# ISP Subscriber Management: RADIUS, PPPoE, BNG, CGNAT, TR-069

> How ISP subscriber management works in practice: RADIUS AAA, PPPoE sessions, BNG/vBNG, CGNAT logging, TR-069 CPE management, billing and BTK reporting.

ISP subscriber management covers everything from the moment a customer's modem connects to the moment their invoice is issued. In a typical flow, the CPE (modem or router) connects to a **BNG** over PPPoE or IPoE, the BNG asks a **RADIUS** server whether the subscriber may connect, and RADIUS returns the IP address and speed profile for that plan. Accounting records then track usage for the rest of the session.

CGNAT, remote CPE management with TR-069, billing and, in Türkiye, BTK reporting and Law 5651 record keeping are all built around this core.

## Components of a subscriber management setup

| Component | Role | Typical technology |
|---|---|---|
| CPE | Starts the connection at the subscriber's premises | ONT/ONU, wireless CPE, home router |
| Access network | Carries the subscriber to the aggregation point | GPON OLT, point-to-multipoint wireless, Ethernet |
| BNG / vBNG | Terminates subscriber sessions and enforces policy | Hardware BNG, x86-based vBNG, MikroTik |
| RADIUS (AAA) | Authentication, authorization and accounting | RFC 2865/2866, FreeRADIUS |
| IP management | Address pools, IPv6, CGNAT | DHCP, IPCP, NAT444 |
| ACS | Configures and monitors CPEs remotely | TR-069 (CWMP), TR-369 (USP) |
| OSS/BSS | Subscriber records, plans, billing, support | Subscriber management software, CRM, e-invoicing |
| Logging and reporting | Traffic and NAT records, regulatory reports | Syslog, NetFlow/IPFIX, archive |

## PPPoE connection flow, step by step

1. **Discovery:** the CPE broadcasts a `PADI`, and the BNG answers with a `PADO`. The CPE requests a session with `PADR`, and the BNG assigns a session ID in `PADS`.
2. **PPP negotiation:** LCP agrees on the MRU and the authentication method (PAP or CHAP/MS-CHAPv2).
3. **Access-Request:** the BNG sends RADIUS the `User-Name`, the password or CHAP response, `NAS-IP-Address`, `NAS-Port-Id` and `Calling-Station-Id` (a MAC address or circuit ID).
4. **Decision:** RADIUS checks whether the account is active, whether invoices are overdue, any port or MAC binding and the concurrent-session limit. If all checks pass, it returns `Access-Accept` with `Framed-IP-Address` or a pool name, `Session-Timeout` and a vendor-specific (VSA) rate profile. Otherwise it returns `Access-Reject`.
5. **Addressing:** IPCP assigns the IPv4 address. For IPv6, IPv6CP is followed by DHCPv6, usually with prefix delegation. The session is now up.
6. **Accounting:** the BNG sends `Accounting-Request` messages: `Start` when the session begins, periodic `Interim-Update` messages and `Stop` when it ends. They carry session time, bytes in and out, and the termination cause.
7. **Mid-session changes:** plan upgrades, quota enforcement and suspension for non-payment take effect immediately through RFC 5176 **CoA** (Change of Authorization) and **Disconnect** messages. The subscriber does not have to reconnect.

## RADIUS and AAA

RADIUS handles **authentication**, **authorization** and **accounting** in one protocol. Authentication runs on UDP 1812 (RFC 2865) and accounting on UDP 1813 (RFC 2866). Dynamic authorization (CoA/Disconnect, RFC 5176) usually uses UDP 3799.

What matters in day-to-day operations:

- **High availability:** configure at least two RADIUS servers on every BNG and replicate the subscriber database. If RADIUS is unreachable, new sessions cannot be established.
- **Accounting loss:** lost accounting packets leave gaps in both billing and traffic records. Use a sensible `Interim-Update` interval and persistent queuing.
- **Security:** classic RADIUS relies on a shared secret and MD5-based protection. Since the Blast-RADIUS disclosure in 2024 (CVE-2024-3596), the recommendation is to require the `Message-Authenticator` attribute on all requests and responses. Keep RADIUS on a management network, or protect it with IPsec or RadSec (RADIUS over TLS).
- **Vendor-specific attributes:** rate profiles, address pools and service policies usually travel as VSAs, so keep attribute dictionaries tidy in multi-vendor networks.

