What Are RADIUS Attributes?

RADIUS (Remote Authentication Dial-In User Service) attributes are the building blocks of every RADIUS packet. They carry all the information exchanged between a Network Access Server (NAS) and a RADIUS server like OneRADIUS. Whether it is authenticating a broadband subscriber, authorising bandwidth limits, or accounting for session data — attributes make it all possible.

For ISPs in India managing thousands of subscribers, understanding RADIUS attributes is not optional. It is fundamental to delivering reliable, scalable, and billing-accurate internet services.

---

How RADIUS Attributes Work

RADIUS attributes are encoded in Type-Length-Value (TLV) format inside RADIUS packets. Each attribute has:

  • **Type**: A number (1–255) identifying the attribute
  • **Length**: Total size of the attribute in bytes
  • **Value**: The actual data being transmitted

When a subscriber connects, the NAS sends an Access-Request packet to OneRADIUS containing attributes like username, password, and NAS IP. OneRADIUS evaluates these and responds with an Access-Accept, Access-Reject, or Access-Challenge — each containing relevant attributes.

💡 OneRADIUS supports all standard RADIUS attributes as defined in RFC 2865 and RFC 2866, plus vendor-specific attributes (VSAs) for major NAS hardware used in India.

---

Types of RADIUS Attributes

1. Standard RADIUS Attributes (RFC 2865 & RFC 2866)

These are universally recognised attributes defined by the IETF. Every RADIUS-compliant server and NAS must support them.

Common Authentication Attributes:

  • **User-Name (Attribute 1)**: The subscriber's username sent in the Access-Request
  • **User-Password (Attribute 2)**: Encrypted password of the user
  • **CHAP-Password (Attribute 3)**: Used in CHAP authentication method
  • **NAS-IP-Address (Attribute 4)**: IP address of the NAS device
  • **NAS-Port (Attribute 5)**: Physical or virtual port the user is connected to
  • **Service-Type (Attribute 6)**: Type of service requested (Framed, Login, etc.)
  • **Framed-Protocol (Attribute 7)**: Protocol used — typically PPP for broadband
  • **Framed-IP-Address (Attribute 8)**: IP address assigned to the subscriber
  • **Framed-IP-Netmask (Attribute 9)**: Subnet mask for the framed route
  • **Framed-Routing (Attribute 10)**: Routing method for the subscriber
  • **Filter-Id (Attribute 11)**: Name of the filter list to apply
  • **Framed-MTU (Attribute 12)**: Maximum Transmission Unit for the connection
  • **Reply-Message (Attribute 18)**: Text message sent back to the user
  • **Called-Station-Id (Attribute 30)**: MAC or phone number of the called station
  • **Calling-Station-Id (Attribute 31)**: MAC or phone number of the calling station
  • **NAS-Identifier (Attribute 32)**: String identifying the NAS device
  • **Proxy-State (Attribute 33)**: Used for RADIUS proxy chaining
  • **Session-Timeout (Attribute 27)**: Maximum session duration in seconds
  • **Idle-Timeout (Attribute 28)**: Time before an idle session is disconnected
  • **Termination-Action (Attribute 29)**: What happens when session ends
  • **NAS-Port-Type (Attribute 61)**: Type of port (Ethernet, Wireless, xDSL, etc.)

Common Accounting Attributes (RFC 2866):

  • **Acct-Status-Type (Attribute 40)**: Start, Stop, or Interim-Update
  • **Acct-Delay-Time (Attribute 41)**: Seconds the NAS tried to send the packet
  • **Acct-Input-Octets (Attribute 42)**: Bytes received from the subscriber
  • **Acct-Output-Octets (Attribute 43)**: Bytes sent to the subscriber
  • **Acct-Session-Id (Attribute 44)**: Unique ID for the accounting session
  • **Acct-Authentic (Attribute 45)**: How the user was authenticated
  • **Acct-Session-Time (Attribute 46)**: Duration of the session in seconds
  • **Acct-Input-Packets (Attribute 47)**: Packets received from subscriber
  • **Acct-Output-Packets (Attribute 48)**: Packets sent to subscriber
  • **Acct-Terminate-Cause (Attribute 49)**: Reason for session termination
  • **Acct-Multi-Session-Id (Attribute 50)**: Links multiple related sessions
  • **Acct-Link-Count (Attribute 51)**: Number of links in a multilink session
  • **Acct-Input-Gigawords (Attribute 52)**: Upper 32 bits of input octets
  • **Acct-Output-Gigawords (Attribute 53)**: Upper 32 bits of output octets
💡 For ISPs doing data-capped plans (FUP), always use both Acct-Input-Octets + Acct-Input-Gigawords together for accurate usage tracking above 4GB.

