MikroTik / RouterOS · Security · July 2026

MikroTik
802.1X Port Authentication

A network jack in a hotel lobby or a shared office is an open door — anyone can plug in and they're on your LAN. 802.1X shuts that door: the port stays dead until the device proves who it is against RADIUS. RouterOS 7 gained a proper dot1x server to do exactly this. The Cisco 802.1X post, in RouterOS.

MikroTik RouterOS 802.1X RADIUS NAC

Everything else in the security posts assumes the attacker is remote. 802.1X addresses the one who walked in: a physical port that grants network access to whatever's plugged in. Port-based authentication flips the default — a port passes no traffic (except the authentication exchange itself) until the connected device, the supplicant, authenticates through the switch (the authenticator) to a RADIUS server. Pass, and the port opens, optionally into a VLAN RADIUS assigns; fail, and it stays closed or drops into a locked-down guest VLAN.

RouterOS 7 implements both roles — a dot1x server (authenticator) on switch ports, and a dot1x client (supplicant) for a MikroTik that itself needs to authenticate onto someone else's secured port. The model and the RADIUS plumbing match Cisco IOS: 802.1X Port Authentication; the must-have detail is a graceful fallback for the printer that can't speak 802.1X.

Prerequisites

A RADIUS server (FreeRADIUS, NPS, or similar) reachable from the switch
VLANs configured, including a locked-down guest/reject VLAN

Point RouterOS at RADIUS

First tell the switch where to send authentication requests and the shared secret that trusts it. The dot1x service is the consumer.

Terminal — RADIUS client for the dot1x service

> /radius add service=dot1x address=10.10.99.20 secret="radius-shared-secret" \
    timeout=1s
# Optional but wise: let RADIUS also drive incoming CoA/disconnect.
> /radius incoming set accept=yes

Enable the dot1x Server on the Ports

Turn each untrusted access port into an authenticator. Until a supplicant authenticates, the port carries nothing but EAP.

Terminal — dot1x server on a lobby/access port

> /interface dot1x server add interface=ether3 \
    auth-types=dot1x \
    reject-vlan-id=999 \
    interim-update=5m
# reject-vlan-id=999 = the locked-down guest VLAN for anyone who fails
# or never tries. Repeat per untrusted access port.
> /interface dot1x server monitor ether3
     status: authenticated
       user: alice@corp

The Fallback — MAC-Auth Bypass

Printers, cameras, badge readers and old VoIP phones can't run an 802.1X supplicant. Without a fallback, 802.1X locks out exactly the devices you most want on a controlled VLAN. MAC-auth bypass lets RADIUS authorise them by hardware address.

Terminal — allow MAC-auth alongside dot1x

# Try 802.1X first; if the device stays silent, fall back to
# authenticating its MAC address as the username against RADIUS.
> /interface dot1x server set [find interface=ether3] \
    auth-types=dot1x,mac-auth \
    mac-auth-mode=mac-as-username
# RADIUS holds the allow-list of known device MACs and the VLAN each
# belongs in — so the NVR lands on the CCTV VLAN automatically.

⚠ Gotcha — MAC-Auth Is a Fallback, Not a Peer of 802.1X

A MAC address is trivially spoofable — an attacker who unplugs the lobby printer can clone its MAC and inherit its access. MAC-auth bypass is a pragmatic exception for devices that can't do better, not equivalent security. Keep the MAC allow-list tight, put MAC-authed devices on the most restricted VLAN their function allows, and never MAC-bypass a port that could reach sensitive segments. Real 802.1X with certificates is the goal; MAB is the compromise.

When the Switch Is the Supplicant

The mirror case: your MikroTik plugs into a port secured by someone else (a corporate uplink, a campus jack). Then RouterOS runs the dot1x client and authenticates itself.

Terminal — dot1x client (supplicant) on an uplink

> /interface dot1x client add interface=ether1 \
    identity="site-rtr@corp" password="supplicant-secret" \
    eap-methods=eap-peap
> /interface dot1x client monitor ether1   # status: authenticated

Takeaways

802.1X secures the physical layer — a jack grants nothing until the device authenticates. The defence against whoever walks in.
Three roles: supplicant (device), authenticator (the RouterOS port), RADIUS (the decision). RouterOS 7 can be authenticator or supplicant.
Point the dot1x service at RADIUS, then enable the server per untrusted access port with a reject VLAN for failures.
MAC-auth bypass rescues devices that can't do 802.1X — but MACs spoof, so treat it as a tight, low-privilege exception.
RADIUS can assign the VLAN, so a device lands in the right segment automatically on authentication.
A MikroTik can be the supplicant too when it plugs into someone else's secured port.

Open network jacks in public areas of your business?

NOCTIS deploys 802.1X and network access control on MikroTik and Cisco across Crete — RADIUS-backed port authentication with sane fallbacks — so a lobby port is no longer a way onto your LAN.

Book a Discovery Call →