RADIUS Server Integration and Bandwidth Throttling for ISP Billing Systems
Internet providers need to do more than authenticate customers. They must also apply the correct speed, manage shared network capacity, enforce data or time allowances, monitor sessions, and connect these policies to billing status.
A RADIUS server provides a centralized way to authenticate and authorize subscribers across PPPoE, MikroTik HotSpot, wireless networks, VPN services, and other access systems. When it is connected to an ISP billing platform, a customer’s service plan can determine the bandwidth profile, IP pool, session limit, quota, and expiry behavior.
Bandwidth throttling is the process of limiting or adjusting a subscriber’s connection speed according to a plan, fair-use policy, account status, congestion rule, or data allowance. Used correctly, it helps the provider protect capacity while giving customers a service that matches what they purchased.
Internet providers can
Important: RADIUS attributes, rate-limit behavior, RouterOS features, billing integrations, and available platform controls depend on the router model, RouterOS version, RADIUS server, access design, plan configuration, and account permissions. Test every profile before applying it to production subscribers.
What is RADIUS server integration?
RADIUS integration connects a network access device to a central authentication and accounting service.
When a customer connects, the MikroTik router or access gateway sends a request to RADIUS. The server checks the subscriber record and returns a response.
The response may authorize or reject access and may include:
•Download speed
•Upload speed
•IP address or pool
•Session timeout
•Idle timeout
•Simultaneous-session limit
•Service profile
•Data or time policy
•VLAN or access rule
RADIUS accounting then records session events such as login, logout, duration, assigned IP address, uploaded data, downloaded data, router, and termination reason.
An ISP billing system can manage the customer, invoice, payment, package, expiry, and account status while RADIUS and MikroTik enforce the network policy.
To evaluate this type of connected workflow,
What is bandwidth throttling?
Bandwidth throttling limits the rate at which a subscriber can send or receive traffic. An ISP may apply throttling based on the customer’s package, network congestion, fair-use policy, quota, or account state.
A plan may define:
•Download speed
•Upload speed
•Peak and off-peak rates
•Burst behavior
•Priority
•Data allowance
•Session duration
•Device count
•Restricted or grace-period speed
For example, a residential plan may provide a standard download and upload rate, while a premium package provides more capacity. An overdue account may receive a restricted profile rather than immediate disconnection if that matches the provider’s policy.
Throttling should be transparent. Customers should know the advertised speed, expected service conditions, fair-use rules, and what happens when a quota or payment period ends.
Why integrate RADIUS with ISP billing?
Centralized subscriber policies
Instead of configuring each customer manually on every router, the provider can maintain account and plan rules centrally.
Consistent speed enforcement
Every subscriber on the same plan can receive the same tested rate policy, regardless of location or access router where the architecture supports it.
Faster activation and renewals
After a confirmed payment or approved installation, the billing platform can activate the account or update the RADIUS authorization.
Easier suspension and restoration
When an account expires or becomes overdue, the provider can apply a restricted profile, reject new sessions, or follow another documented policy. After payment, the account can be restored.
Better usage reporting
Accounting records help the provider understand subscriber usage, session behavior, data quotas, capacity pressure, and support issues.
Scalable multi-router management
Centralized RADIUS can support multiple MikroTik routers, towers, branches, buildings, HotSpot locations, or service areas.
Providers comparing billing and access workflows can
RADIUS integration architecture
A typical ISP deployment has five layers.
1. Customer and billing platform
This layer stores the subscriber account, package, invoice, payment status, expiry, support history, and commercial rules.
2. RADIUS server
The RADIUS server receives authentication requests, looks up the user, returns authorization attributes, and records accounting events.
3. MikroTik access device
The router operates the PPPoE server, HotSpot gateway, or another access service. It sends requests to RADIUS and enforces the returned policy.
4. Subscriber network
This includes the access point, wireless backhaul, VLAN, fiber access, customer router, or other connection path.
5. Reporting and communication
The provider uses accounting, dashboards, email, SMS, WhatsApp, and support tools to inform customers and manage the business.
The exact design may use a local database, managed RADIUS, API integration, or a billing platform that combines several components. Confirm which system is the source of truth for the customer, plan, payment, and network profile.
