RADIUS vs. Local User Management for ISPs: Which Authentication Model Is Best?
Every internet service provider needs a reliable way to authenticate subscribers and control network access. A customer may connect through PPPoE, a MikroTik HotSpot, fixed wireless equipment, fiber access, or another gateway. The provider must decide where usernames, passwords, packages, speed policies, and account status will be managed.
The two common approaches are local user management and centralized RADIUS authentication. Local users are stored directly on the router or access device. RADIUS moves authentication, authorization, and accounting to a central server or platform.
Both approaches can work. The right choice depends on subscriber volume, number of routers, billing requirements, reporting, technical resources, security needs, and plans for growth.
Providers evaluating authentication and billing workflows can 
register for SopraEnt or 
explore a Xenfi billing account while comparing the best approach for their network.
What is local user management?
Local user management stores subscriber credentials and access policies on the network device itself. For example, a MikroTik router can contain PPP secrets for PPPoE customers or local HotSpot users for captive-portal access.
Each local user may have:
•Username and password
•Service type
•Access profile
•Speed limit
•IP address or pool
•Session timeout
•Device or caller-ID rule
•Comment or customer reference
•Account expiry behavior
The router checks the local record when the customer attempts to connect. If the credentials and policy are valid, the router establishes the session.
Local management is often straightforward for a small network. An administrator can create a user, assign a profile, and test the connection without deploying a separate authentication server.
What is RADIUS authentication?
RADIUS stands for Remote Authentication Dial-In User Service. It allows a network access device to send authentication requests to a central server.
RADIUS provides three commonly used functions:
•Authentication: confirms the identity of the subscriber.
•Authorization: returns the policy the subscriber should receive.
•Accounting: records session and usage information.
The access device may be a MikroTik router, PPPoE server, HotSpot gateway, wireless controller, VPN concentrator, or another supported network service.
A RADIUS server can connect to a billing and customer-management platform. This lets the provider manage customers, plans, payments, expiry, and network access from a more centralized workflow.
To compare centralized billing and access management, create a SopraEnt account or start with Xenfi.
Local users vs. RADIUS at a glance
Area | Local user management | RADIUS authentication |
Setup | Simple for one router | Requires server or platform configuration |
Best fit | Small or test networks | Growing or multi-router ISPs |
User storage | On each router | Centralized server or database |
Multi-router management | Manual synchronization | Centralized policy and credentials |
Billing integration | Usually more manual | Generally better suited to automation |
Accounting | Router-dependent and often limited | Centralized session and usage records |
Failure model | Works locally if router is available | Requires reliable RADIUS connectivity or fallback |
Staff permissions | Often limited by router access | Can be separated by platform roles |
Reporting | Basic or fragmented | More centralized and detailed |
Migration effort | Low at first | Higher initial planning and testing |
Advantages of local user management
Simple initial setup
Local users are usually easy to create on a MikroTik router. A small operator can configure a few accounts and profiles without installing another service.
Fewer dependencies
The router does not need to reach an external authentication server for every login. This can be useful in a temporary deployment, test environment, or isolated location.
Direct troubleshooting
An administrator can check the router’s user list, profile, active session, and logs in one place. For a small number of accounts, this may be faster than troubleshooting multiple systems.
Suitable for a pilot
Local users can help validate the access network before the provider introduces centralized billing, RADIUS, and automated account management.
Limitations of local user management
Difficult multi-router administration
When users are stored on several routers, staff must create and update accounts on each device. A plan change may be applied to one router but missed on another.
Fragmented customer records
The router user list is not a complete customer-management system. It may not include invoices, payment history, installation details, support requests, equipment, or communication records.
Limited reporting
Local router records may show active sessions, but they may not provide centralized revenue, churn, payment, plan, agent, or customer reports.
Higher risk of inconsistent policies
Different routers may contain different profile names, speed settings, passwords, or expiry rules. These differences can create unpredictable customer experiences.
Greater dependence on administrative access
If many employees need to manage users locally, more people may require access to router management interfaces. This increases the importance of secure credentials, role separation, and audit procedures.
Advantages of RADIUS authentication
Centralized subscriber access
RADIUS lets the provider keep credentials and access policies in one place. A subscriber can connect through a supported router or location without requiring a separate local user record on every device.
Better support for multiple routers
A growing ISP can add access devices while maintaining a centralized authentication workflow. This is useful for PPPoE networks, multiple HotSpot locations, towers, buildings, and service areas.
