From deployment time to data resilience, here are our top 6 reasons to move your ISP’s billing and radius to the cloud.

1. Rapid Deployment

Cloud services can be deployed much faster than traditional systems. What could take weeks or months of planning in the traditional onsite model can be done in minutes when leveraging a good SaaS platform. Our provisioning time is less than 30 seconds, can a traditional server even boot that fast ?

2. Lower TCO

Total cost of ownership can often be decreased dramatically when you are running in the cloud. Expensive hardware and power costs are no longer a factor. Staffing costs can also be reduced dramatically, a rock solid billing and radius system needs the loving care of an experienced systems administrator, and the careful hand of a great DBA. With a cloud billing and radius service this is done for you, “automagically“.

3. Automatic Upgrades

Our billing and radius platform is constantly evolving to meet your needs, this means new features and bug fixes make their way to you behind the scenes with no interruption to your services.

4. Backups and Data Recovery

Backups and Recovery can be a headache for any organization. The iBill.io billing and radius platform will take care of all of this for you, ensuring your infrastructure is resilient and protected against failure.

5. Access From Anywhere

No more complicated VPN’s or dynamic dns entries. Your services are securely available from anywhere in the world, both to you and your end users.

6. Ease of Evaluation

The traditional model of setting up a test environment, trying to figure how to install the software, learning how everything works only to flatten it and move on to the next solution is expensive and time consuming. Cloud platforms can easily be evaluated to see if it’s a good fit into your organization.

Looking for a Cloud Billing and Radius Platform ?

Try our easy to use ISP Radius and Billing solution and have one available in 30 seconds. Enjoy a risk free 30 day trial.

The post 6 Reasons to host Billing and Radius in the Cloud appeared first on iBill.io.

PPPOE or Point-to-Point Protocol Over Ethernet is a common connection used to authenticate users and account for their traffic. PPPOE is used extensively in all types of networks as it allows the remote device to bring up a connection over layer 2 without much prior configuration.

Part 1: Mikrotik Radius Attributes

What are radius attributes?

Before we dive in to our Mikrotik configuration, let’s get a general understanding of what a radius attribute is. These are important because when we connect clients over PPP using radius we can control certain aspects of the connection using radius attributes.

Radius attributes are special Attribute-Value pairs that are sent inside radius packets. At the radius packet level they contain an Attribute ID, a length and a Value. When the radius server receives these attributes it uses a dictionary to lookup the attribute definition and convert the data into something the server can understand.

A radius packet generally contains several of these attributes holding connection specific information. The radius server will then read these in and decide what to do with the packet. Common attributes include:

• User-Name = The username specified when connecting to a NAS (Network Access Server).
• Calling-Station-Id = The phone number or network mac address of the user.
• NAS-IP-Address = The IP address of the network access server which generated the request.
• Framed-IP-Address = The IP address of the user, typically seen in radius accounting packets.

Many devices include their own radius dictionaries which allow extra device specific information to be sent inside their radius requests. The Mikrotik radius dictionary can be found here: http://wiki.mikrotik.com/wiki/Manual:RADIUS_Client/vendor_dictionary and defines some Mikrotik specific attributes to provide more control over client connections.

Common Mikrotik Radius Attributes

Client Connection Speed Management

Mikrotik-Rate-Limit

This attributes allows you specify the speed of the client connection, it can specify a fixed speed rate, or a burstable speed profile for the user.

The attribute accepts the following as it’s value.

rx-rate[/tx-rate] [rx-burst-rate[/tx-burst-rate] [rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time] [priority] [rx-rate-min[/tx-rate-min]]]]

All values inside braces are optional and the only value which is required is the rx-rate. If only the rx-rate is specified then the tx-rate will be the same as the rx-rate.

When working with rate limits it is important to remember that the rate limit is defined from the perspective of the Mikrotik and not the client device. This means that the rx-rate (Receive rate) determines how fast the Mikrotik will receive traffic from the user (The users upload speed) and the tx-rate will control how fast the Mikrotik will send data to the user (The users download rate).

Let’s look at some definitions to get a clearer understanding of the values.