---

2. Vendor-Specific Attributes (VSAs)

VSAs (Attribute 26) allow hardware vendors to extend RADIUS with custom attributes. ISPs in India commonly work with NAS devices from MikroTik, Cisco, Huawei, ZTE, DASAN/Zhone, and others — each with their own VSA dictionary.

MikroTik VSAs (Vendor ID: 14988):

  • **Mikrotik-Rate-Limit**: Defines upload/download speed (e.g., '10M/20M')
  • **Mikrotik-Mark**: Packet mark for traffic shaping
  • **Mikrotik-Advertise-URL**: Captive portal redirect URL
  • **Mikrotik-Recv-Limit**: Total download data cap
  • **Mikrotik-Xmit-Limit**: Total upload data cap
  • **Mikrotik-Group**: Assigns user to a MikroTik user group

Cisco VSAs (Vendor ID: 9):

  • **Cisco-AVPair**: Extremely flexible attribute for ACLs, QoS, VPN, and more
  • **Cisco-NAS-Port**: Extended NAS port information
  • **h323-credit-amount**: Used for prepaid voice/data billing

Huawei VSAs (Vendor ID: 2011):

  • **Huawei-Input-Average-Rate**: Subscriber download CIR
  • **Huawei-Output-Average-Rate**: Subscriber upload CIR
  • **Huawei-Input-Peak-Rate**: Peak download rate
  • **Huawei-Output-Peak-Rate**: Peak upload rate
  • **Huawei-Subscriber-QoS-Profile**: Name of the QoS profile to apply
  • **Huawei-Web-Self-Service-URL**: Subscriber self-service portal URL
⚠️ Always load the correct VSA dictionary in OneRADIUS for your NAS vendor. Using wrong or missing dictionaries will cause attributes to be ignored or misinterpreted by the NAS.

---

3. Extended RADIUS Attributes (RFC 6929)

For large ISPs needing more than 255 attribute types, RFC 6929 introduced extended attributes using a nested TLV structure. OneRADIUS supports this for modern deployments requiring advanced policy control.

---

RADIUS Attribute Usage by Packet Type

Access-Request Packet

Sent by the NAS to OneRADIUS when a subscriber tries to connect:

  • User-Name
  • User-Password or CHAP-Password
  • NAS-IP-Address
  • NAS-Port
  • NAS-Port-Type
  • Called-Station-Id
  • Calling-Station-Id
  • Framed-Protocol

Access-Accept Packet

Sent by OneRADIUS when authentication succeeds:

  • Framed-IP-Address
  • Framed-IP-Netmask
  • Session-Timeout
  • Idle-Timeout
  • Service-Type
  • Mikrotik-Rate-Limit (or equivalent VSA)
  • Reply-Message

Access-Reject Packet

Sent by OneRADIUS when authentication fails:

  • Reply-Message (with reason)

Accounting-Request Packet (Start)

Sent by NAS when a session begins:

  • Acct-Status-Type = Start
  • Acct-Session-Id
  • User-Name
  • Framed-IP-Address
  • NAS-IP-Address
  • NAS-Port

Accounting-Request Packet (Interim-Update)

Sent periodically during an active session:

  • Acct-Status-Type = Interim-Update
  • Acct-Session-Time
  • Acct-Input-Octets
  • Acct-Output-Octets
  • Acct-Input-Gigawords
  • Acct-Output-Gigawords

Accounting-Request Packet (Stop)

Sent by NAS when a session ends:

  • Acct-Status-Type = Stop
  • Acct-Terminate-Cause
  • Acct-Session-Time
  • Acct-Input-Octets
  • Acct-Output-Octets
💡 In OneRADIUS, you can configure **Interim-Update intervals** per NAS to control how frequently usage data is received and updated in the billing system.

---

Key RADIUS Attributes for ISP Billing and Plan Management

Bandwidth Control

For ISPs delivering tiered broadband plans, bandwidth control via RADIUS is essential. Using Mikrotik-Rate-Limit or Huawei QoS VSAs, OneRADIUS can dynamically assign speed limits based on the subscriber's active plan — no manual NAS configuration needed.

