MikroTik RADIUS Authentication: Setup & Best Practices
RADIUS (Remote Authentication Dial-In User Service) is the backbone of subscriber management for ISPs using MikroTik routers. This guide covers everything you need to set up and optimize RADIUS authentication for PPPoE and DHCP environments.
Why RADIUS for ISP Management?
RADIUS provides centralized authentication, authorization, and accounting (AAA) for your subscriber base. Instead of managing users on each individual router, RADIUS gives you:
- Centralized user management — one database for all subscribers across all routers
- Dynamic bandwidth control — assign and modify speed profiles in real-time
- Session monitoring — track who's connected, their IP, traffic usage, and session duration
- Automatic provisioning — new subscribers get authenticated and configured automatically
MikroTik RADIUS Configuration
Setting up RADIUS on MikroTik RouterOS involves three main steps:
1. RADIUS Server Configuration
First, configure your FreeRADIUS server with the appropriate NAS (Network Access Server) entries for each MikroTik router. Each router needs a shared secret and the correct authentication port configuration.
2. MikroTik Router Setup
On each MikroTik router, configure the RADIUS client to point to your RADIUS server. Key settings include:
- RADIUS server address and shared secret
- PPPoE server profile with RADIUS authentication enabled
- DHCP server configuration for RADIUS-based MAC authentication
- Queue types and bandwidth profiles
3. User Profile Management
Create service plans that map to RADIUS attributes: bandwidth limits (rate-limit), IP pool assignments, session timeouts, and traffic quotas.
Best Practices
- Use separate RADIUS secrets for each router
- Enable accounting (port 1813) for traffic monitoring
- Implement CoA (Change of Authorization) for real-time plan changes
- Set up redundant RADIUS servers for high availability
- Monitor RADIUS response times to detect issues early
Simplifying RADIUS with Veloxiom
Veloxiom eliminates the complexity of manual RADIUS configuration. Connect your MikroTik routers via the RouterOS API, and Veloxiom handles RADIUS configuration, user provisioning, and session monitoring automatically.