Mikrotik-Rate-Limit = 1M

This specifies that the user can upload and download at 1Mbit per second (1Mbit is equivalent to 128Kilobytes per second, which is 1MB of data over 8 seconds).

Mikrotik-Rate-Limit = 1M/2M

Here we specify an upload rate of 1Mbit per second and a download rate of 2Mbits per second.

We can also write the limit in Bits or Kbits, so using the same 1M/2M example we could specify:

Mikrotik-Rate-Limit = 1024k/2048k

Or

Mikrotik-Rate-Limit = 1048576/2097152

For more information on rate limits and burst profiles you can view the Mikrotik Documentation here: http://www.mikrotik.com/testdocs/ros/2.9/root/queue.php.

IP Management

The standard radius dictionary defines some useful attributes for controlling a client’s IP addresses and routing. Two useful attributes in this case are:

• Framed-IP-Address
• Framed-Route

Framed-IP-Address

When used in an Access Accept packet Framed-IP-Address specifies the IP that should be assigned to a user when they connect.

Example:

Framed-IP-Address = 192.168.233.1

When a user dials up and receives this attribute their end of the connection will come up with the following IP.

Framed-Route

Another useful attribute is the Framed-Route attribute. If you wish to route a network address block to an end user you can specify it here.

Example:

Framed-Route = 172.16.10.0/24

When the user dials up the Mikrotik will add a route to it’s local routing table to route 172.16.10.0/24 to the client’s device.

Firewall and Security

Radius can also be used to send some useful information for the purposes of firewalling or creating advanced queues.

Filter-Id

This attribute will place a user’s traffic into a specific firewall chain.

Filter-Id = <custom chain name>

This attribute allows you to redirect a user’s traffic to a custom firewall chain on the Mikrotik. The value it takes may simply be the name of a chain or additionally you can append “.in” or “.out” to the name of the chain. When appending “.in” or “.out” the Mikrotik will only redirect traffic on input (received from the client – client upload) or output (send to the client – client download).

The second attribute is:

Mikrotik-Address-List = <address list name>

This attribute will place a user into a Mikrotik address list on the NAS. Once the user is an address list you can use the address list in your firewall and routing rules to control the client traffic.

Data Transfer Limits

Finally there are a couple attributes useful for controlling the total amount of data a user can transmit on a connection before the NAS will disconnect the session.

Mikrotik-Total-Limit

Mikrotik-Total-Limit = <value> (Value in bytes)
Mikrotik-Total-Limit-Gigawords = (Value in gigawords)

*A gigaword is 4294967296 bytes (4GB) and the radius protocol contains the gigawords field since the regular byte fields are designed to only hold a 32-bit number. If you wanted to specify a limit of 5GB you would need to send 1 Gigaword (4GB) and 1073741824 bytes (1GB) in the regular limit field.

Once the user has reached the limit sent in the radius attributes the session will be automatically disconnected.

The following attributes are also supported:

Mikrotik-Recv-Limit = <value>
Mikrotik-Recv-Limit-Gigawords = <value>

Mikrotik-Xmit-Limit = <value>
Mikrotik-Xmit-Limit-Gigawords = <value>

The Recv and Xmit attributes control the upload and download data limits of the connection and the connection will be terminated when either of these is reached. It functions exactly the same as the Mikrotik-Total-Limit attribute, but allows you some control over the direction.

Part 2: Mikrotik Setup

Mikrotik Radius Settings

For our Mikrotik radius setup we will start with one of the most popular scenarios for providing connections, PPPOE.

We begin our Mikrotik configuration by specifying our radius servers.

To do this, head to the radius section and click the ‘+’ button to add a new radius server.

The radius server settings page allows you to specify which services will be available over radius.

• PPP – PPPOE connections and PPTP tunnels (VPNs).
• Hotspot – Authentication over the hotspot landing page.
• DHCP – The MAC address of the client is sent as a username when connecting to the DHCP server.
• Login – We can use radius to login to the Mikrotik itself, this is useful if you have many Mikrotik devices and want to centrally manage your logins.
• Wireless – Wireless authentication by MAC address.

