Skip to content

MikroTik guide: document full Passpoint / Interworking profile #2078

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
odolan-rgb wants to merge 1 commit into
base: main
Choose a base branch
from
Open

MikroTik guide: document full Passpoint / Interworking profile #2078

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 76 additions & 1 deletion docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,10 @@ the NAS-ID provided during Helium Plus onboarding.

#### Interworking Tab

Fill in as shown:
The Interworking (Passpoint / Hotspot 2.0) profile is what advertises the Helium
realms and carrier network identifiers over ANQP. If this profile is incomplete, handsets
will see the SSID but silently fail to associate — so make sure the domain names, NAI realms,
and 3GPP cellular network information below are all present.

<figure className="screensnippet-wrapper">
<img
Expand All @@ -145,6 +148,78 @@ Fill in as shown:
/>
</figure>

Fill in the profile as follows:

| Field | Value |
| --------------------------- | --------------------------------------------------------- |
| **ANQP Domain ID** | `0` |
| **Network Type** | `2` (chargeable public network), access to internet |
| **Operator Name** | `Helium-Operator` (language code `eng`) |
| **IP Address Type** | IPv4 available (`ip-type ipv4 2`), IPv6 not available |
| **Domain Names** | `freedomfi.com`, `hellohelium.com` |

**NAI Realms** — the Helium-issued credentials use EAP-TLS (`13`); the SIM-based carrier
realms use EAP-AKA (`23`):

| Realm | EAP method |
| -------------------------------------- | ------------ |
| `freedomfi.com` | `13` EAP-TLS |
| `hellohelium.com` | `13` EAP-TLS |
| `wlan.mnc260.mcc310.3gppnetwork.org` | `23` EAP-AKA |
| `wlan.mnc530.mcc312.3gppnetwork.org` | `23` EAP-AKA |
| `wlan.mnc120.mcc310.3gppnetwork.org` | `23` EAP-AKA |
| `wlan.mnc240.mcc310.3gppnetwork.org` | `23` EAP-AKA |

**3GPP Cellular Network Information** (PLMN, MCC / MNC):

| MCC | MNC |
| ----- | ----- |
| `310` | `410` |
| `310` | `280` |
| `310` | `150` |
| `313` | `100` |

##### Equivalent RouterOS CLI

The same profile can be applied from the CLI. This is a known-good Helium Passpoint profile —
substitute your onboarding `NAS-Identifier` on the `aaa attribute` line:

```
hotspot profile Helium-profile
hotspot profile Helium-profile anqp-domain-id 0
hotspot profile Helium-profile network-type 2 access-internet
hotspot profile Helium-profile operator-name Helium-Operator language-code eng
hotspot profile Helium-profile ip-type ipv4 2 ipv6 0
hotspot profile Helium-profile domain-name freedomfi.com
hotspot profile Helium-profile domain-name hellohelium.com
hotspot profile Helium-profile nai-realm freedomfi.com encoding-type 0
hotspot profile Helium-profile nai-realm freedomfi.com eap-method 13
hotspot profile Helium-profile nai-realm hellohelium.com encoding-type 0
hotspot profile Helium-profile nai-realm hellohelium.com eap-method 13
hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org encoding-type 0
hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org eap-method 23
hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org encoding-type 0
hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org eap-method 23
hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org encoding-type 0
hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org eap-method 23
hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org encoding-type 0
hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org eap-method 23
hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 410
hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 280
hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 150
hotspot profile Helium-profile 3gpp-plmn mcc 313 mnc 100
security-object Helium security protocol-suite wpa3-aes-8021x
aaa attribute NAS-Identifier <your-nas-id>
ssid Helium hotspot-profile Helium-profile
save configuration
```

:::note Native RadSec + Orion Wi-Fi
Newer RouterOS releases support RadSec natively (removing the need for the RadSecProxy
container in step 1) and document the matching Passpoint / Orion Wi-Fi setup. See MikroTik's
[Interworking Profiles — Configuration guide using native RadSec and Orion Wi-Fi](https://help.mikrotik.com/docs/spaces/ROS/pages/7962628/Interworking+Profiles#InterworkingProfiles-ConfigurationguideusingnativeRadSecandOrionWifi).
:::

### 4. Attach the Profile to an Interface

Assign the configuration profile to the desired WiFi interface. Either click **New** (this will
Expand Down