Introduction to Bandwidth Policies in RADIUS Server

For Internet Service Providers (ISPs) in India, managing subscriber bandwidth is one of the most critical operational tasks. Whether you are offering 10 Mbps home broadband or 1 Gbps enterprise leased lines, your RADIUS server must enforce the right speed limits for each subscriber — automatically, accurately, and in real time.

With OneRADIUS by ARCR Technologies, you can define granular bandwidth policies and assign them to users, plans, or groups — giving you complete control over your network without manual intervention at each NAS device.

In this guide, we will walk you through everything you need to know about configuring bandwidth policies in a RADIUS server, with practical steps suited for Indian ISPs using OneRADIUS.

---

What Are Bandwidth Policies in a RADIUS Server?

A bandwidth policy in a RADIUS server is a set of rules that defines the upload and download speed limits applied to a subscriber session. These policies are delivered to the Network Access Server (NAS) — such as a MikroTik router, Cisco device, or OLT — as RADIUS attributes during the authentication or accounting phase.

Bandwidth policies can be:

  • **Static** — Fixed speeds assigned permanently to a user account
  • **Dynamic** — Speed limits that change based on data usage, time of day, or plan expiry
  • **Group-based** — Applied to an entire group or plan, not individual users
  • **Profile-based** — Stored as reusable profiles and referenced during authentication
💡 OneRADIUS supports all four types of bandwidth policy assignment, making it ideal for ISPs with complex, multi-tier service plans.

---

Why Bandwidth Policy Configuration Matters for ISPs

Without proper bandwidth policy enforcement, ISPs face:

  • **Revenue leakage** — Subscribers using more bandwidth than their plan allows
  • **Network congestion** — Heavy users degrading the experience for others
  • **Customer complaints** — Due to inconsistent speeds across sessions
  • **Compliance issues** — TRAI regulations in India require ISPs to deliver promised speeds

Configuring bandwidth policies in your RADIUS server ensures per-subscriber speed enforcement at the network edge, without requiring changes at each router individually.

---

Prerequisites Before You Begin

Before configuring bandwidth policies in OneRADIUS, make sure you have:

  • **OneRADIUS installed and running** on your server (Linux/Windows)
  • **NAS devices configured** to send authentication requests to OneRADIUS
  • **RADIUS shared secrets** configured between OneRADIUS and your NAS
  • **Admin access** to the OneRADIUS web dashboard
  • Knowledge of the **VSA (Vendor-Specific Attributes)** supported by your NAS vendor
⚠️ Different NAS vendors use different RADIUS attributes to enforce bandwidth. MikroTik uses 'Mikrotik-Rate-Limit', while Cisco uses 'rate-limit' or policy maps. Always verify which VSAs your hardware supports before configuring policies.

---

Step 1: Understand RADIUS Attributes Used for Bandwidth Control

Bandwidth enforcement in RADIUS relies on specific attributes sent in the Access-Accept packet. Here are the most commonly used ones in Indian ISP environments:

Standard RADIUS Attributes

  • **WISPr-Bandwidth-Max-Down** — Maximum download speed in bps
  • **WISPr-Bandwidth-Max-Up** — Maximum upload speed in bps
  • **Filter-ID** — References a pre-configured policy or ACL on the NAS

MikroTik VSA (Most Common in India)

  • **Mikrotik-Rate-Limit** — Format: 'upload/download' e.g., '10M/20M'
  • **Mikrotik-Mark** — For packet marking and queue tree policies

Cisco VSA

  • **Cisco-AVPair = 'sub-qos-policy-in=PLAN_10MBPS'** — Applies a QoS policy map
  • **Cisco-AVPair = 'sub-qos-policy-out=PLAN_10MBPS'**

Huawei VSA (Common with OLTs)

  • **HW-Data-Filter** — References bandwidth profiles defined on the OLT
  • **HW-Input-Peak-Basic-Bandwidth** — Download speed in Kbps
  • **HW-Output-Peak-Basic-Bandwidth** — Upload speed in Kbps
💡 OneRADIUS includes a built-in VSA dictionary for MikroTik, Cisco, Huawei, ZTE, and other popular vendors, so you do not need to manually add attribute definitions.

---

Step 2: Create a Bandwidth Profile in OneRADIUS

OneRADIUS allows you to create reusable Bandwidth Profiles (also called Service Profiles or Plans) from the admin dashboard.

