Radius Manager: setup, profiles, and accounts
Connect Radius Manager, synchronize profiles, and manage Radius accounts linked to customer services.
Last updated: 2026-08-31
Purpose
Radius Manager remains the technical platform while ISP Billing manages customers, services, states, and routine operations. Do not run it alongside ISP Radius 2.0 for the same account without a controlled migration plan.
API connection
Enter the full server URL, API User, and API Password. Grant the remote user only the permissions needed to read profiles and manage accounts. Verify HTTPS, certificate, reachability, and version compatibility before synchronization.
Profiles and options
Synchronize remote profiles before creating accounts. The profile supplies the technical plan; the option selects the Radius Manager variant. Repeat synchronization after remote changes and confirm that identifiers and names remain stable.
Create an account
Select customer and installation address, username, password, CPE IP mode, profile, option, and state. Dynamic, static, and pool modes require different values: provide the address for static mode or the server pool identifier for pool mode.
Verify the result in Radius Manager and perform a real authentication where possible. A linked service prevents accidental account deletion.
Service lifecycle
The customer service links technical access to the commercial contract. Activation, suspension, reactivation, and termination must keep remote and local state consistent. Deleting an account is not a substitute for suspension.
Online state and active sessions
With Radius Manager 4.7.0 or later, the account detail uses the official get_userdata function to display the real online state. Each active session supplies the assigned IP, NAS, and access point. When the installation exposes a session slot, an empty list means offline; when the API returns account data only, a blue Account active card avoids inventing a connection state. An unrecognized response remains N/A.
Live values remain separate from account data such as enabled state, configured static IP, expiry, and remaining limits. Account data alone is not proof of an active connection.
Controls and troubleshooting
Diagnose in order: commercial service state, remote account enabled state, complete username and realm, selected profile and option, static or pool address policy, API reachability, NAS request, and Radius Manager logs. Versions older than 4.7.0 may not expose active sessions through the SysAPI.
A successful ISP Billing save proves that the form was accepted; it does not prove that the remote account exists, the NAS can reach Radius Manager, or the CPE authenticated.
CPE SNMP diagnostics
The account detail stores device type and SNMP community. Without an override, diagnostics use the cpeipaddress of an active Radius Manager session. For a bridged CPE, enable Query a different IP, enter its static address, and press OK: the stored target is queried even while PPPoE is offline. Disable the flag and confirm to restore the online-session address.
With an operational Edge Agent or configured MikroTik bridge, opening the page starts an unsaved live check even when history is empty. Generic runs ten pings for loss and latency; a specific device type runs ping and SNMP independently. Verify stores one valid sample and temporary monitoring stores up to 20.
Customer Area and security
Customer Area widgets must expose only the subscriber’s permitted account state, connection information, and self-service options. Keep API credentials, account passwords, internal addresses, raw Radius attributes, and other customers’ data outside the response.
Use HTTPS, a dedicated API user, least privilege, and deliberate credential rotation. When customer self-service can alter an option, combine clear impact information, OTP confirmation, and reconnection so the new policy is actually applied.
Importing existing accounts
The CSV import accepts one complete remote username per row and retrieves the matching Radius Manager account. Preserve the realm exactly, review every lookup result, and reject ambiguous or missing matches before association.
For each imported account, select the correct CRM customer, installation address, and commercial service. Verify profile, option, IP mode, and current state. Import links an existing technical resource; it must not create a second account to compensate for a failed match.
Automatic profile synchronization
Optional scheduled synchronization reads the remote profile catalog, creates or updates local records using stable provider identifiers, and removes local profiles that are no longer returned. Run a manual comparison before enabling the schedule.
Remote removal or renaming can affect account forms and customer options. Review dependent accounts, monitor scheduler timestamps and logs, and confirm that an apparent missing profile is not caused by API permissions or a partial provider response.
Customer options and OTP
Additional options store a name, Radius attributes, and a customer-facing description. Customer Area changes require SMS OTP and disconnect the current session so new attributes apply. Explain parental-control DNS/policy and any modem restart.
Credential delivery and unbilled access
Email delivery uses the linked customer and configured templates; verify recipient and content. The unbilled-services view identifies technical access with no proper commercial association and should trigger reconciliation rather than blind deletion.
Checklist
- Use HTTPS and a dedicated API user
- Synchronize profiles first
- Check profile and option
- Configure static IP or pool correctly
- Link customer, address, and service
- Verify remote state
- Do not delete linked accounts
- Protect administrative access