Encapto WiFi. Integration Guide. Mikrotik Routerboard Provisioning. For Release and above Document Version 7 PUBLIC DOCUMENT

Transcription

1 Encapto WiFi Integration Guide Mikrotik Routerboard Provisioning For Release and above Document Version 7 PUBLIC DOCUMENT

2 Contents 1. What you will need 3 2. Firewall configuration 4 3. Connecting up the network 4 4. Resetting the Default Configuration on the Mikrotik Login to the Mikrotik Router using Winbox Resetting the Mikrotik Router For New Out-of-the-box Mikrotik routers For previously configured Mikrotik routers Provisioning the router for Encapto Add DHCP client Confirm the Mikrotik has Internet Access Configure the Mikrotik Router to talk to the Encapto Provisioning Servers Checking the serial number in Mikrotik Accessing Mikrotik remotely once it s onsite 14 Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

3 Introduction This guide provides step-by-step instructions to configure a supported Mikrotik Routerboard as an Encapto Cloud Managed Gateway appliance and assumes the reader is familiar with the configuration of a Mikrotik Routerboard (Router OS/Winbox), which is outside the scope of this document. Recommended Mikrotik Router OS version is Encapto supported Mikrotik Router boards include: RB951XXX RB2011XXX RB3011XXX CCR10XXX except CCR1072 hap AC (Only compatible with Cloud Deck Version and higher) hap AC light* (Only compatible with Cloud Deck Version and higher) *not recommend if you are planning more than one network (including hotspot), and also recommended maximum concurrent user amount will be 10 or less due to insufficient RAM. 1. What you will need To set up your Mikrotik device you will require: A Windows PC directly connected to the new Mikrotik Router. DHCP based internet connectivity for the Mikrotik Router to communicate with Encapto Core. The Mikrotik Winbox application installed to the aforementioned Windows PC to perform the configuration. Winbox can be downloaded at Note: Encapto recommends that you to upgrade your router to Mikrotik Router OS version which can be found in Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

4 2. Firewall configuration You will need to configure the following ports in any firewall between the new Mikrotik router (WAN network) and the Encapto provision servers. Service Port Number Inbound/ Outbound VPN TCP 1723 GRE Protocol 47 Outbound DNS UDP 53 Outbound ICMP Outbound 3. Connecting up the network You will need to connect the Windows PC directly to the new Mikrotik Router using the last (rightmost from front) Ethernet port. Then connect Port 1 on the Mikrotik router to a DHCP enabled network with unrestricted internet access. This is essential to allow the new device to communicate with Encapto provisioning servers. This is shown in figure 1. below. Figure 1. Connecting up the network Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

5 4. Resetting the Default Configuration on the Mikrotik Regardless of whether the Mikrotik is new out-of-the-box or previously configured, a system reset MUST be performed according the instructions below. Warning: This will remove all configuration settings from the Mikrotik and return it to a basic configuration. You will lose any previous configuration settings Login to the Mikrotik Router using Winbox On your Windows PC, open the Winbox application (winbox.exe) downloaded earlier. 1. Click Neighbors in the Winbox window to will display the MAC address of the connected Mikrotik router. 2. Click on the MAC address of the router a. Login as admin and leave the password section blank (for brand new Mikrotik routers) 3. Click the Connect button. Figure 2: Winbox to Mikrotik router 4. Current Router OS version. Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

6 4.2. Resetting the Mikrotik Router For New Out-of-the-box Mikrotik routers You will be shown the following dialogue box at login. Click on Remove Configuration. Figure 3: Remove Configuration from out-of-the-box router After you click Remove Configuration you ll be disconnected from the Mikrotik router whilst it resets. Wait for around 30 seconds and the log back into the Mikrotik router as shown in Section 3.1 above to continue the provisioning in Section For previously configured Mikrotik routers Navigate to the system reset tool as below: 1. Click System in Winbox window. 2. Click Reset Configuration in menu list and the Reset dialogue will appear. 3. Check the No Default Configuration and Do Not Backup checkboxes. 4. Click Reset Configuration Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

7 Figure 4: Remove Configuration from previously configured router After you click Remove Configuration you ll be disconnected from the Mikrotik router whilst it resets. Wait for around 30 seconds and the log back into the Mikrotik router as shown in Section 3.1 above to continue the provisioning in Section 4. Note: Before proceed to next step, Encapto recommends that you to upgrade your router to Mikrotik Router OS version which can be found in Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