Under server address we enter our primary server IP address or hostname and our predefined radius secret. This radius secret must match what is held on the radius server. iBill.io users can find these details under ‘Setup’ > ‘General Settings’ > ‘Radius Configuration’.

Our radius ports also need to be defined, these are two separate ports, one for authentication traffic and one for accounting. Additionally, we set the Radius Timeout up to 3000ms to ensure network congestion does not cause a false timeout.

Once all of your settings are entered correctly click ‘OK’ to add the radius server.

Next we will do the same for the secondary Radius server. If the primary fails Mikrotik will start sending traffic to the secondary to keep services running.

Our secondary configuration looks almost identical, except here we have the secondary hostname or IP address specified.

After adding both servers you should have the following in your Radius pane.

By double clicking an of the radius servers we can view the configuration and the status pane. The status pane will indicate the requests, responses and any problems with the configuration.

Mikrotik Radius Incoming

Next up we can configure incoming radius requests. Incoming radius requests allow the radius server to send a ‘Disconnect Message’ to the Mikrotik to disconnect a specific connection.

To do this, click the ‘Incoming’ button at the top of the Radius window and the following window will appear.

To enable incoming requests simply check the ‘Accept’ option and click ‘OK’. The port number may be changed if needed and configured under the NAS on the radius server.

Configuring the Mikrotik PPPOE Server

Mikrotik IP Pools

The first thing we will need to do is create an IP pool which will be used to assign IP addresses to incoming client connections. In this example we will give out IP’s in the 192.168.30.1-192.168.30.254 range.

We do this by going to ‘IP’ > ‘Pool’ in winbox and clicking the add button ‘+’. Here is what it looks like when the pool has been created.

After adding our IP pool we can configure the PPPOE server.

Mikrotik PPPOE Server Configuration

To configure the PPPOE server, head to ‘PPP’ > ‘PPPOE Servers’ and click the add button ‘+’.

Our server configuration looks like this:

First we give the service a friendly name and we specify the interface the PPPOE server will listen on, this can be a wireless interface or a regular Ethernet interface, dependent on how the clients will be connecting to the network.

We also set the ‘Default Profile’ which determines which PPP profile will be used for client connections. In our case we chose the included ‘default-encryption’ profile.

After saving the new service your ‘PPPOE Servers’ list should look like this.

Next, we need to specify which IP addresses will be used for client connections. This is controlled under ‘Profiles’. In our case we selected the ‘default-encryption’ profile. So, let’s edit that profile and add the IP address information in.

To configure the IP address information we simply specify a ‘Local Address’, this will be the Mikrotik’s IP Address on the PPPOE connection and the ‘Remote Address’ can be set to the IP pool we created earlier.

Finally, we need to configure PPP to use radius authentication and accounting. To do this, head to the ‘Secrets’ tab and click the ‘PPP Authentication & Accounting’ button.

To enable radius authentication, we need to check the ‘Use Radius’ option. Accounting should be enabled by default, however it will only send start and stop packets unless we specify an ‘Interim Update’ period.

Set this value to value to 5 minutes to have the Mikrotik send usage information for each session every 5 minutes.

That’s it! Our PPPOE server is now configured and ready to accept client connections.

Part 3: Adding A Client Connection

Now that everything is set up we can configure a client to connect to our new PPPOE Service.

In our test scenario we have another Mikrotik (To be called “Client CPE” from here on out) connected to the Mikrotik over Ethernet.

Firstly, inside our iBill.io instance we have created a 1Mbit Uncapped product. We did this by using the Mikrotik-Rate-Limit attribute and specifying a rate of 512k/1024k

We then created a service for the user as seen below.

The ‘Radius Username’ and ‘Radius Password’ is what our client will be using to connect to the PPPOE server.

Let’s get started and configure the Client’s CPE PPPOE interface.

Start by going to the ‘PPPOE’ menu in winbox and selecting the add button ‘+’ under the ‘Interfaces’ tab.

The ‘New Interface’ window will pop up. Under the first tab we can give the connection a friendly name and select interface to run over.