How to Create a Bandwidth Profile

  1. Log in to the **OneRADIUS Admin Dashboard**
  2. Navigate to **Configuration > Bandwidth Profiles** (or **Plans > Speed Profiles**)
  3. Click **'Add New Profile'**
  4. Fill in the following fields:
  • **Profile Name** — e.g., 'Broadband_20Mbps_Plan'
  • **Download Speed** — e.g., 20 Mbps
  • **Upload Speed** — e.g., 5 Mbps
  • **Burst Download Speed** — Optional: e.g., 40 Mbps for 10 seconds
  • **Burst Upload Speed** — Optional: e.g., 10 Mbps for 10 seconds
  • **NAS Type** — Select MikroTik / Cisco / Huawei etc.
  • **Attribute Mapping** — OneRADIUS auto-fills the correct RADIUS attributes based on NAS type
  1. Click **Save Profile**
💡 You can create unlimited bandwidth profiles in OneRADIUS — one for each plan tier you offer, including FUP (Fair Usage Policy) throttle profiles.

---

Step 3: Assign Bandwidth Profiles to Subscriber Plans

Once profiles are created, you need to link them to your subscriber plans.

Assigning Profile to a Plan

  1. Go to **Plans > Manage Plans** in OneRADIUS
  2. Select or create a plan (e.g., '20 Mbps Unlimited Monthly')
  3. Under **Speed Settings**, select the bandwidth profile you created
  4. Optionally, set a **FUP Profile** — the throttle speed applied after the data limit is reached (e.g., 1 Mbps after 100 GB)
  5. Save the plan

Now, any subscriber assigned to this plan will automatically receive the correct bandwidth attributes during RADIUS authentication.

⚠️ If you change a bandwidth profile that is already assigned to active subscribers, the new speed will only apply at the next session — not to currently active sessions unless you use RADIUS CoA (Change of Authorization) to push updates in real time.

---

Step 4: Assign Plans to Individual Subscribers

Manual Assignment

  1. Go to **Subscribers > Manage Users**
  2. Search for the subscriber by username, mobile number, or account ID
  3. Click **Edit**
  4. Under **Plan Assignment**, select the appropriate plan
  5. Save changes

Bulk Assignment

For large ISPs managing thousands of users, OneRADIUS supports CSV-based bulk import of subscriber plan assignments.

  1. Go to **Subscribers > Bulk Import**
  2. Download the CSV template
  3. Fill in username, plan name, and validity
  4. Upload the file
  5. OneRADIUS will process and assign plans to all listed users
💡 OneRADIUS also integrates with popular Indian ISP billing software, so plan assignments can be synced automatically when a subscriber pays or renews.

---

Step 5: Configure FUP (Fair Usage Policy) Bandwidth Throttling

FUP throttling is one of the most requested features for Indian ISPs. OneRADIUS supports automated FUP enforcement.

How FUP Works in OneRADIUS

  • Subscriber uses data normally at **full speed** (e.g., 20 Mbps)
  • Once they exceed the FUP limit (e.g., 100 GB), OneRADIUS **automatically switches** them to the throttle profile (e.g., 1 Mbps)
  • At the start of the next billing cycle, they are **automatically restored** to full speed

Setting Up FUP in OneRADIUS

  1. Create a **Throttle Bandwidth Profile** (e.g., 'FUP_1Mbps')
  2. In the subscriber plan, set the **FUP Data Limit** (e.g., 100 GB)
  3. Assign the **FUP Profile** (e.g., 'FUP_1Mbps') to the plan
  4. Enable **'Auto FUP Enforcement'** in plan settings

OneRADIUS monitors data usage via RADIUS Accounting and triggers CoA (Change of Authorization) packets to the NAS when the FUP limit is reached — no manual action needed.

⚠️ For FUP CoA to work, your NAS device must support RADIUS CoA/DM (RFC 3576). Most modern MikroTik, Cisco, and Huawei devices do. Verify this in your device documentation.

---

Step 6: Configure Time-Based Bandwidth Policies

Many Indian ISPs offer different speeds during off-peak hours (e.g., 2x speed between 2 AM and 8 AM). OneRADIUS supports time-based bandwidth switching.

Steps to Configure Time-Based Policies

  1. Go to **Configuration > Time Policies**
  2. Create a new Time Policy and define:
  • **Peak Hours** — e.g., 8 AM to 2 AM (standard speed applies)
  • **Off-Peak Hours** — e.g., 2 AM to 8 AM (bonus speed applies)
  1. Assign different **Bandwidth Profiles** to each time window
  2. Link the Time Policy to the subscriber plan

OneRADIUS will automatically send the appropriate speed attributes based on the time of day when the subscriber connects or reconnects.

---

Step 7: Use CoA to Apply Bandwidth Changes Without Disconnecting Users

RADIUS Change of Authorization (CoA) allows OneRADIUS to push bandwidth changes to active sessions without disconnecting the subscriber.