8 5. Provisioning the router for Encapto 5.1. Add DHCP client Once you log back in to the router, click on New Terminal and the Mikrotik command terminal will appear. Copy and Paste the following script into the terminal and hit enter. Note: To paste into the Mikrotik terminal you must right click and select paste. { /ip dhcp-client add interface=ether1 add-default-route=yes disabled=no /ip dns set servers= The following screenshot shows an example. Figure 5: Add DHCP Client Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

9 5.2. Confirm the Mikrotik has Internet Access The router should now have received an IP address on Ethernet Port 1 from the DHCP server on your network. You can Ping google.com to confirm the internet is working as below: 1. Click Tools 2. Click Ping and the Ping tool window will appear. 3. Type google.com In the Ping To field 4. Click start. Figure 6: Check Internet Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

10 5.3. Configure the Mikrotik Router to talk to the Encapto Provisioning Servers Once you ve confirmed Mikrotik Router has internet access, open a new terminal as previously described Section 5.1. Copy and Paste (using right click) the following script into the terminal and hit enter. There are three provisioning server regions for Encapto so it is important to use the correct one for your Encapto Cloud Deck region. WARNING: There are three provisioning server regions (.com,.co.uk,.net) for Encapto so it is important to use the correct one for your Encapto Cloud Deck region. Use the following script If your Cloud Deck URL ends in encapto.com { if ([:len [/file find type=disk]] > 0 && [:len [/file find name=flash]] > 0 ) do={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0dauhap \ password=enc@p70by0dau allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" else={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0dau \ password=enc@p70by0dau allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

11 Use the following script If your Cloud Deck URL ends in encapto.co.uk { if ([:len [/file find type=disk]] > 0 && [:len [/file find name=flash]] > 0 ) do={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0dukhap \ password=enc@p70by0duk allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" else={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0duk \ password=enc@p70by0duk allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

12 Use the following script If your Cloud Deck URL ends in encapto.net { if ([:len [/file find type=disk]] > 0 && [:len [/file find name=flash]] > 0 ) do={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0dushap \ password=enc@p70by0dus allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" else={ /interface pptp-client add name="pptp-encapto-byod" \ connect-to=byod.deployment.encapto.com user=enc@p70by0dus \ password=enc@p70by0dus allow=mschap1,mschap2 profile=default-encryption \ dial-on-demand=no add-default-route=no disabled=no comment="encapto BYOD \ VPN" The Mikrotik will now start the provisioning process and should complete in a few minutes. WARNING: YOU SHOULD NOT UNPLUG THE POWER CORD OR NETWORK CABLE DURING THE PROVISIONING PROCESS AS YOU MIGHT BRICK THE ROUTER. The Mikrotik will reboot itself several times during the provisioning process and you ll hear it beep when rebooting. When the Mikrotik is provisioned with Encapto it will play a happy little musical tune (not applicable for haps and any model that doesn t beep when it s booting up). Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

13 6. Checking the serial number in Mikrotik You will need the serial number of the new Mikrotik router to add it to Cloud Deck. Once the Mikrotik Router has been fully configured, as described in Section 5, open Winbox as previously described Section 4.1. Use the following default user name and password to connect to the configured Mikrotik and click connect. Username: admin Password: admin IMPORTANT: YOU SHOULD CHANGE YOUR DEFAULT PASSWORD TO A SECURE PASSWORD TO PREVENT UNAUTHORISED ACCESS, PLEASE REFER TO THE MIKROTIK WIKI TO FIND HOW TO CHANGE THE PASSWORD. Navigate to the system Routerboard as below: 1. Click System in the Winbox window. 2. Click Routerboard in menu list and a pop up window will appear. 3. Check the Serial Number and copy it to clipboard. Figure 7: Check Serial Number You can now remove the Mikrotik from the provisioning setup. Please refer to the Encapto User Guide to add the Mikrotik into Encapto using Cloud Deck. Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published:

14 7. Accessing Mikrotik remotely once it s onsite By default Encapto will not allow remote access to any Mikrotik routers provisioned using this guide. You can only login to the Mikrotik router by connecting your PC directly to the Mikotik previously described Section 3. Once you install the Mikrotik router onsite, you will not be able to access it remotely for any troubleshooting. If you require remote access to Mikrotik, copy the below command and paste into a new terminal window in Winbox (access as described in Section 5). Replace the example IP address ( ) with the WAN (Public) IP of your office (or other location from which you will be accessing your remote Mikrotik). If you have multiple WAN IPs you can run this multiple times with the new IPs. { /ip firewall address-list add address= list=en-trusted Encapto Pty Ltd Encapto WiFi BYOD Mikrotik Setup Guide Doc Version 7 Published: