FreeRADIUS is the dominant authentication platform in Pakistani ISP networks. Its flexibility, performance, and the depth of MikroTik's RADIUS client implementation make it the right choice for subscriber authentication, QoS policy delivery, and accounting log generation. Done correctly, FreeRADIUS running on a modest server handles tens of thousands of subscribers with authentication times under 50 milliseconds and accounting records suitable for both billing and CTDISR-2025 compliance logging.

Architecture and Prerequisites

The FreeRADIUS server sits between your MikroTik NAS devices and your subscriber database. Authentication requests flow from MikroTik to FreeRADIUS, which validates credentials against the subscriber database and returns a response with any QoS attributes the policy requires. Accounting requests flow the same direction: MikroTik sends session start, interim-update, and session stop records to FreeRADIUS, which logs them for billing and compliance purposes.

A minimum production FreeRADIUS deployment has two servers for redundancy: primary and secondary. MikroTik NAS devices are configured with both as RADIUS servers, falling back to secondary if primary does not respond within the timeout window. A single-server RADIUS deployment is a single point of failure for subscriber authentication.

MikroTik NAS Configuration

Configure each MikroTik NAS device to use FreeRADIUS as its AAA server. In RouterOS, RADIUS is configured in /radius:

/radius
add address=<freeradius-primary-ip> secret=<shared-secret> \
    service=ppp,hotspot,dhcp timeout=3000 \
    authentication-port=1812 accounting-port=1813

add address=<freeradius-secondary-ip> secret=<shared-secret> \
    service=ppp,hotspot,dhcp timeout=3000 \
    authentication-port=1812 accounting-port=1813

Enable RADIUS for the PPPoE server (the most common subscriber authentication method for Pakistani ISPs):

/ppp aaa
set use-radius=yes accounting=yes interim-update=5m \
    radius-attribute-79=yes

The 5-minute interim-update interval sends session updates to FreeRADIUS every 5 minutes, keeping accounting records current even for long-duration sessions. This is important for CGNAT log correlation: if a subscriber's session is active and an abuse complaint arrives referencing a specific time, the interim-update records give you the IP-to-subscriber mapping at that time.

FreeRADIUS NAS Client Configuration

In FreeRADIUS, each MikroTik NAS is defined as a client in clients.conf:

client mikrotik-nas-1 {
    ipaddr = <nas-ip>
    secret = <shared-secret>
    nas_type = other
    shortname = nas-1
}

Use a unique shared secret per NAS device rather than a single secret for all. This limits the blast radius if a secret is compromised: only the affected NAS needs its secret rotated rather than all NAS devices simultaneously.

Attribute Mapping for QoS Policy Delivery

FreeRADIUS delivers QoS parameters to MikroTik through vendor-specific attributes in the Access-Accept response. MikroTik's VSA dictionary defines the attributes RouterOS understands. The most commonly used are:

Mikrotik-Rate-Limit delivers the subscriber's bandwidth policy in RouterOS queue format:

Mikrotik-Rate-Limit = "5M/10M"

This sets upload to 5 Mbps and download to 10 Mbps using RouterOS simple queue syntax. With burst:

Mikrotik-Rate-Limit = "5M/10M 10M/20M 4M/8M 30 5M/10M 1000/1000"

The format is: rate upload/download, burst-rate upload/download, burst-threshold upload/download, burst-time, MIR upload/download, priority.

In your FreeRADIUS users file or SQL query for subscriber lookup, return the appropriate Mikrotik-Rate-Limit based on the subscriber's plan in your database. This means plan changes in your billing system automatically take effect at the subscriber's next authentication without touching RouterOS configuration.

Accounting Log Structure

FreeRADIUS writes accounting records to its accounting log, which by default is a text file but should be written to a database for practical query capability. The minimum fields to capture for CTDISR compliance and CGNAT correlation:

User-Name (subscriber identifier), NAS-IP-Address, NAS-Port-Id, Framed-IP-Address (the CGNAT subscriber IP assigned), Acct-Status-Type (Start, Interim-Update, Stop), Acct-Session-Id, Acct-Session-Time, Acct-Input-Octets, Acct-Output-Octets, Event-Timestamp.

With these fields in a queryable database, you can answer the question "which subscriber had IP 100.64.x.x at time T" within seconds, which is the operational requirement for abuse complaint response and the compliance requirement for lawful intercept support.

Troubleshooting Authentication Failures

The fastest way to diagnose RADIUS authentication failures is FreeRADIUS debug mode: radiusd -X runs the server in foreground with full debug output showing every step of the authentication process, which attributes were received, which module was consulted, and what response was generated. Run this on a test authentication to see exactly what is happening.

For MikroTik-side debugging, /radius monitor 0 shows the current status of RADIUS connections including timeouts and response counts.

For operators who want RADIUS authentication events integrated into their security monitoring (authentication failures above threshold as an alert trigger), NOC Enablement & Monitoring covers the log integration. For automation of subscriber provisioning workflows that update FreeRADIUS alongside billing system changes, Automation & Integrations covers the full integration architecture.