ISP Radius 2.0: complete setup and operations

Correct setup order

ISP Radius 2.0 connects a commercial service to real network authentication. Prepare the Radius database connection, NAS entries, optional IP pools, realms, profiles, and general rules before creating customer accounts.

A credential stored in ISP Billing does not prove PPPoE access works: the NAS must reach the server, share the same secret, send accounting, and understand returned attributes.

Radius server and security

Server settings contain the Radius database host, database, user, and password. The primary fallback server, API port, and Reboot API Key support the remote operations provided by the installation. Use a dedicated limited database user and firewall the allowed application network.

Test SQL connectivity, server reachability, and permissions separately. Do not expose database, API, or accounting ports without filtering.

NAS configuration

Register every PPPoE concentrator or router that queries Radius. The IP must be the source seen by the server; name and description identify the unit; type describes the vendor; port normally identifies authentication; secret must match at both ends. Server and community are optional infrastructure fields.

When NAT is present, register the actual observed source. Run a controlled authentication and inspect the access request and session.

IPv4 and IPv6 pools

With local management disabled, the NAS assigns addresses and a profile may return Framed-Pool. When enabled, ISP Radius 2.0 assigns addresses: the first Master pool is mandatory and later pools may be limited to selected NAS devices.

Names cannot contain spaces. IPv4 ranges must not overlap DHCP, management, or other pools. IPv6 supports prefix ranges and a calculator that divides a base prefix; verify capacity, assigned-prefix size, and delegation before production.

Profiles and Radius attributes

A profile is a reusable group of attributes. Every row has attribute, operator, and value. := sets or replaces a value; other operators have different Radius semantics and must match the NAS dictionary.

Profiles may include vendor speed controls, Framed-Pool, timeouts, filters, and a linked parental-control profile. Review the account count before editing a used profile; Move accounts provides an explicit migration.

PPPoE realm

A realm is the username suffix, such as @isp.example. Create it before accounts when required and keep CPE, concentrator, and routing rules consistent. Do not add the at-sign twice or change a deployed realm without migration.

Accounts and services

Select customer and installation address, then set username, password, profile, and state. The customer service remains the commercial reference while the Radius account controls technical access.

Use unique credentials and the correct IP policy. Disconnect ends only the current session; suspend, activate, and terminate change account lifecycle and are not interchangeable.

Dashboard, sessions, and diagnostics

The dashboard separates total, online, offline, never-connected, NAS, PPPoE without service, and longest sessions. Never-connected means no first session; offline has history but no current session; unbilled active accounts require commercial review.

Sessions and access requests expose times, NAS, addresses, traffic, and authentication outcomes. Export only necessary ranges and protect the files.

SNMP, Edge Agent, and automatic monitoring

General settings select the SNMP method used by both manual buttons and automatic monitoring. An Edge Agent can query a private network without exposing equipment to the cloud. Register and authorize the Agent first, then select it in Radius.

Community, version, credentials, and OIDs must match the vendor. Restrict SNMP sources, prefer SNMPv3 where available, and do not interpret a timeout as proof that the Radius account is offline.

General state profiles

General settings can map separate profiles to Suspended and Terminated services. Create and test both profiles first, then verify that reactivation restores the correct commercial profile. Keep service and account state authoritative rather than using the restricted profile as the only state record.

SNMP queries and snapshots

Manual queries use either the configured classic MikroTik API path or an online SNMP-capable Edge Agent. Validate target IP, route, device type, SNMP version, community or credentials, and the applicable OID catalog before interpreting the response.

A successful query stores a snapshot containing the collected interface and device observations. Account detail retains the latest twenty snapshots; compare their timestamps and collection method. A timeout means that this query failed, not that the Radius account or customer line is necessarily offline.

Automatic SNMP monitoring

An automatic monitor defines its collection interval, maximum run count, usage tag, next execution, current progress, and errors. Choose a cadence that provides useful evidence without overloading the Agent or network equipment.

The scheduler queues Edge Agent work when that method is selected and closes the monitor after its run limit. Closing the browser does not cancel scheduled collection. Review missed runs, Agent availability, stored snapshots, and the final state rather than relying only on the monitor’s creation message.

Metrics and session exports

Account detail calculates thirty-day connection metrics and filters session history. Background CSV/XLSX export requires a start- or stop-time range and publishes the completed file in a dedicated download list. Treat accounting files as sensitive usage data and apply access and retention controls.

Credentials and customer communications

Credential delivery uses the account’s linked customer and the templates configured for this communication. Before sending, verify the recipient, customer, username, realm, instructions, and whether the chosen channel is authorized. Never include administrative database, NAS, API, or SNMP secrets.

If credentials are changed, coordinate the CPE or router update and test a new authentication. A delivered email proves only transmission of the message, not that the access device has been reconfigured successfully.

Scheduled Radius database maintenance

Database maintenance runs from the command line or scheduler. It assigns the correct ISP ownership to accounting and post-authentication rows, removes post-auth records older than the configured short operational window, and closes older duplicate sessions that remained open.

A separate scheduled process executes automatic SNMP monitoring. Configure these jobs in the intended environment, prevent overlapping runs with their lock mechanism, and monitor exit status, timestamps, logs, row counts, and repeated failures. Do not run ad-hoc cleanup queries against the Radius database as a substitute for the supported process.

Customer Area and API

Customer widgets expose only permitted account and connection data. Public APIs support list, detail, create, update, delete, disconnect, suspend, activate, terminate, and traffic status; profiles are readable with their attributes.

Separate read and management permissions, make integrations idempotent, verify effects in the operational module, and never expose Radius passwords.

Checklist

• Protect Radius database and APIs
• Register every NAS with correct source IP and secret
• Choose who assigns addresses
• Avoid IPv4/IPv6 pool overlap
• Understand profile operators and attributes
• Define realms before accounts
• Link account, customer, address, and service
• Distinguish disconnect from suspension
• Review never-connected and unlinked PPPoE accounts
• Configure SNMP and Agent with least privilege