Step 1: Document the MikroTik environment
Before configuring RADIUS, document the network. Record:
•Router model
•RouterOS version
•Router identity and location
•Subscriber-facing interface
•PPPoE server or HotSpot server
•VLANs and bridges
•IP pools
•Management addresses
•DNS settings
•NAT and firewall rules
•RADIUS server address
•Expected concurrent sessions
•Upstream bandwidth
Keep the management network separate from subscriber traffic. Back up the RouterOS configuration before changing authentication or provisioning settings.
Identify which router settings may be managed by the billing platform and which custom rules must remain protected. An automated provisioning service should not overwrite unrelated configuration without a documented process.
Step 2: Create ISP packages and throttling profiles
Bandwidth throttling works best when each commercial package maps to one tested network policy.
For every plan, define:
•Plan name
•Price
•Billing period
•Download rate
•Upload rate
•Burst rate, if used
•Data quota
•Session limit
•Device limit
•IP pool
•Expiry rule
•Fair-use rule
•Grace-period policy
•Support conditions
Use names that are consistent in the billing platform, RADIUS database, MikroTik profiles, customer portal, and support documents.
For example, a provider might create Home-10M, Home-25M, Business-50M, and Restricted-Grace profiles. The names are less important than having a clear mapping and documented behavior.
To organize packages and customer billing,
Step 3: Configure RADIUS clients securely
Each MikroTik router that sends requests to RADIUS is a client of the RADIUS server.
For each client, configure:
•Router IP address
•RADIUS service type
•Shared secret
•Authentication port
•Accounting port
•Timeout
•Retry behavior
•Source address
•Firewall allowance
Use strong, unique shared secrets where possible. Restrict RADIUS requests to known router addresses. Do not allow arbitrary public networks to send authentication or accounting traffic.
If the network has multiple routers, document each client and its location. A unique client identity makes troubleshooting and access revocation easier.
Step 4: Configure authentication and authorization
Authentication confirms the username and password. Authorization determines what the subscriber receives.
A successful RADIUS response may return a service profile or attributes for:
•Rate limit
•IP address
•IP pool
•Session timeout
•Idle timeout
•Simultaneous use
•Data quota
•Service type
Test rejected credentials, expired accounts, disabled accounts, wrong passwords, duplicate sessions, and missing profiles. Confirm that the router applies the expected response rather than silently using a local default.
If local and RADIUS users are both enabled, document the authentication order and avoid duplicate usernames. A local recovery account should be protected and restricted, not used as a substitute for centralized customer management.
Step 5: Configure accounting
Accounting allows the provider to see what happened after authentication. Enable start, interim, and stop records according to the billing and reporting requirements.
Accounting data may include:
•Username
•Session ID
•Login time
•Logout time
•Session duration
•Assigned IP address
•Upload traffic
•Download traffic
•Router or location
•Termination reason
Interim updates provide periodic information about active sessions. They are useful for quota enforcement, customer support, and real-time usage visibility.
Test accounting by opening a session, waiting for an interim record, disconnecting, and verifying the stop record. If a router goes offline, records may be delayed or incomplete, so staff should check the router and account before making a final billing decision.
Bandwidth throttling with MikroTik and RADIUS
A RADIUS response can assign a speed policy that MikroTik enforces through its PPP, HotSpot, queue, or profile system. The exact attribute and behavior depend on the service type and configuration.
For PPPoE customers, the policy may map to a PPP profile or return speed attributes. For HotSpot users, the policy may map to a user profile, time limit, data limit, or rate rule.
Test both directions. A common mistake is to reverse upload and download values, causing customers to receive the wrong service.
Also test:
•Single device
•Multiple devices
•Peak traffic
•Burst behavior
•Active-session policy changes
•Reconnection after plan change
•Router reboot
•RADIUS timeout
•Full IP pool
•Quota exhaustion
Do not assume that a profile change affects an active session immediately. Some changes apply on the next login unless the session is reauthorized or disconnected.
Shared bandwidth and fair-use policies
An ISP must decide whether speed limits apply per user, per device, per account, or across a shared customer group.
A residential account may allow several household devices to share one plan. A business package may need a predictable rate and priority. A public hotspot may use vouchers with time or data allowances.
Fair-use policies should be written in customer-friendly language. Explain what happens after a quota is reached, whether the speed changes, whether access stops, when the allowance resets, and how a customer can upgrade.
Avoid advertising a speed that is technically available only for a short burst if the customer expects sustained performance. Review peak usage, upstream capacity, and customer experience together.
