Module · NAS Devices
Your fleet, registered, monitored and answerable.
Every BRAS and Mikrotik registered with its shared secret, watched for reachability, and reachable back — disconnects and re-profiles go out as CoA from the panel and come back as logged replies.
What it does
Built in, not bolted on.
Device registry
NAS devices with shared secrets, types and locations. FreeRADIUS trusts exactly the fleet you registered — nothing else.
Live status
Reachability checks and per-NAS online session counts. A dead BRAS shows up on your dashboard before it shows up on your phone.
CoA from the panel
Disconnect a session, apply a new rate limit, kick an expired customer — sent as Change-of-Authorization, acknowledged by the NAS.
CoA logs
Every CoA request and its response is recorded. When a disconnect didn't happen, you know which NAS ignored it and when.
Port binding
Bind a customer to a NAS port so the account only works from the line it was sold for. Sharing stops being a business model.
Vendor agnostic
Anything that speaks RADIUS is a NAS here — Mikrotik, Cisco, Huawei, NetElastic. Import the dictionary and use its attributes.
Change of Authorization
The panel talks back to the network.
; operator clicks disable — session is livePOST /customers/ahmed.k/disablestatus → disabled ; CRM → NAS 10.40.0.1:3799Disconnect-RequestUser-Name = "ahmed.k"Acct-Session-Id = "81600b1f" ; NAS → CRMDisconnect-ACKsession closed · logged in coa_logs next login → rejected (status=disabled)- 01
Actions reach live sessions
Disable, expiry, a speed change — none of it waits for the customer to log in again. The CoA goes out the moment the state changes.
- 02
Acknowledged, not assumed
The NAS answers every CoA, and the answer is logged. 'Did the disconnect actually happen?' is a report, not a mystery.
- 03
The fleet is the boundary
Only registered devices with valid secrets can authenticate subscribers. A rogue AP with your SSID gets nothing.
Screenshot coming — the NAS fleet with live status and CoA log, captured from the live product.
What it replaces
Retire the workaround.
SSHing into the BRAS to kick a session, if you're the one person who knows the command.
Disconnect and re-profile are buttons in the panel — scoped by permission, logged by name.
Discovering a NAS is down when the complaint calls start.
Reachability and session counts per device on the dashboard — the drop to zero is visible in minutes.
One account shared across a street because nothing binds it to a line.
MAC and NAS-port binding per customer. The credentials work where they were sold, and nowhere else.
Keep exploring