The ‘PPPoE Scan’ option will scan the selected interface and look for PPPoE servers which can be useful for debugging connection issues.

Here we have added a friendly connection name and set the connection to run on ether1.

Next we will need to configure the ‘Dial Out’ settings for the service. This is where we enter the Radius Username and Password we created earlier.

We can also specify other options, such as DNS and whether to create a default route by default.

After entering the username and password, click the ‘Apply’ button and the PPPOE client should immediately begin to dial out.

Once you have applied the settings you can view the connection status in the ‘Status’ pane.

As we can see the connection came up and the server allocated the IP addresses we specified earlier.

If we look at the ‘PPP’ > ‘Interface’ tab on the PPPOE Server we can see the client is listed there.

Since we specified a speed limit for the client, the PPPOE Server will create a queue under ‘Queues’ > ‘Simple Queues’.

We can also visit the service page on our iBill.io server and see the connection there.

Looking for a Mikrotik Radius Server?

Try our easy to use ISP Radius and Billing solution and have one available in the cloud in 30 seconds. Our free trial is a great way to learn more about mikrotik radius and PPPOE by practicing and testing your knowledge.

We hope you gained some insights from our Mikrotik Radius and PPPOE guide. If you have any questions please feel free to leave a comment or contact our helpdesk.

The post Mikrotik Radius, PPPOE Server and PPPOE Client Setup Guide appeared first on iBill.io.

Below we will look at a typical connection cycle and the radius traffic between the Radius Client and Radius Server.

A typical session to your NAS (Network Access Server) will begin with Radius Authentication and once the user’s session has successfully been authenticated the NAS will send Radius Accounting information to track the session.

Radius Authentication

Let’s start by having a look at the basic flow of Radius Authentication. Let’s say you have client X who is connecting to your Mikrotik PPPOE Server. We use Mikrotik as an example here, but the same holds true for any device which operates over the Radius Protocol.

First off the user will initiate a session over PPPOE and send along a Username and Password for their connection.

The mikrotik will receive these details and construct a Radius Access-Request packet.

A typical Radius Access-Request Packet.

Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 15732834
NAS-Port-Type = Ethernet
User-Name = "example@ibill.io"
Calling-Station-Id = "00:00:1E:2E:3E:A0"
Called-Station-Id = "PPPoE"
NAS-Port-Id = "eth1"
MS-CHAP-Domain = "ibill.io"
CHAP-Challenge = 0xe7da8697192738465509d9fc3dc1d7fd
CHAP-Password = 0x0173c707ea3c510bc76b37f3a6b0c29fdc
NAS-Identifier = "Mikrotik"
Mikrotik-Realm = "ibill.io"
NAS-IP-Address = 10.0.0.1

When this packet is received by the radius server a few actions will take place.

1. The source ip of the packet will be checked to see if it’s allowed to send traffic to the radius server.
2. The User-Name will be checked to see if it’s valid and allowed to connect.
3. The password will be verified. There are multiple methods of sending a password, each of these methods uses some form of hashing against the radius secret. (When the radius secret does not match between the radius client and the server the password will always fail to verify.)
4. Once the user and password have been verified the server will then reply with either an Access-Accept or Access-Reject.
5. Additionally some attributes may be added to the reply. These attributes can include speed limits, transfer limits, IP addresses or various other AVP’s (Attribute Value Pairs) which can change the parameters of the connection.

A typical Access-Accept packet.

Acct-Interim-Interval = 300
Framed-IP-Address = 10.1.1.1
Class = 0x57696d617834122314
Mikrotik-Rate-Limit = "1M/2M"

In this example we send an Access-Accept to say the connection is allowed. Some additional AVP’s are sent here, including the expected Interim for the radius accounting packets, an IP Address to assign to the connection, a rate limit (1 Mbit upload, 2 Mbit download) and a class to identify the session.

Radius Accounting

Once the Mikrotik receives the radius Access-Accept the connection setup will complete and a radius Accounting-Request will be sent to the radius server. The first Accounting-Request which is sent is known as the Accounting Start. This packet signifies that it is a new session which needs to be tracked.