## PPPoE or IPoE?

| Criterion | PPPoE | IPoE (DHCP + Option 82) |
|---|---|---|
| Subscriber identity | Username and password | Port, VLAN, DHCP Option 82 or MAC |
| Header overhead | 8 bytes, MTU usually 1492 | None, MTU 1500 |
| CPE setup | Credentials required, or pushed via TR-069 | Plug and play |
| Load on the BNG | PPP state kept per session | Lighter |
| Portability | Same credentials work if the modem changes | Identity tied to the physical port |
| Common in | DSL, fibre and wireless ISPs | Large fibre operators, VLAN-based designs |

Because of PPPoE's 8-byte header, TCP MSS clamping is important. Without it you get problems that are hard to diagnose, such as certain websites never loading.

## BNG and vBNG

The BNG (Broadband Network Gateway) is where subscriber sessions terminate and per-subscriber policy is applied. It handles session setup, IP assignment, speed and QoS profiles, access lists, accounting and CoA. Broadband Forum architecture documents such as TR-101 and TR-178 describe this role.

Traditional BNGs are chassis systems built on dedicated hardware. A **vBNG** runs the same functions in software on standard x86 servers, using high-performance packet-processing frameworks. Broadband Forum TR-459 defines control and user plane separation (CUPS). In that model the control plane scales centrally, and user planes can be placed closer to subscribers.

A vBNG scales with demand, reduces hardware lock-in and can run services such as CGNAT on the same platform. Software BNGs such as netElastic follow this model. Smaller wireless ISPs often start with a MikroTik RouterOS PPPoE server and an external RADIUS server.

## CGNAT and record keeping

With IPv4 addresses exhausted, many ISPs give subscribers private addresses and put large numbers of them behind a small pool of public IPs. RFC 6598 reserves the **100.64.0.0/10** shared address space for this purpose, and RFC 6888 sets out requirements for carrier-grade NAT devices.

CGNAT causes three main problems:

- **Port exhaustion:** a low per-subscriber port limit breaks applications that open many connections.
- **Application compatibility:** gaming, IP cameras and remote access that need inbound connections are affected.
- **Log volume:** recording every single connection produces very large amounts of data.

Two techniques keep logging manageable. With **port block allocation (PBA)**, one record is written when a block of ports is assigned to a subscriber. **Deterministic NAT** uses a fixed mapping between private IPs and public IP-port ranges.

There is also a legal requirement. In Türkiye, Article 6 of Law 5651 requires access providers to retain traffic data for their services. The data must be kept for a period set by regulation, not exceeding two years, and its accuracy, integrity and confidentiality must be ensured. To identify a subscriber behind CGNAT, you must be able to match **public IP + port + time** to RADIUS accounting records. The BNG, CGNAT and RADIUS servers therefore need a common NTP source.

Collecting NAT records in a central log layer such as [Syslog](/en/solutions/syslog) makes those lookups faster and more consistent. The long-term fix is dual-stack IPv6. IPv6 traffic does not pass through NAT, which reduces the load on the CGNAT.

## Managing CPEs with TR-069

TR-069 (CPE WAN Management Protocol, CWMP) is the Broadband Forum protocol that lets an Auto Configuration Server (ACS) manage CPEs remotely. The CPE opens sessions to the ACS using SOAP over HTTP(S). It does this at first boot, at regular intervals (periodic inform) or when the ACS sends a connection request.

