From 9e2abdf64622543aff295e838f6cef3bfc135304 Mon Sep 17 00:00:00 2001 From: Oliver Dolan Date: Mon, 20 Jul 2026 19:41:35 +0200 Subject: [PATCH] MikroTik guide: document full Passpoint/Interworking profile The Interworking Tab section previously said only 'Fill in as shown' with a screenshot, omitting the ANQP domains, NAI realms, and 3GPP PLMN values that the Passpoint profile must advertise. An incomplete profile lets handsets see the SSID but silently fail to associate (e.g. Orion/WeFi devices not connecting on deployments that otherwise work for HMHs). Document the known-good profile as both GUI fields and the equivalent RouterOS CLI, and link MikroTik's native RadSec + Orion Wi-Fi guide. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../helium-plus-mikrotik.mdx | 77 ++++++++++++++++++- 1 file changed, 76 insertions(+), 1 deletion(-) diff --git a/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx b/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx index 11f2fe46e..6bf1527eb 100644 --- a/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx +++ b/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx @@ -135,7 +135,10 @@ the NAS-ID provided during Helium Plus onboarding. #### Interworking Tab -Fill in as shown: +The Interworking (Passpoint / Hotspot 2.0) profile is what advertises the Helium +realms and carrier network identifiers over ANQP. If this profile is incomplete, handsets +will see the SSID but silently fail to associate — so make sure the domain names, NAI realms, +and 3GPP cellular network information below are all present.
+Fill in the profile as follows: + +| Field | Value | +| --------------------------- | --------------------------------------------------------- | +| **ANQP Domain ID** | `0` | +| **Network Type** | `2` (chargeable public network), access to internet | +| **Operator Name** | `Helium-Operator` (language code `eng`) | +| **IP Address Type** | IPv4 available (`ip-type ipv4 2`), IPv6 not available | +| **Domain Names** | `freedomfi.com`, `hellohelium.com` | + +**NAI Realms** — the Helium-issued credentials use EAP-TLS (`13`); the SIM-based carrier +realms use EAP-AKA (`23`): + +| Realm | EAP method | +| -------------------------------------- | ------------ | +| `freedomfi.com` | `13` EAP-TLS | +| `hellohelium.com` | `13` EAP-TLS | +| `wlan.mnc260.mcc310.3gppnetwork.org` | `23` EAP-AKA | +| `wlan.mnc530.mcc312.3gppnetwork.org` | `23` EAP-AKA | +| `wlan.mnc120.mcc310.3gppnetwork.org` | `23` EAP-AKA | +| `wlan.mnc240.mcc310.3gppnetwork.org` | `23` EAP-AKA | + +**3GPP Cellular Network Information** (PLMN, MCC / MNC): + +| MCC | MNC | +| ----- | ----- | +| `310` | `410` | +| `310` | `280` | +| `310` | `150` | +| `313` | `100` | + +##### Equivalent RouterOS CLI + +The same profile can be applied from the CLI. This is a known-good Helium Passpoint profile — +substitute your onboarding `NAS-Identifier` on the `aaa attribute` line: + +``` +hotspot profile Helium-profile +hotspot profile Helium-profile anqp-domain-id 0 +hotspot profile Helium-profile network-type 2 access-internet +hotspot profile Helium-profile operator-name Helium-Operator language-code eng +hotspot profile Helium-profile ip-type ipv4 2 ipv6 0 +hotspot profile Helium-profile domain-name freedomfi.com +hotspot profile Helium-profile domain-name hellohelium.com +hotspot profile Helium-profile nai-realm freedomfi.com encoding-type 0 +hotspot profile Helium-profile nai-realm freedomfi.com eap-method 13 +hotspot profile Helium-profile nai-realm hellohelium.com encoding-type 0 +hotspot profile Helium-profile nai-realm hellohelium.com eap-method 13 +hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org encoding-type 0 +hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org eap-method 23 +hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org encoding-type 0 +hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org eap-method 23 +hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org encoding-type 0 +hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org eap-method 23 +hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org encoding-type 0 +hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org eap-method 23 +hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 410 +hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 280 +hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 150 +hotspot profile Helium-profile 3gpp-plmn mcc 313 mnc 100 +security-object Helium security protocol-suite wpa3-aes-8021x +aaa attribute NAS-Identifier +ssid Helium hotspot-profile Helium-profile +save configuration +``` + +:::note Native RadSec + Orion Wi-Fi +Newer RouterOS releases support RadSec natively (removing the need for the RadSecProxy +container in step 1) and document the matching Passpoint / Orion Wi-Fi setup. See MikroTik's +[Interworking Profiles — Configuration guide using native RadSec and Orion Wi-Fi](https://help.mikrotik.com/docs/spaces/ROS/pages/7962628/Interworking+Profiles#InterworkingProfiles-ConfigurationguideusingnativeRadSecandOrionWifi). +::: + ### 4. Attach the Profile to an Interface Assign the configuration profile to the desired WiFi interface. Either click **New** (this will