A RADIUS server decides who can get on your network, at what speed, and for how long. For an ISP it is the link between a subscriber’s plan and their actual connection. This guide explains how RADIUS works, what you need to set it up with MikroTik or another NAS, and how to connect it to billing so plans, expiry and payments are applied automatically.
What is RADIUS?
RADIUS stands for Remote Authentication Dial-In User Service. It is a standard network protocol (RFC 2865 and RFC 2866) that does three jobs, often called AAA:
- Authentication: checks the subscriber’s username and password when they connect.
- Authorization: tells the router what that user is allowed: speed, IP address, data limit, session time.
- Accounting: records when each session starts and stops and how much data it used.
Almost every broadband and FTTH ISP that uses PPPoE or hotspot logins relies on RADIUS, because it lets you manage thousands of users from one place instead of creating them on every router.
How RADIUS works in an ISP network
There are three parts:
- The subscriber connects from their ONU or router with a PPPoE username and password.
- The NAS (Network Access Server) is your MikroTik, BRAS or BNG. It is the RADIUS client.
- The RADIUS server holds users and plans and answers the NAS.
When a subscriber dials in:
- The NAS sends an Access-Request to the RADIUS server on UDP port 1812.
- The server checks the user. If the account is active, it replies Access-Accept with attributes such as the speed limit and IP pool. If the account is expired or the password is wrong, it replies Access-Reject.
- The NAS starts the session and sends Accounting-Start on UDP port 1813, then regular Interim-Update messages with data used, and Accounting-Stop when the session ends.
The NAS and server trust each other through a shared secret that is configured on both sides and never sent over the network.
RADIUS attributes ISPs use most
| Attribute | What it does |
|---|---|
| Mikrotik-Rate-Limit | Sets upload/download speed on MikroTik, for example 10M/50M |
| Framed-IP-Address | Gives a static IP to a subscriber |
| Framed-Pool | Picks the IP pool the user gets an address from |
| Session-Timeout | Ends the session after a set time |
| Acct-Interim-Interval | How often the NAS sends usage updates |
| Simultaneous-Use | Stops one account being used on two connections at once |
To change a live session, such as upgrading speed or cutting off an unpaid user, the RADIUS server sends a CoA (Change of Authorization) or Disconnect message to the NAS on UDP port 3799 (RFC 5176). Without CoA, changes only apply when the user reconnects.
How to set up a RADIUS server for your ISP
1. Choose your RADIUS server
Common options are FreeRADIUS (open source, runs on Linux, used by most ISPs), FreeRADIUS with a web panel such as daloRADIUS, Windows NPS for small setups, or RADIUS that comes with your bandwidth manager or ISP billing software.
2. Add your NAS as a client
On the RADIUS server, add each MikroTik or BRAS by its IP address with a strong shared secret. Only listed clients can send requests.
3. Create plans and users
Create a group or profile for each plan with its speed and limits, then add subscribers to the right plan. This is where most manual work happens if RADIUS is not connected to billing.
4. Point MikroTik to RADIUS
On a MikroTik PPPoE server, the basic configuration looks like this:
/radius add service=ppp address=10.0.0.10 secret=YourSharedSecret
/ppp aaa set use-radius=yes accounting=yes interim-update=5m
/radius incoming set accept=yes port=3799The last line allows CoA and Disconnect messages, so speed changes and suspensions apply instantly.
5. Test before going live
Create a test user and connect from a real router. On the server, radtest or the debug mode (freeradius -X) shows each request and the reply. Check that the speed, IP and accounting records are correct.
6. Move subscribers in batches
Migrate one area or one NAS at a time, so a mistake affects a few users instead of the whole network.
Common RADIUS problems and fixes
- All users rejected: the shared secret or NAS IP does not match on both sides.
- Users connect but speed is wrong: the plan attribute is missing or uses the wrong vendor format for your NAS.
- Usage not showing: accounting is off on the NAS or port 1813 is blocked by a firewall.
- Expired users still online: CoA/Disconnect is not enabled, so they stay connected until they redial.
- One account used in two places: set Simultaneous-Use to 1.
Why RADIUS should be connected to billing
A RADIUS server on its own only knows what you type into it. Someone still has to change a user’s plan after an upgrade, disable them when they do not pay, and enable them again after payment. With hundreds of renewals a month, this is where ISPs lose money and get complaints.
ISP billing software that works with RADIUS removes that manual step:
- A new connection in billing creates the PPPoE user in RADIUS with the right plan.
- A plan upgrade changes the speed on the live session.
- On expiry the user is suspended, and as soon as they pay online the connection is restored.
- Usage from accounting appears on the subscriber’s profile for support and FUP.
How ISPMate works with RADIUS
ISPMate connects billing, CRM and the network. PPPoE users are created, speed-limited, suspended on expiry and reconnected on payment through RADIUS and MikroTik, and ISPMate also integrates with bandwidth managers such as Jaze, IPACCT, Height8, DMA, XceedNet and 24online. See ISP bandwidth management software and the full list of integrations.
Related guides: bandwidth monitoring tools for ISPs and ISP CRM software.
Frequently asked questions
What is a RADIUS server for an ISP?
It is the server that authenticates subscribers when they connect, tells the router their speed and IP, and records session usage. The router (NAS) asks the RADIUS server before allowing each login.
Which ports does RADIUS use?
UDP 1812 for authentication, UDP 1813 for accounting and UDP 3799 for CoA and Disconnect messages. Older systems may use 1645 and 1646.
Is FreeRADIUS good for ISPs?
Yes. FreeRADIUS is free, stable and handles large numbers of users, but it needs Linux skills to configure and has no billing. Most ISPs pair it with billing software or a web panel.
Does MikroTik support RADIUS?
Yes. MikroTik RouterOS supports RADIUS for PPPoE, hotspot and other services, including the Mikrotik-Rate-Limit attribute for speed and incoming CoA for live changes.
Can RADIUS suspend users automatically when they don’t pay?
RADIUS can reject or disconnect a user, but it needs to be told when an account has expired. When RADIUS is connected to ISP billing software, suspension on expiry and reconnection on payment happen automatically.
Want RADIUS, billing and renewals working together? Book a free ISPMate demo or call +91-9310313545.