For an ISP, this allows:

- **Zero-touch provisioning:** PPPoE credentials, the Wi-Fi name and the password are pushed the first time the modem powers on.
- **Bulk configuration and firmware updates:** policies and firmware roll out to thousands of devices on a schedule.
- **Remote diagnostics:** the support desk can see signal levels, WAN status and connected devices, and can run ping or traceroute tests.
- **A link to the subscriber record:** the CPE serial number is bound to the account, so modem swaps are recorded in the system of record.

The CPE learns the ACS URL from factory settings, DHCP Option 43 or the installation process. The data models are TR-098 and the current **TR-181 (Device:2)**. **TR-369 (User Services Platform, USP)** is the Broadband Forum's successor protocol. It supports transports such as MQTT, WebSocket and STOMP, as well as multiple controllers, and is gradually replacing TR-069. Always connect to the ACS over HTTPS and use per-device credentials.

## Integrating billing and BTK reporting

Billing, provisioning and reporting should all work from the same subscriber record:

- **Single record:** contract, identity details, plan, CPE, session history, invoices and support tickets all hang off the same subscriber ID.
- **Automated lifecycle:** a new subscription creates the RADIUS entry and the TR-069 profile. An unpaid invoice triggers a CoA that throttles the line or redirects it to a payment page. Payment reactivates the line automatically.
- **Usage-based billing:** accounting data feeds quota and overage calculations.
- **E-documents:** invoices in Türkiye must be issued in line with the Revenue Administration's e-Invoice and e-Archive systems.
- **Regulatory duties:** authorized operators must report the periodic sector data and subscription information the BTK requests. They must also retain traffic data under Law 5651 and be members of the Association of Access Providers (Erişim Sağlayıcıları Birliği). Subscription contracts and commitment terms have to follow the consumer rules for the electronic communications sector.

[Cetvel / WiRadius](/en/solutions/cetvel) is our ISP software. It covers subscriber management, RADIUS, TR-069 and BTK reporting in the same application.

## BNG, RADIUS and CGNAT checklist

1. Are the BNG, CGNAT, RADIUS and log servers synchronized to the same NTP source?
2. Is a secondary RADIUS server configured, with sensible timeout and retry values?
3. Does the `Interim-Update` interval suit both billing and record-keeping needs?
4. Is MTU/MSS clamping in place for PPPoE?
5. Is the CoA port (3799) open between the BNG and RADIUS, and restricted by source IP?
6. Have you validated per-subscriber port limits and the PBA or deterministic NAT records?
7. Do CPEs reach the ACS over HTTPS with per-device credentials?

## Frequently asked questions

### Do subscribers lose internet if the RADIUS server fails?

Existing sessions usually stay up, because session state is kept on the BNG. New connections and reconnecting subscribers cannot be authenticated, though, and accounting records may be lost. That is why at least two RADIUS servers and a replicated database are recommended.

### Does a small wireless ISP need a dedicated BNG?

Not at the start. Many wireless ISPs begin with a MikroTik router running a PPPoE server and an external RADIUS server. When subscriber numbers, CGNAT needs and availability expectations grow, a hardware BNG or a vBNG is worth evaluating.

### What records should an ISP using CGNAT keep?

Keep the private IP assigned to the subscriber, the post-NAT public IP and port range, start and end times, and the RADIUS accounting records. They must be stored in a form that lets you match them together. In Türkiye, base retention periods and formats on Law 5651 and BTK regulations.

### What is the difference between TR-069 and TR-369?

TR-069 is a SOAP-over-HTTP management protocol between the CPE and the ACS. TR-369 (USP) covers the same need with newer transports such as MQTT and WebSocket, support for multiple controllers and more real-time management. USP support is growing in new devices, but TR-069 is still widespread in the installed base.

### Why is the PPPoE MTU 1492?

The PPPoE header (6 bytes) and the PPP protocol field (2 bytes) come out of Ethernet's 1500-byte payload, which leaves 1492 bytes. Some networks use RFC 4638 to raise the Ethernet MTU and restore a full 1500-byte PPP MTU.

---
Canonical: https://internetten.com.tr/en/knowledge-base/isp-subscriber-management-radius-pppoe-bng