1. Introduction

For a gentle and quick tutorial on how to setup and configure BlissRADIUS™, we will examine a case of an small Internet service provider.

Our ISP services number of wireless as well as LAN clients. It uses MikroTik routers and Microsoft Windows® server for BlissRADIUS™ hosting. Clients are authenticated using PPPoE authentication protocol.

Two account types are provided for clients:

  • Monthly prepaid package, with download and upload speed limited to 1 Mbit/sec. Client is automatically disconnected after period expires and can not reestablish session.

  • MB limit prepaid package, with default price of 1$ for 1Gb of downloaded data, with bandwidth limit set to 6 Mbit/sec. Client is disconnected and disabled upon reaching set MB limit.

All clients are randomly assigned address in range from 1.1.1.10 to 1.1.1.255. This is example range and will not work in your case. You should use your available address range.

2. Network overview

Image shows basic network setup with RADIUS, one wireless and one LAN router. They are all connected using central router.

Here is description of RADIUS protocol and network utilization for administrators to take a note of:

images/network.png
Figure 1. Network setup
  • NAS is Network Access Server, an entry point for clients to authenticate and start session. In this setup we have 2 NAS servers, both are MikroTik.

  • Session is authenticated client connection that gives him Internet access. Session is not same as wireless connection that all wireless clients establish with their wireless routers.

  • RADIUS must be able to communicate with each NAS server using ports 1812 and 1813 and using static IP address or host name. Take special care if there is NAT or restrictive firewall between them. Properly route paths and add exceptions to firewall rules and test connections before continuing.

  • Clients never communicate with RADIUS server directly. They do communicate with NAS server for the whole duration of session.

  • NAS servers are mediators, they are the one communicate with both RADIUS server and clients.

  • In correctly configured network, RADIUS server is not a routing point, but an end point.

  • Restart or shutdown of RADIUS server does not interfere with existing client sessions, but it does restrict clients from (re)opening new sessions. If session is finished while RADIUS server is down, it will not be properly accounted.

  • Clients receive by default local IP address by DHCP. This address does not give them Internet access. They are required to authenticate and upon success, they will be assigned new address in range of 1.1.1.10 - 1.1.1.255 (example address range) that gives them Internet access. Network should be properly routed so this is possible.

3. NAS setup

Both MikroTik’s in network must be configured first. After log on using WinBox® this must be executed:

  • System → Identity string must be set to something meaningful. It will be known as NAS identifier. No two routers on network may share same NAS identifier.

  • Go to option RADIUS → + to add new RADIUS server. Set values to:

    • service = PPP

    • address = IP address of BlissRADIUS™ server

    • secret = chose secret password and remember it for later use

    • timeout = 1000ms-3000ms (if router is connected over slow or wireless network, you should increase this option to 3000ms or more)

  • Go to PPP → Secrets → AAA to enable accounting request and interim update. Interim update should be set to no less of 3 minutes.

  • Go to PPP → Interfaces → PPPoE to create PPPoE server. Set Authentication to PAP, CHAP or HTTP Digest as BlissRADIUS™ supports only them. Leave other options to default.

  • Go to SNMP → + and enable read only access from BlissRADIUS™ servers address. This is not crucial for system to work. Remember community string for later.

4. Configuring

BlissRADIUS should be set using browser. Login to Admin portal on http://localhost:8800 (replace address with RADIUS servers address). Enter admin as username and password.

There are couple of things that must be configured here:

  • setup NAS servers

  • create 2 account types

  • create couple of client accounts and activate them

Only then we can proceed to test connection.

5. Setting up NAS servers

This must be done for both MikroTik routers. Go to Administration → NAS and click on button Add.

Set options to: - NAS ID = NAS identifier that you have set previously during MikroTik setup

  • NAS IP address = NAS address

  • Secret = secret you have set

  • SNMP community = community string (optional)

  • Interim update interval = number of seconds you have set for this NAS.

Note Interim update interval setting is in minutes on MikroTik, BlissRADIUS™ uses seconds.
  • NAS type = MikroTik

Leave rest of the options to default. Upon finishing this you should see 2 MikroTik routers on NAS server list.

6. Creating account types

For a first type of account (a monthly limited) go to Administration → Types of accounts and click Add button. Set options to:

  • Name = Monthly account or something else you like

  • Limit interval = yes

  • Assigned IP address = 1.1.1.10-255 (here we define IP address pool clients will receive upon authentication).

  • RADIUS response = Mikrotik-Rate-Limit=1M/1M (limit speed)

Then create second type of account with options:

  • Name = MB account

  • Limit MB = yes

  • Assigned IP address = 1.1.1.10-255

  • RADIUS response = Mikrotik-Rate-Limit=6M/6M (limit speed)

  • Price = 1.00

  • MB total = 1024.00

Note Use this link to check MikroTik documentation on avaliable RADIUS attributes.

7. Creating client accounts

Go to Users → Search and click Add button. Select username and one of two created account types.

After creating client account, you must click on Add payment button and create default payment.

When done, a green indicator under Active field will show that client account is ready for use.

8. Testing

By here, BlissRADIUS™ and NAS servers are configured for use. Now it is time to try to connect using one of created client accounts. Using clients computer, do the following:

  • Create PPPoE connection. Use username and password of client account you just have created. Under authentication settings set Encryption to optional, and use only PAP and CHAP encryption.

  • Try to connect. If everything is right, you should receive indicator of new connection, and have a new IP address assigned (one in range of 1.1.1.10 - 1.1.1.255).

  • Try opening some web page.

Warning Again, IP address range is just an example and will not work with your network setup. You must set address range to something appliable to your case.

If this failed then open NAS using WinBox and open RADIUS settings. Click on Status tab and check counters.

  • If counters do not increment on connection attempts then there is problem in connection between NAS and client, or client connection is not configured properly, or NAS PPPoE server is not set right. Check client connection again. Try to ping NAS server from client computer.

  • If counter with failures is incrementing then there is problem in communication between NAS nad BlissRADIUS™. Try to ping BlissRADIUS™ from NAS. Check address and secret settings on BlissRADIUS™ and NAS.

  • If counter with rejects is incrementing then the problem is probably with client account setting or password. Login to BlissRADIUS™ admin portal and go to Monitoring → Log*. Set Hide disabled accounts option to No and click Refresh button. There should be useful message describing why client connection attempt has been rejected.