Example for a 50 Mbps plan on MikroTik:

Mikrotik-Rate-Limit = '50M/50M'

Example burst configuration:

Mikrotik-Rate-Limit = '50M/50M 100M/100M 50M/50M 1/1 5 75M/75M'

Session and Idle Timeout

  • **Session-Timeout**: Forces re-authentication after a set time — useful for FUP plan enforcement
  • **Idle-Timeout**: Disconnects inactive sessions to free up NAS resources and IP pools
⚠️ Setting Session-Timeout too low (e.g., under 300 seconds) can cause frequent reconnections and a poor subscriber experience. Plan-level timeouts in OneRADIUS should align with your billing cycle logic.

IP Address Management

  • **Framed-IP-Address**: Assign a static IP to a subscriber directly from RADIUS
  • Use '255.255.255.254' to instruct the NAS to use its own IP pool
  • OneRADIUS supports **IP pool management** per NAS and per plan, automatically assigning and releasing IPs

FUP (Fair Usage Policy) Enforcement

For data-capped plans, OneRADIUS tracks usage using accounting attributes. When a subscriber hits their data limit:

  1. OneRADIUS updates the subscriber profile
  2. On the next CoA (Change of Authorization) or re-authentication, it sends reduced speed attributes
  3. The NAS applies the new rate limit automatically

This FUP enforcement workflow uses these attributes:

  • Acct-Input-Octets + Acct-Input-Gigawords (to track data)
  • Mikrotik-Rate-Limit (to apply reduced speed post-FUP)
  • Session-Timeout (to force re-auth)

---

Change of Authorization (CoA) — Dynamic Attribute Updates

CoA is defined in RFC 3576 and extended in RFC 5176. It allows OneRADIUS to push attribute changes to an active session without disconnecting the subscriber.

Common CoA use cases for ISPs:

  • Upgrading subscriber speed mid-session after a plan change
  • Applying FUP speed reduction when data cap is hit
  • Pushing a captive portal URL for bill payment reminder
  • Enabling or disabling services dynamically

CoA Packet attributes typically include:

  • NAS-IP-Address
  • Acct-Session-Id or User-Name (to identify the session)
  • New VSA attributes (e.g., new Mikrotik-Rate-Limit)
💡 OneRADIUS has built-in CoA support. You can trigger CoA actions from the subscriber management dashboard or automate them through billing plan logic and FUP thresholds.

Disconnect Message (DM):

A special CoA variant that forces a session to terminate. Used when a subscriber's account is suspended or a prepaid balance runs out.

---

RADIUS Attribute Configuration in OneRADIUS

Setting Up Reply Attributes per Plan

In OneRADIUS, each service plan can have a predefined set of reply attributes. When a subscriber on that plan authenticates, OneRADIUS automatically includes those attributes in the Access-Accept response.

Steps to configure plan-level attributes in OneRADIUS:

  1. Log in to the OneRADIUS admin panel
  2. Navigate to **Plans > Create/Edit Plan**
  3. Under 'RADIUS Reply Attributes', add required attributes
  4. Set VSA values based on your NAS vendor
  5. Save and apply to subscriber profiles

Per-Subscriber Override Attributes

Some subscribers may need custom attributes (e.g., static IP, custom rate limit). OneRADIUS allows per-subscriber attribute overrides that take precedence over plan-level attributes.

NAS-Specific Attribute Profiles

Different NAS devices require different VSAs. OneRADIUS lets you create NAS profiles with vendor-specific attribute dictionaries, so the right attributes are sent to the right NAS automatically.

⚠️ Never send MikroTik VSAs to a Huawei NAS or vice versa. OneRADIUS NAS profiles prevent this automatically when configured correctly.

