ISP Subscriber Management: RADIUS, PPPoE, BNG, CGNAT, TR-069

ISP subscriber management covers everything from the moment a customer's modem connects to the moment their invoice is issued. In a typical flow, the CPE (modem or router) connects to a BNG over PPPoE or IPoE, the BNG asks a RADIUS server whether the subscriber may connect, and RADIUS returns the IP address and speed profile for that plan. Accounting records then track usage for the rest of the session.

CGNAT, remote CPE management with TR-069, billing and, in Türkiye, BTK reporting and Law 5651 record keeping are all built around this core.

Components of a subscriber management setup

PPPoE connection flow, step by step

1. Discovery: the CPE broadcasts a PADI, and the BNG answers with a PADO. The CPE requests a session with PADR, and the BNG assigns a session ID in PADS.
2. PPP negotiation: LCP agrees on the MRU and the authentication method (PAP or CHAP/MS-CHAPv2).
3. Access-Request: the BNG sends RADIUS the User-Name, the password or CHAP response, NAS-IP-Address, NAS-Port-Id and Calling-Station-Id (a MAC address or circuit ID).
4. Decision: RADIUS checks whether the account is active, whether invoices are overdue, any port or MAC binding and the concurrent-session limit. If all checks pass, it returns Access-Accept with Framed-IP-Address or a pool name, Session-Timeout and a vendor-specific (VSA) rate profile. Otherwise it returns Access-Reject.
5. Addressing: IPCP assigns the IPv4 address. For IPv6, IPv6CP is followed by DHCPv6, usually with prefix delegation. The session is now up.
6. Accounting: the BNG sends Accounting-Request messages: Start when the session begins, periodic Interim-Update messages and Stop when it ends. They carry session time, bytes in and out, and the termination cause.
7. Mid-session changes: plan upgrades, quota enforcement and suspension for non-payment take effect immediately through RFC 5176 CoA (Change of Authorization) and Disconnect messages. The subscriber does not have to reconnect.

RADIUS and AAA

RADIUS handles authentication, authorization and accounting in one protocol. Authentication runs on UDP 1812 (RFC 2865) and accounting on UDP 1813 (RFC 2866). Dynamic authorization (CoA/Disconnect, RFC 5176) usually uses UDP 3799.

What matters in day-to-day operations:

• High availability: configure at least two RADIUS servers on every BNG and replicate the subscriber database. If RADIUS is unreachable, new sessions cannot be established.
• Accounting loss: lost accounting packets leave gaps in both billing and traffic records. Use a sensible Interim-Update interval and persistent queuing.
• Security: classic RADIUS relies on a shared secret and MD5-based protection. Since the Blast-RADIUS disclosure in 2024 (CVE-2024-3596), the recommendation is to require the Message-Authenticator attribute on all requests and responses. Keep RADIUS on a management network, or protect it with IPsec or RadSec (RADIUS over TLS).
• Vendor-specific attributes: rate profiles, address pools and service policies usually travel as VSAs, so keep attribute dictionaries tidy in multi-vendor networks.

PPPoE or IPoE?

Because of PPPoE's 8-byte header, TCP MSS clamping is important. Without it you get problems that are hard to diagnose, such as certain websites never loading.

BNG and vBNG

The BNG (Broadband Network Gateway) is where subscriber sessions terminate and per-subscriber policy is applied. It handles session setup, IP assignment, speed and QoS profiles, access lists, accounting and CoA. Broadband Forum architecture documents such as TR-101 and TR-178 describe this role.

Traditional BNGs are chassis systems built on dedicated hardware. A vBNG runs the same functions in software on standard x86 servers, using high-performance packet-processing frameworks. Broadband Forum TR-459 defines control and user plane separation (CUPS). In that model the control plane scales centrally, and user planes can be placed closer to subscribers.

A vBNG scales with demand, reduces hardware lock-in and can run services such as CGNAT on the same platform. Software BNGs such as netElastic follow this model. Smaller wireless ISPs often start with a MikroTik RouterOS PPPoE server and an external RADIUS server.

CGNAT and record keeping

With IPv4 addresses exhausted, many ISPs give subscribers private addresses and put large numbers of them behind a small pool of public IPs. RFC 6598 reserves the 100.64.0.0/10 shared address space for this purpose, and RFC 6888 sets out requirements for carrier-grade NAT devices.

CGNAT causes three main problems:

• Port exhaustion: a low per-subscriber port limit breaks applications that open many connections.
• Application compatibility: gaming, IP cameras and remote access that need inbound connections are affected.
• Log volume: recording every single connection produces very large amounts of data.

Two techniques keep logging manageable. With port block allocation (PBA), one record is written when a block of ports is assigned to a subscriber. Deterministic NAT uses a fixed mapping between private IPs and public IP-port ranges.

