Radius Manager: setup, profiles, and accounts
Connect Radius Manager, synchronize profiles, and manage Radius accounts linked to customer services.
Last updated: 2026-08-19
Purpose
Radius Manager remains the technical platform while ISP Billing manages customers, services, states, and routine operations. Do not run it alongside ISP Radius 2.0 for the same account without a controlled migration plan.
API connection
Enter the full server URL, API User, and API Password. Grant the remote user only the permissions needed to read profiles and manage accounts. Verify HTTPS, certificate, reachability, and version compatibility before synchronization.
Profiles and options
Synchronize remote profiles before creating accounts. The profile supplies the technical plan; the option selects the Radius Manager variant. Repeat synchronization after remote changes and confirm that identifiers and names remain stable.
Create an account
Select customer and installation address, username, password, CPE IP mode, profile, option, and state. Dynamic, static, and pool modes require different values: provide the address for static mode or the server pool identifier for pool mode.
Verify the result in Radius Manager and perform a real authentication where possible. A linked service prevents accidental account deletion.
Service lifecycle
The customer service links technical access to the commercial contract. Activation, suspension, reactivation, and termination must keep remote and local state consistent. Deleting an account is not a substitute for suspension.
Controls and troubleshooting
Diagnose in order: commercial service state, remote account enabled state, complete username and realm, selected profile and option, static or pool address policy, API reachability, NAS request, and Radius Manager logs. This order separates a billing association problem from authentication or network provisioning.
A successful ISP Billing save proves that the form was accepted; it does not prove that the remote account exists, the NAS can reach Radius Manager, or the CPE authenticated. Verify the provider record and perform a controlled connection test where possible.
Customer Area and security
Customer Area widgets must expose only the subscriber’s permitted account state, connection information, and self-service options. Keep API credentials, account passwords, internal addresses, raw Radius attributes, and other customers’ data outside the response.
Use HTTPS, a dedicated API user, least privilege, and deliberate credential rotation. When customer self-service can alter an option, combine clear impact information, OTP confirmation, and reconnection so the new policy is actually applied.
Importing existing accounts
The CSV import accepts one complete remote username per row and retrieves the matching Radius Manager account. Preserve the realm exactly, review every lookup result, and reject ambiguous or missing matches before association.
For each imported account, select the correct CRM customer, installation address, and commercial service. Verify profile, option, IP mode, and current state. Import links an existing technical resource; it must not create a second account to compensate for a failed match.
Automatic profile synchronization
Optional scheduled synchronization reads the remote profile catalog, creates or updates local records using stable provider identifiers, and removes local profiles that are no longer returned. Run a manual comparison before enabling the schedule.
Remote removal or renaming can affect account forms and customer options. Review dependent accounts, monitor scheduler timestamps and logs, and confirm that an apparent missing profile is not caused by API permissions or a partial provider response.
Customer options and OTP
Additional options store a name, Radius attributes, and a customer-facing description. Customer Area changes require SMS OTP and disconnect the current session so new attributes apply. Explain parental-control DNS/policy and any modem restart.
Credential delivery and unbilled access
Email delivery uses the linked customer and configured templates; verify recipient and content. The unbilled-services view identifies technical access with no proper commercial association and should trigger reconciliation rather than blind deletion.
Checklist
- Use HTTPS and a dedicated API user
- Synchronize profiles first
- Check profile and option
- Configure static IP or pool correctly
- Link customer, address, and service
- Verify remote state
- Do not delete linked accounts
- Protect administrative access