RADIUS CoA and Disconnect Messages: An ISP Runbook
Use RADIUS Change of Authorization and Disconnect Messages safely with stable session matching, protected transport and read-back evidence.
Use RADIUS Change of Authorization and Disconnect Messages safely with stable session matching, protected transport and read-back evidence.
Dynamic authorization changes a live session
A billing platform may need to disconnect an expired PPPoE session or change policy without waiting for the customer to reconnect. RFC 5176 defines Disconnect and Change of Authorization requests for that job. Because these packets change active access, they need a stricter operational boundary than ordinary dashboard actions: an exact target, an authenticated sender, an explained result and independent confirmation.
Disconnect
Terminate the matching live session and let the next login obtain current policy.
CoA
Request a supported policy change while the session remains active.
Matching
Use enough attributes to identify one session without affecting a namesake or stale record.
Verification
Treat ACK as request acceptance, then read the actual NAS and accounting state.
Select the smallest correct action
Use a Disconnect-Request when continuing the current session is not acceptable or the NAS cannot apply the required attribute dynamically. Use a CoA-Request only for attributes the exact NAS and service type support. Vendor support is not uniform, so maintain an acceptance matrix by platform, version and service rather than assuming an Access-Accept attribute can also be changed in place.
A financial event should first change the authoritative entitlement. Dynamic authorization is the enforcement attempt that follows. If it fails, the customer record must not claim the network has already changed; store desired and observed state separately and surface the exception to an operator.
Match one live session safely
User-Name by itself may match several sessions or a reused login. Correlate the current accounting record with NAS identity and Acct-Session-Id, then add the framed address, calling station or NAS port where supported. Compare the identifier set accepted by every deployed NAS before enabling a bulk workflow.
Dynamic authorization uses a request/response exchange. Record the request authenticator, target attributes, NAS address, response code and timing without logging the shared secret. A timeout is uncertain: the NAS may have acted and the response may have been lost. Query live state before blindly retrying.
Protect the authorization path
Permit the dynamic-authorization listener only from designated policy hosts and restrict the return path. Use a unique, high-entropy secret per NAS, keep time synchronized and rotate credentials through a controlled process. RFC 5176 discusses IPsec because classic RADIUS does not provide modern transport confidentiality; use a private or encrypted management path appropriate to the deployment.
Separate the permission to change entitlement from the permission to send a network action. A support role may request reconnection while the billing service verifies payment and the network service performs the scoped request. Audit the initiating user or system, business reason, session selected and read-back result.
Test failure as part of acceptance
Test an unknown session, stale Acct-Session-Id, wrong NAS, unsupported attribute, duplicate request, delayed response and unreachable router. Confirm NAK error causes remain visible and actionable. Then test a clean disconnect and ensure the resulting Accounting-Stop, live session table and customer-facing status converge.
Rate-limit batch operations and preview the exact subscribers and NAS devices. If a payment reconciliation or package edit selects thousands of sessions, split the work into bounded jobs with a pause control. The goal is not merely to send packets quickly; it is to preserve access correctness during partial failure.
Evidence before rollout
| Signal | Required proof |
|---|---|
| NAS support | Disconnect and each intended CoA attribute pass on the exact platform and release. |
| Session target | NAS identity and accounting identifiers resolve exactly one current session. |
| Transport | Only approved sources reach the listener through a protected management path. |
| Uncertainty | Timeouts trigger state inspection before retry. |
| Read-back | Live NAS state and accounting confirm the requested outcome. |
Put the plan into operation
- Inventory. Record NAS support, source addresses, secrets and accepted match attributes.
- Lab. Test ACK, NAK, timeout, duplicate and stale-session cases.
- Authorize. Separate business approval from network execution permission.
- Pilot. Enable one router and a small controlled subscriber set.
- Observe. Reconcile responses, live sessions and Accounting-Stop records.
- Scale. Use bounded queues, rate limits and an operator pause control.
The decision standard
A dynamic-authorization workflow is ready when it can identify one active session, prove who requested the change, survive an uncertain response and confirm the resulting network state independently.
Research basis: IETF RFC 5176 — Dynamic Authorization Extensions to RADIUS; IETF RFC 2865 — RADIUS; IETF RFC 2866 — RADIUS Accounting; MikroTik RouterOS RADIUS documentation; FreeRADIUS project documentation. Validate implementation details against the releases, contracts, and local regulations governing your network.