Flexible authorization
RADIUS can return speed limits, IP pools, session timeouts, device limits, service profiles, and other supported attributes. The policy can be based on the subscriber’s plan or account status.
Session and usage accounting
RADIUS accounting can record login time, logout time, duration, assigned IP, traffic, router, location, and termination reason. This helps support, billing, quota management, and capacity planning.
Stronger billing integration
A billing platform can update account status or service policy after a payment, renewal, expiry, or suspension. This makes it easier to connect commercial records with network access.
For ISPs that want to evaluate a centralized workflow, register for SopraEnt or open a Xenfi billing account and test the customer-to-network process.
Limitations and risks of RADIUS
More initial complexity
RADIUS requires configuration on the server and network access device. The provider must set shared secrets, trusted addresses, authentication methods, attributes, accounting, and firewall rules.
Dependence on connectivity
If the router cannot reach the RADIUS server, new users may fail to authenticate. The provider must choose a clear timeout, fallback, fail-open, or fail-closed policy.
Troubleshooting across multiple layers
A login failure may come from the customer credentials, router configuration, VLAN, shared secret, firewall, RADIUS server, database, billing status, or returned attribute. Staff need a documented troubleshooting process.
Accounting may be delayed or incomplete
If a router is offline or a session does not close correctly, usage records may arrive late. The provider should not treat one stale session record as final evidence without checking the router and account.
Security must be designed carefully
Protect RADIUS shared secrets, server credentials, APIs, certificates, databases, and management interfaces. Restrict which network devices may send requests and monitor unusual authentication activity.
Which option is best for a small ISP?
A small ISP with one router and a limited number of subscribers may begin with local users. This can reduce setup time while the provider validates demand, packages, and network performance.
However, the provider should still maintain a separate customer and billing record. Do not treat the router user list as the only source of truth for customer information or payment status.
If growth is expected, introduce RADIUS early enough to establish consistent policies before the number of routers and customers becomes difficult to migrate.
Which option is best for a growing ISP?
RADIUS is usually more suitable when the provider manages multiple routers, locations, access services, staff members, or customer plans.
Centralized authentication makes it easier to:
•Add new routers
•Apply plan changes
•Suspend overdue accounts
•Renew paid customers
•Record sessions
•Manage packages
•Produce reports
•Restrict staff permissions
•Investigate compromised credentials
The provider still needs reliable network design, monitoring, backups, and recovery procedures. Centralization improves control but does not remove operational responsibility.
RADIUS for MikroTik PPPoE
In a MikroTik PPPoE deployment, the router accepts the subscriber connection and sends credentials to RADIUS. The response determines whether the session is accepted and which attributes are applied.
A plan may return:
•Upload and download speed
•IP address or pool
•Session timeout
•Idle timeout
•Simultaneous-use limit
•Service profile
•Data or time restriction
When a customer upgrades a plan, the billing or customer system can update the service record. Depending on the configuration, the new policy may apply on the next login or after the active session is reauthorized or disconnected.
Always test whether plan changes affect active sessions. A customer who has paid for a higher speed should not remain on the old policy because the session was never refreshed.
RADIUS for MikroTik HotSpot
MikroTik HotSpot users may authenticate through a captive portal using usernames, passwords, vouchers, or customer accounts. RADIUS can centralize those credentials and return policies for time, speed, data, device, or location.
This is particularly useful when a WiFi business operates multiple cafés, hotels, buildings, public hotspots, or reseller locations.
A voucher or package record can include the payment status, activation, expiry, package, device relationship, router, and session information. The billing platform can control the commercial side while the HotSpot gateway enforces access.
Billing, payments, and account status
The best architecture separates responsibilities while keeping systems connected.
The billing platform should manage:
•Customer profile
•Service plan
•Invoice
•Payment status
•Expiry date
•Grace period
•Renewal
•Suspension policy
The network access system should manage:
•Authentication
•Session establishment
•IP assignment
•Bandwidth enforcement
•Device limits
•Accounting
•Disconnection
When payment is confirmed, the account can be renewed. When payment is overdue, the account may enter a grace period and later receive a restricted profile or suspension.
Do not activate access based on an unverified payment screenshot. Distinguish between pending, completed, failed, refunded, reversed, and unmatched transactions.
Security comparison
Local users and RADIUS can both be secure or insecure depending on implementation.
Local-user security checklist
•Use unique credentials.
•Protect router management access.
•Limit staff permissions.
•Disable unused accounts.
•Back up configuration securely.