Connecting billing status to RADIUS authorization
The billing platform should manage the commercial state, while RADIUS and MikroTik enforce access.
A normal lifecycle might work like this:
1.Customer registers.
2.Provider assigns a package.
3.Installation and first payment are approved.
4.RADIUS authorization is created or enabled.
5.MikroTik authenticates the customer.
6.The package profile applies bandwidth rules.
7.Billing creates renewal invoices.
8.Payment renews the account.
9.If payment is late, the account enters a grace period.
10.After the grace period, a restricted or suspended policy applies.
11.After payment, the normal policy is restored.
Use clear internal states such as pending, active, grace, overdue, suspended, refunded, and cancelled. Do not allow a payment screenshot or unverified transaction to change access automatically.
Providers evaluating billing-to-RADIUS workflows can
PPPoE bandwidth throttling
PPPoE is often used for fixed wireless, fiber, apartment, and residential broadband subscribers.
A PPPoE plan can apply:
•Upload and download rate
•IP pool
•Session timeout
•Idle timeout
•Static IP option
•Simultaneous session rule
•Priority or queue behavior
•Expiry or restricted profile
The provider should test the customer router, PPPoE client, MTU, DNS, NAT, routing, and speed policy together. A correct RADIUS response cannot fix an upstream capacity problem or a misconfigured VLAN.
When a customer upgrades, determine whether the active session should be disconnected, reauthorized, or allowed to continue until the next login. Communicate the expected timing to the customer.
HotSpot bandwidth throttling
HotSpot packages can limit speed, time, data, devices, or a combination of these policies.
A voucher package may provide one hour of access at a defined speed. A daily package may include a data allowance. A premium package may allow more devices or a higher rate.
The captive portal should show the customer what was purchased and when it expires. If a data allowance is consumed, the system should apply the documented policy rather than leaving the account status unclear.
Monitor voucher usage and active sessions. A single shared code or device can consume more capacity than expected, so use appropriate device rules and fraud monitoring.
Troubleshooting RADIUS integration
Authentication fails for every customer
Check RADIUS server reachability, client IP, shared secret, firewall, authentication port, router time, server status, and logs. Confirm that the router is sending requests to the intended server.
One customer receives the wrong speed
Check the customer’s package, RADIUS reply, profile name, rate attribute, active session, and any local override. Verify upload and download direction.
Customers authenticate but have no internet
Check IP assignment, routing, DNS, NAT, firewall forwarding, VLANs, gateway reachability, and upstream connectivity.
Accounting records are missing
Check accounting settings, port, shared secret, interim interval, server logs, router connectivity, and whether the session closed correctly.
Suspension does not disconnect a user
Check whether the billing status changed, whether RADIUS rejects new sessions, and whether active sessions require an explicit disconnect or reauthorization.
The IP pool is exhausted
Review active sessions, pool size, stale leases, address planning, and the subscriber forecast. Do not solve a capacity problem by creating overlapping pools.
Bandwidth is not enforced
Check the returned attribute, plan-to-profile mapping, MikroTik queue or profile behavior, active session state, and test traffic from more than one device.
Security best practices
Protect the RADIUS server, MikroTik routers, billing platform, and customer records as critical infrastructure.
Use strong administrator credentials, separate staff roles, secure management paths, unique shared secrets, firewall restrictions, and regular updates.
Protect API keys, RADIUS secrets, certificates, payment credentials, database passwords, and backups. Never place them in public JavaScript, front-end code, screenshots, or ordinary support messages.
Monitor repeated authentication failures, unusual simultaneous sessions, unexpected profile changes, mass suspensions, and spikes in provisioning activity.
Back up RADIUS configuration, customer records, invoices, package profiles, RouterOS configuration, and integration settings. Test restoration and keep an emergency recovery procedure.
For providers comparing secure access and billing workflows,
Monitoring and reports
A RADIUS-enabled ISP billing system should show both commercial and network indicators.
Track:
•Active subscribers
•Active sessions
•Authentication accepts and rejects
•RADIUS response time
•Accounting gaps
•IP pool utilization
•Bandwidth usage by plan
•Peak traffic
•Data quota consumption
•Overdue accounts
•Suspended customers
•Renewals
•Churn
•Support requests
•Revenue by plan and location
Reports help the provider decide whether to adjust pricing, change a package, add capacity, investigate abuse, or contact a customer.