Use Cases for CoA in Bandwidth Management

  • **FUP limit reached** — Throttle speed without dropping the connection
  • **Plan upgrade** — Apply new speed immediately after payment
  • **Admin override** — Temporarily boost speed for a VIP customer
  • **Speed fix** — Correct a misconfigured speed without rebooting the router

Configuring CoA in OneRADIUS

  1. Go to **NAS Management > Edit NAS**
  2. Enable **CoA Support** for the NAS device
  3. Enter the **CoA Port** (default: 3799)
  4. Save settings

Now, whenever a bandwidth policy change is triggered — manually or automatically — OneRADIUS will send a CoA packet to the NAS to update the session in real time.

💡 OneRADIUS logs all CoA requests and responses, so you can audit every speed change applied to subscriber sessions.

---

Step 8: Test Your Bandwidth Policy Configuration

After setting up your bandwidth profiles and policies, always test before rolling out to live subscribers.

Testing Checklist

  • **Authenticate a test user** using radtest or the OneRADIUS built-in test tool
  • **Verify the Access-Accept packet** contains the correct bandwidth attributes
  • **Check the NAS** to confirm the speed queue or policy is applied to the session
  • **Run a speed test** from the subscriber end to confirm actual throughput
  • **Simulate FUP** by manually setting a low data limit and verifying throttling activates
  • **Test CoA** by triggering a plan change and confirming the speed updates without disconnection
⚠️ Always test on a staging NAS or a test subscriber account before applying changes to production. A misconfigured attribute can cause all subscriber authentications to fail.

---

Common Bandwidth Policy Issues and Fixes

Issue 1: Bandwidth Policy Not Being Applied

  • **Cause:** Wrong NAS type selected in OneRADIUS, so wrong VSAs are sent
  • **Fix:** Edit the bandwidth profile and select the correct NAS vendor

Issue 2: All Users Getting the Same Speed

  • **Cause:** A global default profile is overriding individual plan profiles
  • **Fix:** Check Configuration > Default Profiles and disable or update the global override

Issue 3: FUP Not Activating

  • **Cause:** Accounting packets not reaching OneRADIUS, so data usage is not being tracked
  • **Fix:** Verify NAS accounting settings — interim-update interval should be set to 60–300 seconds

Issue 4: CoA Not Working

  • **Cause:** NAS firewall blocking port 3799, or CoA not enabled on the NAS
  • **Fix:** Open UDP port 3799 on the NAS firewall and enable CoA in NAS configuration

Issue 5: Speed Showing Correctly in RADIUS but Not on User End

  • **Cause:** NAS queue tree or HTB configuration overriding RADIUS-assigned speeds
  • **Fix:** Remove static queue entries on the NAS and let RADIUS control all queues dynamically

---

Best Practices for Bandwidth Policy Management in OneRADIUS

  • **Name profiles clearly** — Use names like 'MikroTik_20Mbps_5Mbps' for easy identification
  • **Create separate FUP profiles** for each plan tier to avoid mix-ups
  • **Use CoA** instead of session disconnection wherever possible — it improves subscriber experience
  • **Monitor accounting logs** regularly to ensure data usage tracking is accurate
  • **Set interim-update intervals** on NAS devices to 120–300 seconds for accurate real-time data tracking
  • **Review bandwidth policies quarterly** to align with plan changes and network upgrades
  • **Document all profiles** and their corresponding plan names in a central spreadsheet
💡 OneRADIUS provides a built-in bandwidth policy audit log, showing which profile was applied to which subscriber and when — making troubleshooting and compliance reporting easy.

---

Why Choose OneRADIUS for Bandwidth Policy Management?

OneRADIUS by ARCR Technologies is purpose-built for Indian ISPs and offers:

  • **Multi-vendor VSA support** — MikroTik, Cisco, Huawei, ZTE, Cambium, and more
  • **Automated FUP enforcement** via real-time accounting and CoA
  • **Time-based bandwidth policies** for peak/off-peak differentiation
  • **Seamless billing integration** with popular Indian ISP billing platforms
  • **Web-based dashboard** for easy plan and profile management
  • **High availability and redundancy** for 24x7 ISP operations
  • **Dedicated support** from a team that understands the Indian telecom landscape

Whether you are a startup ISP with 500 subscribers or an established provider with 50,000 connections, OneRADIUS scales with your business.

---

Conclusion

Configuring bandwidth policies in your RADIUS server is not just a technical task — it is the backbone of your ISP's service quality and revenue integrity. With OneRADIUS, the entire process from creating profiles to enforcing FUP and pushing real-time CoA updates is streamlined and automated.

By following the steps in this guide, you can ensure every subscriber gets exactly the speed they are paying for — improving customer satisfaction, reducing support calls, and protecting your network from abuse.

Ready to get started? Visit oneradius.com to explore OneRADIUS features, request a demo, or speak with our team of RADIUS experts today.