•Review local users regularly.
•Keep public subscriber traffic separate from management access.
RADIUS security checklist
•Use strong, unique shared secrets.
•Restrict RADIUS requests by source address.
•Protect the server and database.
•Secure APIs and certificates.
•Limit management access.
•Monitor authentication failures.
•Back up configuration and customer data.
•Test failover and recovery.
Do not expose router or RADIUS administration interfaces to the public WiFi network. Use secure management paths and document who may change access policies.
How to migrate from local users to RADIUS
Step 1: Inventory local accounts
Export or document usernames, profiles, addresses, expiry dates, plan assignments, and customer references from every router.
Step 2: Clean the records
Remove duplicates, inactive accounts, unknown users, incorrect plan names, and missing customer information. Reconcile payment status before migration.
Step 3: Standardize plans
Create a clear mapping between commercial plans and RADIUS or MikroTik profiles. Confirm speed, IP, device, session, and quota behavior.
Step 4: Deploy a test RADIUS environment
Use one router and a small customer group. Test successful and failed authentication, accounting, plan assignment, expiry, suspension, and restoration.
Step 5: Run local and centralized systems carefully
During a transition, document which users authenticate locally and which use RADIUS. Avoid duplicate usernames and conflicting policies.
Step 6: Expand in stages
Migrate one location or router at a time. Review logs, support requests, customer access, and billing status after each stage.
Common mistakes to avoid
Do not adopt RADIUS without documenting the failure policy. Decide what happens when the server or network path is unavailable.
Do not leave old local accounts active after migration unless they are required for a protected recovery process.
Do not assume that authentication proves accounting is working. Verify start, interim, and stop records.
Do not change speed attributes without testing upload and download direction.
Do not create multiple commercial plan names for the same network policy. Keep package and profile mapping consistent.
Do not enable automatic suspension before testing grace periods, refunds, manual extensions, active sessions, and payment delays.
Practical decision framework
Choose local user management when the network is small, the router count is low, the access service is simple, and the provider needs a quick starting point.
Choose RADIUS when the ISP has multiple routers, many subscribers, several locations, centralized billing, usage reporting, staff roles, reseller workflows, or plans for expansion.
A hybrid approach can also work during a transition. Keep a protected local emergency account while using RADIUS for normal subscriber authentication. Document the emergency path and restrict its use.
For providers comparing centralized ISP billing options, register with SopraEnt and explore Xenfi as part of the platform evaluation process.
Conclusion
Local user management is simple and can be appropriate for a small network or test deployment. RADIUS requires more planning but provides stronger centralization for growing ISPs, multi-router operations, billing integration, accounting, and consistent subscriber policies.
The decision should be based on the provider’s real requirements rather than on complexity alone. Consider customer volume, router count, network locations, payment workflow, support needs, security, reporting, and future growth.
Start with accurate subscriber records, clear service plans, secure authentication, reliable accounting, tested failure behavior, and a documented migration plan.
To evaluate billing and access-management options, register for SopraEnt or create a Xenfi account.
Frequently asked questions
Is RADIUS better than local user management?
RADIUS is usually better for growing or multi-router ISPs because it centralizes authentication, authorization, accounting, and policies. Local users may be sufficient for small or temporary networks.
Can MikroTik use local users and RADIUS together?
MikroTik deployments can be designed around local accounts, RADIUS, or a controlled fallback arrangement. Document the authentication order and avoid duplicate or conflicting users.
Does RADIUS handle billing by itself?
RADIUS provides authentication, authorization, and accounting. A separate billing or customer-management platform is usually used for invoices, payments, plans, renewals, and account status.
Can RADIUS suspend an overdue customer?
A billing platform can update the customer’s status, while RADIUS or the access device can reject new sessions, apply a restricted profile, or support disconnection according to the integration.
What is RADIUS accounting used for?
It records session and usage information such as login time, logout time, duration, IP address, traffic, router, and termination reason.
Should a small ISP start with RADIUS?
A small ISP can begin with local users, but RADIUS may be worthwhile if the provider expects multiple routers, many subscribers, centralized billing, or rapid growth.
How do I migrate local users to RADIUS?
Inventory and clean existing accounts, standardize plans, map profiles, test one router and a small group, verify accounting and billing, then migrate additional locations gradually.
Where can I compare ISP billing options?
Review platform features, pricing, country support, payment methods, router compatibility, customer management, reports, security, and support. You can register for SopraEnt or explore Xenfi as part of your evaluation.