Do not treat usage data as perfectly real-time when a router is offline or accounting updates are delayed. Document the reporting delay and use reconciliation for exceptions.
How to choose an ISP billing platform for RADIUS
When evaluating a platform, ask it to demonstrate:
1.Customer creation
2.Package assignment
3.RADIUS user authorization
4.PPPoE login
5.HotSpot login
6.Bandwidth profile application
7.Session accounting
8.Payment renewal
9.Grace-period policy
10.Suspension
11.Active-session handling
12.Restoration after payment
13.Reporting and export
14.Staff roles and audit logs
Also confirm support for your router model, RouterOS version, RADIUS design, payment methods, country, currencies, subscriber volume, and locations.
To compare ISP billing workflows,
Implementation roadmap
Phase 1: Inventory the network
Document routers, access services, VLANs, IP pools, RADIUS clients, packages, and current local users.
Phase 2: Standardize packages
Map every commercial plan to a tested bandwidth, IP, session, quota, and expiry policy.
Phase 3: Deploy one RADIUS client
Connect one MikroTik router, test one PPPoE or HotSpot service, and verify authentication, authorization, accounting, and throttling.
Phase 4: Connect billing status
Test activation, renewal, overdue, grace, suspension, restoration, refund, and manual extension workflows.
Phase 5: Monitor and tune
Review peak usage, customer experience, IP pools, support tickets, accounting, and profile behavior.
Phase 6: Expand gradually
Add routers, locations, packages, agents, and customers after the pilot has been stable.
Common mistakes to avoid
Do not configure bandwidth policies without testing upload and download direction.
Do not assume the RADIUS server alone can fix network congestion. Review upstream capacity, access-point limits, router CPU, queues, and peak demand.
Do not ignore accounting. Without reliable session records, quota, support, and reporting become less accurate.
Do not suspend a customer without checking payment confirmation, grace rules, active sessions, and time zones.
Do not use the same shared secret across every device if unique secrets are practical.
Do not give every employee router or RADIUS administration access.
Do not create overlapping IP pools or unclear commercial-to-profile mappings.
Do not launch automation without backups and a recovery plan.
Conclusion
RADIUS server integration and bandwidth throttling give ISPs centralized control over subscriber access, service quality, and network capacity. When connected to an ISP billing platform, customer plans and payment status can determine the profile, speed, quota, IP assignment, session rules, and expiry behavior applied by MikroTik.
A reliable deployment starts with clear packages, a documented network, secure RADIUS clients, tested authorization attributes, accurate accounting, payment-linked status rules, monitoring, and a staged rollout.
Start with one router and a small customer group. Test PPPoE and HotSpot access, speed enforcement, session accounting, upgrades, expiry, suspension, and restoration before expanding.
To evaluate ISP billing and RADIUS workflows,
Frequently asked questions
What is RADIUS integration for an ISP?
RADIUS integration connects routers or access gateways to a central server that authenticates customers, returns authorization policies, and records session accounting.
How does RADIUS control bandwidth?
The RADIUS response can return or map to a speed, queue, profile, or service policy. MikroTik then applies the configured upload and download limits to the customer session.
Can RADIUS work with MikroTik PPPoE?
Yes. MikroTik PPPoE can use RADIUS for subscriber authentication, authorization, and accounting. Test the exact attributes and active-session behavior on the installed RouterOS version.
Can RADIUS work with MikroTik HotSpot?
Yes. HotSpot users and vouchers can be authenticated through RADIUS, with policies for speed, time, data, devices, and expiry where supported by the configuration.
What is the difference between throttling and suspension?
Throttling limits the connection speed or usage. Suspension blocks access according to the provider’s policy. A grace-period profile may throttle or restrict a customer before full suspension.
Why are RADIUS accounting records important?
Accounting records provide session and usage information for customer support, quotas, reports, capacity planning, and billing-related review.
Can a billing platform change a customer’s speed after payment?
When the platform integrates with RADIUS or MikroTik provisioning, a confirmed payment or plan change can update the customer’s authorization profile. Active sessions may need reauthorization or reconnection.
How do I choose between SopraEnt and Xenfi?
Compare current features, RADIUS and MikroTik compatibility, package management, payment support, reporting, staff roles, country availability, support, and recovery processes. You can
