish uchun quyidagi buyruqni ishlating. Kalitni import qilgandan so‘ng u sertifikat bilan birga ko‘rsatiladi.

/certificate import file-name=key.pem passphrase=""

4. Sertifikatlarni tekshirish

Import qilingan sertifikatlar ro‘yxatini ko‘rib, ularning holatini tasdiqlang. Keltirilgan buyruq barcha import qilingan sertifikatlarni ko‘rsatadi.

[admin@MikroTik] > /certificate/print
Flags: K - PRIVATE-KEY; T - TRUSTED
Columns: NAME, COMMON-NAME, SUBJECT-ALT-NAME, SKID
#    NAME                    COMMON-NAME                                      SUBJECT-ALT-NAME                                     SKID                                    
0  T bw.radsec.cacert.pem_0  Buttonwood Radsec CA                                                                                  XXYYXXYYXXYYXXYYXXYYXXYYXXYYXXYYXXYYXXY
1 KT cert.pem_0              xxxxx.yyyyyyyyyyyyyyyyyyy.orion.area120.com  DNS:xxxxx.yyyyyyyyyyyyyyyyyyy.orion.area120.com

5. RADIUS serverini qo‘shish

RADIUS serverini radsec protokoli bilan, sertifikatga asoslangan autentifikatsiya uchun qo‘shamiz. Bu qadam interworking xizmatini xavfsiz qilish uchun zarur.

/radius
add address=216.239.32.91 certificate=cert.pem_0 protocol=radsec radsec-timeout=1s500ms service=wireless

6. Wi‑Fi xavfsizlik profilini yaratish

WPA2‑EAP asosida xavfsizlik profilini yaratamiz. Profilda eap-accounting=yes va management-protection=allowed sozlamalari mavjud.

/interface wifi security
add authentication-types=wpa2-eap disabled=no eap-accounting=yes management-protection=allowed name=orion_password_profile wps=disable

7. Interworking profilini yaratish

Interworking elementlarini belgilab, Hotspot 2.0 ni yoqamiz. Profilda network-type=public-chargeable, internet=yes, venue=business-unspecified kabi parametrlar kiritilgan.

/interface wifi interworking
add disabled=no domain-names=orion.area120.com hotspot20=yes hotspot20-dgaf=yes internet=yes ipv4-availability=public ipv6-availability=not-available name=interworking network-type=public-chargeable operator-names=Orion:eng \
    realms=orion.area120.com:eap-tls roaming-ois=f4f5e8f5f4,baa2D00100,baa2d00000 venue=business-unspecified venue-names=Orion:eng wan-downlink=50 wan-status=up wan-uplink=50

8. Profilni Wi‑Fi interfeysiga biriktirish

Yaratilgan interworking profilini Wi‑Fi interfeysiga qo‘shamiz, shu bilan birga SSID, mamlakat va xavfsizlik profilini ham belgilaymiz.

/interface wifi
set [ find default-name=wifi1 ] configuration.country=Latvia .mode=ap .ssid=Orion disabled=no interworking=interworking security=orion_password_profile

Tekshirish

interworking=interworking qiymati interfeys sozlamalarida ko‘rinadi.

/interface wifi
set [ find default-name=wifi1 ] configuration.country=Latvia .mode=ap .ssid=Orion disabled=no interworking=interworking security=orion_password_profile

Diqqat:

Sertifikat fayllari to‘g‘ri formatda bo‘lishi kerak
RADIUS server manzili va sertifikat nomi mos kelishi zarur
Interworking profilidagi venue va network-type qiymatlari tarmoq maqsadiga mos bo‘lishi kerak

Xulosa

Interworking va Hotspot 2.0 ni sozlash orqali Wi‑Fi6 tarmog‘ingiz foydalanuvchilarga yanada aniq va xavfsiz ulanish imkoniyatini beradi. Sertifikat va RADIUS konfiguratsiyasiga e’tibor berish muhim.

Manba: Interworking for WiFi6 — help.mikrotik.com