RADIUS Server Setup and Management Training

How It Works

The Role of RADIUS in ISP Subscriber Management

RADIUS (Remote Authentication Dial-In User Service) is the protocol that makes centralized subscriber management possible for ISPs. Every time a broadband subscriber connects to the internet through PPPoE, their credentials are sent to a RADIUS server for verification. The RADIUS server checks the username and password against its database, verifies that the subscriber's account is active and not expired, determines which bandwidth plan the subscriber is on, and sends back the appropriate speed limits and IP address assignment to the NAS (Network Access Server, typically a MikroTik router). This entire process happens in milliseconds and is completely transparent to the subscriber. Beyond authentication, RADIUS also handles authorization (determining what resources a subscriber can access) and accounting (recording session start/stop times, data usage, and session duration for billing purposes). Without a properly configured RADIUS server, ISPs would need to manage subscriber credentials and bandwidth profiles locally on each router, which is impractical for any network serving more than a handful of subscribers.

Setting Up FreeRADIUS with MikroTik

Our training provides a complete, step-by-step walkthrough of deploying FreeRADIUS from scratch and integrating it with MikroTik PPPoE servers. The process begins with installing FreeRADIUS on a Linux server (we cover both Ubuntu/Debian and CentOS/Rocky Linux installations), configuring the database backend using MySQL or MariaDB, and setting up the initial client (NAS) definitions that tell FreeRADIUS which routers are authorized to send authentication requests. Participants then configure the MikroTik PPPoE server to point to the RADIUS server, defining the shared secret, timeout values, and fallback behavior.

The training covers the FreeRADIUS configuration files in detail, including the main radiusd.conf, the clients.conf for NAS definitions, the users file for local user testing, and the SQL module configuration for database-backed authentication. We explain how FreeRADIUS processes authentication requests through its module chain: first checking the authorize section to look up the user and retrieve their stored password and attributes, then passing through the authenticate section to verify the password, and finally the post-auth section where custom logic like logging or attribute manipulation can be added. This understanding of the FreeRADIUS processing pipeline is essential for troubleshooting authentication failures and implementing custom business logic.

Automating Subscriber Provisioning

Manual subscriber management through direct database edits or configuration file changes does not scale for growing ISPs. Our training teaches operators how to automate the subscriber lifecycle using RADIUS in conjunction with billing and CRM systems. When a new subscriber signs up, the billing system creates a record in the RADIUS database with the subscriber's credentials, assigned bandwidth plan, and account validity period. When the subscriber connects, the RADIUS server automatically applies the correct speed limits based on their plan. If the subscriber upgrades or downgrades their plan, the billing system updates the RADIUS database and sends a CoA (Change of Authorization) packet to the MikroTik router, which updates the subscriber's speed limits in real time without requiring a reconnection. When a subscriber's payment is overdue, the billing system can update the RADIUS profile to redirect the subscriber to a captive portal or reduce their speed until payment is received.

Integrating with Billing Systems

The connection between RADIUS and billing is what transforms raw authentication into a revenue-generating system. Our training covers the integration architecture, where the billing system writes subscriber data to the RADIUS database and reads accounting data back for usage tracking and invoice generation. We work with common ISP billing platforms used in India, teaching operators how to configure the database schema for compatibility, set up accounting tables that record session details (bytes in, bytes out, session duration, NAS IP, assigned IP), and build SQL queries that generate usage reports for billing reconciliation. The training also covers how to implement prepaid and postpaid models using RADIUS, where prepaid subscribers have a data or time quota that decrements in real time, and postpaid subscribers have unlimited access with usage-based billing at the end of each cycle.

Troubleshooting and Monitoring

Authentication failures are one of the most common issues ISP support teams deal with daily. Our training equips operators with systematic troubleshooting skills for RADIUS-related problems. We cover how to read FreeRADIUS debug output (running the server in debug mode with the -X flag), interpret common error messages, trace the authentication flow from the NAS through to the database lookup and back, and identify issues such as incorrect shared secrets, password mismatches, expired accounts, simultaneous-use violations, and database connectivity problems. We also set up monitoring for the RADIUS infrastructure using tools like radclient for synthetic testing, Zabbix for server health monitoring, and custom scripts that alert operators when authentication failure rates exceed normal thresholds.

Frequently Asked Questions