FreeRADIUS is the authentication and accounting backbone for many broadband ISPs. A reliable setup should answer three questions on every login: who is the subscriber, is the subscriber allowed online, and what policy should the NAS apply?
Define NAS devices first
Add each MikroTik, Cisco, Huawei, or other NAS device with a stable management IP, shared secret, location, and owner. Keep shared secrets rotated and avoid reusing the same secret across unrelated locations.
Separate authentication from accounting
Authentication decides whether a subscriber can connect and which plan attributes apply. Accounting records session start, stop, interim usage, NAS port, framed IP, and traffic counters. ISPs need both. Authentication without accounting makes usage reports and dispute resolution weak.
Use CoA for live changes
Change of Authorization lets the billing system update speed, disconnect an expired session, or apply FUP without waiting for the subscriber to reconnect. CoA is especially useful after payment confirmation or plan upgrades.
Monitor failure patterns
Track bad password attempts, expired subscribers, unknown usernames, NAS timeout errors, and duplicate sessions. These logs help support teams solve real subscriber issues faster than checking routers manually.
NowaCRM integrates FreeRADIUS with subscriber CRM and billing rules so the RADIUS response reflects the subscriber's current plan, expiry, wallet, and operational status.