Splynx RADIUS server for ISPs: authentication, authorization and accounting

Splynx pairs carrier-grade AAA with ISP RADIUS billing software to automate authentication and revenue workflows end-to-end.

Splynx consists of several sub-systems. One of its leading and most essential parts is the Splynx RADIUS server: PPPoE, DHCP, IPoE, Hotspot or Wireless authentication. Customers with static IPs are managed too, via the MikroTik API (see below). You don’t deploy or maintain a separate RADIUS server: FreeRADIUS ships with Splynx, bundled, pre-configured and connected to your customer data. Splynx also provides smart bandwidth management, billing, network management and other useful features.

The Splynx RADIUS server is used to perform AAA tasks:

• Authentication – networking equipment checks over the RADIUS server if the login/password of the connecting device or user is correct. If it matches with an entry in the RADIUS server, the device or user can access the equipment or get the service.
• Authorization – defines which actions are allowed for the user or device and its privilege level.
• Accounting – statistics of the usage of the Internet or information about when equipment was accessed.

How RADIUS works in Splynx

The Splynx RADIUS server has two parts: FreeRADIUS, which receives requests from your routers, and Splynx, which checks each request against your customer data: whether the customer exists, whether their service is active, and which speed their plan gives. You control the answers from Splynx settings: the attributes sent for each router type (NAS type), extra attributes per customer or per plan, blocking methods and FUP rules.

A typical connection looks like this:

1. A customer’s device connects to your network via PPPoE, DHCP or hotspot.
2. The router (the NAS, network access server) sends an Access-Request to FreeRADIUS in Splynx.
3. If the customer exists in Splynx and has an internet service, Splynx answers with an Access-Accept. The answer includes rate-limit attributes that set the customer’s download and upload speeds.
4. While the session is up, the router sends accounting updates, so Splynx sees the customer online and records their traffic.

Each vendor uses its own rate-limit format: Mikrotik-Rate-Limit for MikroTik, WISPr-Bandwidth-Max-Down for Ubiquiti, Cisco-Avpair rate-limit for Cisco. These attributes are pre-configured per NAS type, so you pick your vendor under Config → Networking → Radius, click Load and adjust only what you need. Because Splynx uses FreeRADIUS, its attribute dictionaries cover most common device manufacturers; if you need a dictionary for a specific device, our support team can help install it.

1. Administrative AAA

1.1. Authentication

With Splynx you can set up administrator access to equipment to check their credentials over the RADIUS server database.

If their username/password is correct, they will be able to log in to the equipment. If not, they will not get access. This is a very convenient approach compared to local login.

Imagine you hire a new administrator and, in one case, you need to update hundreds of routers, APs, and switches to create a local login everywhere. In another case, you give a new hire one common login/password but must remember to change those credentials when a person leaves the company.

The best-case scenario is to connect all networking devices to the RADIUS server and verify administrator login using RADIUS protocol.

1.2. Authorization

Authorization means that different levels of access can be implemented. Some administrators can change the configurations. Some can only view and read config.

1.3. Accounting

Splynx stores information on when the network unit was accessed by an administrator: for MikroTik routers, every login and logout is logged under Administration → Logs → Operations.

Check out the tutorials on how to configure admin login using the Splynx RADIUS server on different platforms:

1. MikroTik: RADIUS admin login to MikroTik routers
2. Administrative login to Cisco devices

2. Customer AAA

Splynx supports different ways of central customer authentication in a broadband network. The choice depends on the network topology and the technology the operator decides to use. The most widely used access technologies, with their advantages and disadvantages, are described below:

1. PPPoE is easy to maintain and implement. The customer sets up a username and password on the CPE device, and the CPE receives all network settings from the PPPoE NAS (Network Access Server). PPPoE also provides encryption if needed and accounting for usage statistics. There were issues with MTU in the past, but the main vendors have fixed them.
2. IPoE (or DHCP) is based on the client’s MAC address. It can also be linked to the switch port where the customer is connected (DHCP option 82). On MikroTik, DHCP reports accounting to Splynx only when queues are applied dynamically via RADIUS; queues created via the API don’t report accounting stats.
3. Wireless Authentication. When a broadband business has a wireless network, it needs to maintain access of CPE devices to its Access Points. For this purpose, several wireless authentication methods are used, such as a password inside TDMA protocols or wireless access lists.
4. Hotspot is used when a customer has to enter their username and password on the webpage before using the Internet. Many hotspot networks allow free limited access and charge customers for additional usage or advanced plans. For paid public Wi-Fi, see Powerlynx, our separate hotspot product.
5. Static IP addressing. Some broadband businesses don’t have central authentication management and set up static IP addresses for CPE devices. With the MikroTik RouterOS platform, Splynx can manage even customers who have static IPs, with a VLAN per customer or a direct IPv4 connection. Splynx can also collect statistics from MikroTik routers for such customers.

2.1. Blocking customers and fair usage

RADIUS follows each customer’s status in Splynx, so it also handles blocking, for example of non-payers. You choose the method per NAS type:

• Change of Authorization (CoA): when a customer becomes blocked, Splynx sends a CoA packet to the router. By default it adds the customer’s IP to the Reject_1 address list. The session isn’t interrupted, so you can still give the customer access to local resources without changing their IP address.
• Reject IP pools: the customer gets an address from a separate range for each reason: user not found, blocked or inactive, negative balance or a filter applied, wrong MAC address, or wrong password (Reject IP 0–4).
• Drop the session: Splynx interrupts the session and prohibits further connection.

Fair usage policy (FUP) rules use the same mechanism: Splynx sends a CoA request with the FUP rate-limit or block attributes set for the NAS type. More on this in our post on blocking non-paying customers in Splynx. To show blocked customers why they’re blocked and let them pay right away, Splynx can also redirect them to a landing page via DNS: see redirecting blocked customers to a payment page.

3. Keeping RADIUS available

If routers can’t reach RADIUS, new sessions can’t be authorized. Two options keep customers connecting:

• RADIUS failover: you add one or more backup servers for the main Splynx RADIUS server. If the Splynx server is under maintenance or the connection to it is lost, the router switches to a failover server automatically. The setup is active-active, and data syncs from the main server every 4 hours.
• Local authorization via the MikroTik API (MikroTik only): Splynx keeps DHCP leases, PPP secrets or hotspot users on the router itself, so customers can still connect when Splynx is offline.

To keep accounting data on a second server as well, use proxy accounting: Splynx copies RADIUS accounting packets to another RADIUS server. Setup is in the knowledge base: RADIUS proxy accounting.

4. More RADIUS settings

• IPv6 reject pools. Next to Reject IP 0–4, you can also set Reject IPv6 0–4 ranges for the same five reasons.
• Activate service on first auth. When this option is on, a Pending internet service with no start date becomes Active the first time the customer’s equipment authenticates successfully, and billing starts from that day. It’s set per NAS type (Config → Networking → Radius, select the NAS type, click Load), off by default, and recorded in the customer and service log.
• Copy NAS type settings. When you create a new NAS type, you can copy the settings from an existing one.

5. Setup guides

The guides below show how to set up customer authentication on different equipment. If you run MikroTik, start with our post on MikroTik RADIUS configuration and troubleshooting; if your router gets no answer from RADIUS, see RADIUS server network issues. For per-device Wi-Fi passwords on one SSID, see Multiple PSK, which you enable in the RADIUS advanced settings.