Technical Documentation
RADIUS & AAA
Authentication, authorization and real-time accounting.
Authentication, authorization and real-time accounting.
01How RADIUS works here
RADIUS is the protocol your NAS (MikroTik or other access device) uses to ask Daddy SAS three questions about every subscriber connection.
- Authentication — "Are these credentials valid?" The NAS forwards the subscriber credentials; Daddy SAS answers Access-Accept or Access-Reject.
- Authorization — "What may this subscriber do?" The Access-Accept carries the service profile: rate limits, IP pool or static address, session and idle timeouts.
- Accounting — "What did they use?" The NAS reports session start, interim usage and stop; Daddy SAS stores counters that power online status, usage reports and billing.
02Authentication & authorization
- Standard authentication methods: PAP, CHAP, MSCHAP and EAP variants (owner-confirmed).
- Access types: PPPoE, Hotspot captive portal, IPoE/DHCP and MAC-address accounts.
- Per-account and per-profile authentication policies and restrictions.
- Account states (active, suspended, expired) directly drive the Access-Accept/Reject decision.
03Accounting & sessions
- Real-time session accounting with start/stop events and interim updates.
- A live session list shows which subscribers are online, on which NAS, with how much data used.
- Simultaneous-use limits restrict how many concurrent sessions one account may hold.
- Missing or delayed accounting records can make a closed session look open — enable interim updates on the NAS.
04Session control — CoA & Disconnect
- Change of Authorization (CoA) applies a new speed/policy to a live session — no disconnect needed.
- Disconnect-Message terminates a session from the panel immediately.
- Requires the NAS to accept RADIUS dynamic-authorization requests on UDP 3799 (on MikroTik, enable "radius incoming").
05Attribute reference
Common attributes involved in a Daddy SAS deployment. Availability of a standard attribute does not by itself prove product support — this table reflects the documented access types and policies.
| Attribute | Direction | Used for |
|---|---|---|
| User-Name | NAS → Server | Credential identity for the auth request |
| NAS-IP-Address / NAS-Identifier | NAS → Server | Identifies which router the request came from |
| Calling-Station-Id | NAS → Server | Client MAC — used for MAC binding / MAC accounts |
| Service-Type | Both | Distinguishes PPPoE, Hotspot, admin logins |
| Framed-IP-Address / Framed-Pool | Server → NAS | Static IP or named pool assignment |
| Session-Timeout / Idle-Timeout | Server → NAS | Max session length / idle disconnect |
| Mikrotik-Rate-Limit | Server → NAS | Per-subscriber upload/download limits |
| Acct-Status-Type | NAS → Server | Start / Interim-Update / Stop accounting events |
| Acct-Input/Output-Octets (+Gigawords) | NAS → Server | Usage counters → quotas, FUP, reports |
| Acct-Session-Id | NAS → Server | Correlates all records of one session |
06Reliability & security
- Authentication UDP 1812 · Accounting UDP 1813 · Dynamic authorization UDP 3799 on the NAS.
- Shared secrets authenticate NAS↔server traffic — use a long random secret per NAS and restrict RADIUS to router addresses in the firewall.
- Standard RADIUS runs over UDP and is not encrypted by design — put NAS and server on a private network or VPN on untrusted links.
- Authentication and accounting events are logged and surface in reports.
07Troubleshooting quick checks
- No requests arriving: verify NAS IP in the panel entry, firewall rules, and that the router points at the server IP/ports.
- Access-Reject for valid credentials: check account state (expired/suspended) and the service profile.
- Sessions look stuck online: missing Stop records — check interim-update interval on the NAS.
For a full diagnostic workflow see the Troubleshooting page.