RADIUS for ISPs

RADIUS fails silently. Authentication that was failing 2% of the time becomes a mass complaint when it hits 15%. A B-RAS correctly configured to talk to RADIUS plus active monitoring prevent the circus.

What RADIUS is in an ISP context

RADIUS (Remote Authentication Dial-In User Service) is the central AAA system that validates every PPPoE/IPoE/Wi-Fi session and controls what the subscriber can use. In Brazilian ISPs, it usually comes bundled with the ERP/management system (MK-Auth, IXC, SGP, Voalle) where the subscriber record lives. On the network side, the B-RAS has to be configured to talk correctly to that RADIUS — that is where Rasys operates.

What RASYS does

  • B-RAS configuration to talk to your ERP's RADIUS (MK-Auth, IXC, SGP, Voalle) — primary/secondary server pointing, PSK, timeout, retry.
  • Vendor-specific attributes on the B-RAS (Huawei, Juniper, Mikrotik) so it understands what your RADIUS sends: rate-limit, VLAN, IP pool.
  • Management network hardening — isolation, firewall between B-RAS and RADIUS, rate-limit per NAS to prevent abuse.
  • Authentication failure debug — cross-reading logs B-RAS ↔ RADIUS ↔ ERP to find where the session dies.
  • Active monitoring — Access-Reject rate, response latency, accounting gaps; alert before customers notice.
  • B-RAS migration that keeps your existing RADIUS/ERP intact, no subscriber-record changes on our side.

Systems we work with

We integrate the B-RAS with any RADIUS commonly seen in Brazilian ISPs: FreeRADIUS, MK-Auth, IXC Soft, SGP, Voalle, RouterOS RADIUS, embedded RADIUS on Huawei/Juniper. Operating the RADIUS itself (internal configuration, database schema, plan logic) usually stays with your ERP vendor.

When it makes sense to talk to us

Intermittent authentication failures without an obvious cause; migrating B-RAS and the existing RADIUS needs to keep working; accounting gaps and you cannot tell if the problem is B-RAS or ERP; management network hardening for LGPD/audit compliance.

Talk to us — initial conversation, no commitment. See also: PPPoE, OLT and GPON.

FREQUENTLY ASKED QUESTIONS

Do you replace the management system (e.g. MK-Auth to IXC)?

We do not replace the management system/ERP — that is the ERP integrator's job. On our side, we migrate the B-RAS and any network change the swap requires (VLANs, pools, routes).

FreeRADIUS or embedded RADIUS on Mikrotik — which to use?

This decision usually sits with your ERP vendor, because the RADIUS is coupled to the management system. As a technical reference: under 5k sessions, Mikrotik RADIUS usually works; above that, FreeRADIUS on a pair of Linux VMs is more robust and easier to debug. But this is outside what Rasys configures — on our side, the B-RAS points wherever the ERP indicates.

How do you alert when RADIUS starts failing?

We monitor Access-Reject rate, average response latency, and accounting gaps. When a combined threshold is exceeded, an alert fires to the on-call group.