There is also a legal requirement. In Türkiye, Article 6 of Law 5651 requires access providers to retain traffic data for their services. The data must be kept for a period set by regulation, not exceeding two years, and its accuracy, integrity and confidentiality must be ensured. To identify a subscriber behind CGNAT, you must be able to match public IP + port + time to RADIUS accounting records. The BNG, CGNAT and RADIUS servers therefore need a common NTP source.

Collecting NAT records in a central log layer such as Syslog makes those lookups faster and more consistent. The long-term fix is dual-stack IPv6. IPv6 traffic does not pass through NAT, which reduces the load on the CGNAT.

Managing CPEs with TR-069

TR-069 (CPE WAN Management Protocol, CWMP) is the Broadband Forum protocol that lets an Auto Configuration Server (ACS) manage CPEs remotely. The CPE opens sessions to the ACS using SOAP over HTTP(S). It does this at first boot, at regular intervals (periodic inform) or when the ACS sends a connection request.

For an ISP, this allows:

• Zero-touch provisioning: PPPoE credentials, the Wi-Fi name and the password are pushed the first time the modem powers on.
• Bulk configuration and firmware updates: policies and firmware roll out to thousands of devices on a schedule.
• Remote diagnostics: the support desk can see signal levels, WAN status and connected devices, and can run ping or traceroute tests.
• A link to the subscriber record: the CPE serial number is bound to the account, so modem swaps are recorded in the system of record.

The CPE learns the ACS URL from factory settings, DHCP Option 43 or the installation process. The data models are TR-098 and the current TR-181 (Device:2). TR-369 (User Services Platform, USP) is the Broadband Forum's successor protocol. It supports transports such as MQTT, WebSocket and STOMP, as well as multiple controllers, and is gradually replacing TR-069. Always connect to the ACS over HTTPS and use per-device credentials.

Integrating billing and BTK reporting

Billing, provisioning and reporting should all work from the same subscriber record:

• Single record: contract, identity details, plan, CPE, session history, invoices and support tickets all hang off the same subscriber ID.
• Automated lifecycle: a new subscription creates the RADIUS entry and the TR-069 profile. An unpaid invoice triggers a CoA that throttles the line or redirects it to a payment page. Payment reactivates the line automatically.
• Usage-based billing: accounting data feeds quota and overage calculations.
• E-documents: invoices in Türkiye must be issued in line with the Revenue Administration's e-Invoice and e-Archive systems.
• Regulatory duties: authorized operators must report the periodic sector data and subscription information the BTK requests. They must also retain traffic data under Law 5651 and be members of the Association of Access Providers (Erişim Sağlayıcıları Birliği). Subscription contracts and commitment terms have to follow the consumer rules for the electronic communications sector.

Cetvel / WiRadius is our ISP software. It covers subscriber management, RADIUS, TR-069 and BTK reporting in the same application.

BNG, RADIUS and CGNAT checklist

1. Are the BNG, CGNAT, RADIUS and log servers synchronized to the same NTP source?
2. Is a secondary RADIUS server configured, with sensible timeout and retry values?
3. Does the Interim-Update interval suit both billing and record-keeping needs?
4. Is MTU/MSS clamping in place for PPPoE?
5. Is the CoA port (3799) open between the BNG and RADIUS, and restricted by source IP?
6. Have you validated per-subscriber port limits and the PBA or deterministic NAT records?
7. Do CPEs reach the ACS over HTTPS with per-device credentials?

Frequently asked questions

Do subscribers lose internet if the RADIUS server fails?

Existing sessions usually stay up, because session state is kept on the BNG. New connections and reconnecting subscribers cannot be authenticated, though, and accounting records may be lost. That is why at least two RADIUS servers and a replicated database are recommended.

Does a small wireless ISP need a dedicated BNG?

Not at the start. Many wireless ISPs begin with a MikroTik router running a PPPoE server and an external RADIUS server. When subscriber numbers, CGNAT needs and availability expectations grow, a hardware BNG or a vBNG is worth evaluating.

What records should an ISP using CGNAT keep?

Keep the private IP assigned to the subscriber, the post-NAT public IP and port range, start and end times, and the RADIUS accounting records. They must be stored in a form that lets you match them together. In Türkiye, base retention periods and formats on Law 5651 and BTK regulations.

What is the difference between TR-069 and TR-369?

TR-069 is a SOAP-over-HTTP management protocol between the CPE and the ACS. TR-369 (USP) covers the same need with newer transports such as MQTT and WebSocket, support for multiple controllers and more real-time management. USP support is growing in new devices, but TR-069 is still widespread in the installed base.

Why is the PPPoE MTU 1492?

The PPPoE header (6 bytes) and the PPP protocol field (2 bytes) come out of Ethernet's 1500-byte payload, which leaves 1492 bytes. Some networks use RFC 4638 to raise the Ethernet MTU and restore a full 1500-byte PPP MTU.