A typical Accounting-Request Start packet.

Acct-Status-Type = Start
NAS-Port-Type = Ethernet
Calling-Station-Id = "00:00:1E:2E:3E:A0"
Called-Station-Id = "PPPoE"
NAS-Port-Id = "eth1"
User-Name ="example@ibill.io"
NAS-Port =15732834
Acct-Session-Id = "80e00136"
Framed-IP-Address = 10.1.1.1
Mikrotik-Host-IP = 10.1.0.1
Event-Timestamp = "Dec 20 2016 13:37:00 GMT"
NAS-Identifier = "Mikrotik"
Acct-Delay-Time = 0
NAS-IP-Address = 10.0.0.1
Class = 0x57696d617834122314

The Accounting start packet contains everything needed to identify the session, include the unique session id on the NAS, the user’s IP address and relevant port/media information of the connection.

After the Acct-Interim-Interval supplied on authentication (this interval can also be directly configured on the device without the need to send it via the accept) has elapsed the NAS will send an Interim-Update Accounting-Request.

The Interim-Update is very similar to the start packet but contains some extra information, such as the length of the session and the amount of data transferred during the lifecycle of the session.

A typical Interim-Update packet.

Acct-Status-Type = Interim-Update
NAS-Port-Type = Ethernet
Calling-Station-Id = "00:00:1E:2E:3E:A0"
Called-Station-Id = "PPPoE"
NAS-Port-Id = "eth1"
User-Name ="example@ibill.io"
NAS-Port =15732834
Acct-Session-Id = "80e00136"
Framed-IP-Address = 10.1.1.1
Mikrotik-Host-IP = 10.1.0.1
Event-Timestamp = "Dec 20 2016 13:37:00 GMT"
NAS-Identifier = "Mikrotik"
Acct-Delay-Time = 0
NAS-IP-Address = 10.0.0.1
Class = 0x57696d617834122314
Acct-Input-Octets = 4762630
Acct-Output-Octets = 124009799
Acct-Session-Time = 300
Acct-Input-Packets = 69492
Acct-Output-Packets = 92722

Here we have the same identifying information for the session as was present in the Start packet. We also have some new information such as Acct-Input-Octets (The amount of bytes sent from the user to the NAS – uploaded bytes), Acct-Output-Octets (Bytes sent from NAS to user – downloaded bytes) and the Acct-Session-Time (Length in seconds that the user has been online for).

When the session is finally terminated the NAS will send one last Accounting-Request packet. This is the Stop request and it signals to the radius server that the session has ended.

A typical Stop packet.

Acct-Status-Type = Stop
NAS-Port-Type = Ethernet
Calling-Station-Id = "00:00:1E:2E:3E:A0"
Called-Station-Id = "PPPoE"
NAS-Port-Id = "eth1"
User-Name ="example@ibill.io"
NAS-Port =15732834
Acct-Session-Id = "80e00136"
Framed-IP-Address = 10.1.1.1
Mikrotik-Host-IP = 10.1.0.1
Event-Timestamp = "Dec 20 2016 13:37:00 GMT"
NAS-Identifier = "Mikrotik"
Acct-Delay-Time = 0
NAS-IP-Address = 10.0.0.1
Class = 0x57696d617834122314
Acct-Input-Octets = 5695632
Acct-Output-Octets = 125013767
Acct-Session-Time = 367
Acct-Input-Packets = 71627
Acct-Output-Packets = 98318
Acct-Terminate-Cause = User-Request

The Stop packet is almost the same as the Interim-Update packet but once again contains extra information. In this case the Acct-Terminate-Cause indicates the reason the connection was closed. The Octets counters also contain the final tally of data used during the session.

We hope this basic overview of the Radius protocol gives you a greater understanding of the interaction that takes place between a NAS and a Radius Server. If you have any questions please feel free to add a comment and we will try answer them for you.

Looking for a Radius Server ?

Try our easy to use ISP Radius and Billing solution and have one available in the cloud in 30 seconds. Our free trial is a great way to learn more by practicing and testing your Radius Configurations.

The post What is a Radius Server? appeared first on iBill.io.