---

Common RADIUS Attribute Errors ISPs Face

Error 1: Attributes Being Ignored by NAS

Cause: Wrong VSA dictionary or unsupported attribute for that NAS firmware

Fix: Verify the NAS firmware version and load the correct dictionary in OneRADIUS

Error 2: Wrong IP Assignment

Cause: Framed-IP-Address conflict or pool misconfiguration

Fix: Use OneRADIUS IP pool management with proper range definitions and lease tracking

Error 3: Bandwidth Limits Not Applied

Cause: Rate-limit VSA format mismatch or NAS not configured to use RADIUS-assigned queues

Fix: Check MikroTik queue type — use 'PCQ' or 'Simple Queue' as required and verify VSA syntax

Error 4: Accounting Data Gaps

Cause: Interim-Update interval too long or accounting packets being dropped

Fix: Set Interim-Update to 300–600 seconds and ensure accounting port (1813) is accessible

Error 5: FUP Not Triggering

Cause: Gigaword overflow not being tracked (sessions with >4GB usage)

Fix: Always configure OneRADIUS to sum Acct-Input-Octets + (Acct-Input-Gigawords x 2^32)

---

RADIUS Attributes Reference Table for ISPs

Quick Reference — Most Used Attributes

  • **Attribute 1** — User-Name — Authentication
  • **Attribute 4** — NAS-IP-Address — Authentication
  • **Attribute 6** — Service-Type — Authorization
  • **Attribute 7** — Framed-Protocol — Authorization
  • **Attribute 8** — Framed-IP-Address — Authorization
  • **Attribute 27** — Session-Timeout — Authorization
  • **Attribute 28** — Idle-Timeout — Authorization
  • **Attribute 40** — Acct-Status-Type — Accounting
  • **Attribute 42** — Acct-Input-Octets — Accounting
  • **Attribute 43** — Acct-Output-Octets — Accounting
  • **Attribute 44** — Acct-Session-Id — Accounting
  • **Attribute 46** — Acct-Session-Time — Accounting
  • **Attribute 49** — Acct-Terminate-Cause — Accounting
  • **Attribute 52** — Acct-Input-Gigawords — Accounting
  • **Attribute 53** — Acct-Output-Gigawords — Accounting
  • **Attribute 26** — Vendor-Specific — VSA Container

---

Best Practices for Managing RADIUS Attributes in ISP Networks

  • **Always use Gigaword attributes** alongside Octet attributes for high-usage subscribers to avoid 4GB rollover issues
  • **Set meaningful Reply-Messages** in Access-Reject packets so subscribers know why they cannot connect
  • **Use CoA instead of forced disconnects** wherever possible to improve subscriber experience
  • **Maintain updated VSA dictionaries** in OneRADIUS as NAS vendors release firmware updates
  • **Log all accounting attributes** for at least 90 days to meet TRAI compliance requirements in India
  • **Test new attribute configurations** in a staging NAS before rolling out to production
  • **Use NAS profiles in OneRADIUS** to avoid sending wrong VSAs to different NAS vendors
  • **Monitor Acct-Terminate-Cause** values to diagnose frequent disconnections proactively
  • **Audit subscriber attributes periodically** to ensure plan attributes match active subscriptions
💡 OneRADIUS provides a built-in attribute audit log and real-time session monitoring dashboard, making it easy for ISP network administrators to track and troubleshoot attribute-related issues.

---

Why OneRADIUS Is the Right Choice for ISPs Managing RADIUS Attributes

Managing RADIUS attributes manually across thousands of subscribers is complex and error-prone. OneRADIUS by ARCR Technologies simplifies this with:

  • **Plan-based attribute templates** — define once, apply across all subscribers on a plan
  • **Per-subscriber attribute overrides** — full flexibility for enterprise or special subscribers
  • **Multi-vendor NAS support** — MikroTik, Cisco, Huawei, ZTE, Dasan, and more
  • **Built-in FUP engine** — automatic attribute updates based on data consumption
  • **CoA and DM support** — dynamic session management without disconnection
  • **IP pool management** — integrated with Framed-IP-Address assignments
  • **Accounting data integrity** — accurate Gigaword tracking for high-volume users
  • **TRAI-compliant logging** — full accounting records for regulatory needs
  • **Made for Indian ISPs** — designed around the realities of India's broadband market

Whether you are a small WISP in Tier 3 India or a large fibre ISP managing lakh+ subscribers, OneRADIUS gives you complete control over every RADIUS attribute in your network.

---

Conclusion

RADIUS attributes are the language your AAA infrastructure speaks. Getting them right means accurate billing, consistent subscriber experience, effective FUP enforcement, and a well-managed network. From standard RFC attributes to vendor-specific extensions, every ISP must have a solid understanding of how these attributes work — and the right RADIUS server to manage them.

OneRADIUS makes RADIUS attribute management intuitive, scalable, and ISP-ready. Ready to take control of your AAA infrastructure? Visit oneradius.com to learn more or request a free demo today.