RADIUS Dynamic Address Assignment

RADIUS Dynamic Address Assignment

Summary

RouterOS can assign IP addresses to PPP (PPPoE, L2TP, PPTP, SSTP, OVPN) and DHCP clients based on attributes returned in a RADIUS Access-Accept. Two attributes control addressing:

• Framed-IP-Address — assigns a specific static IP to the client
• Framed-Pool — names a local /ip pool from which RouterOS allocates an address

If both attributes are returned, Framed-IP-Address takes precedence and Framed-Pool is ignored. This lets you centrally control whether a subscriber receives a fixed or dynamic address without changing NAS configuration.

Attribute Precedence

Priority	Attribute	Behaviour
1	Framed-IP-Address	Assigns the exact IP returned. Overrides Framed-Pool.
2	Framed-Pool	Allocates from the named local /ip pool. Used only when Framed-IP-Address is absent.
3	PPP profile remote-address	Falls back to profile-defined pool when neither RADIUS attribute is present.

Special Framed-IP-Address Values

RouterOS treats certain Framed-IP-Address ranges as signals to fall back to pool allocation from the default profile:

Range	Meaning
127.0.0.0/8	Use the default profile pool (dynamic allocation)
224.0.0.0/3	Use the default profile pool (dynamic allocation)

These ranges allow a RADIUS server to force pool allocation even via the Framed-IP-Address attribute.

Prerequisites

1. A /radius entry must exist with the appropriate service flag (ppp, dhcp).
2. RADIUS must be enabled for the service (/ppp aaa use-radius=yes or DHCP server use-radius=yes).
3. For Framed-Pool, a matching /ip pool with the same name must exist on the router.

Configuration

Step 1 — Add RADIUS Server

/radius
add address=10.0.0.3 secret=RadiusSecret service=ppp

For DHCP address assignment via RADIUS, add dhcp to the service list:

/radius
add address=10.0.0.3 secret=RadiusSecret service=ppp,dhcp

Step 2 — Enable RADIUS for the Service

PPP (covers PPPoE, L2TP, PPTP, SSTP, OVPN):

/ppp aaa
set use-radius=yes

DHCP Server:

/ip dhcp-server
set [find name=dhcp1] use-radius=yes

Step 3 — Create Local Pools (for Framed-Pool)

Define the pools that RADIUS will reference by name:

/ip pool
add name=broadband-standard ranges=100.64.0.2-100.64.0.254
add name=broadband-premium  ranges=100.64.1.2-100.64.1.254
add name=broadband-business  ranges=100.64.2.2-100.64.2.10

Pool names must match exactly what the RADIUS server returns in Framed-Pool.

RADIUS Server Side

Your RADIUS server returns one of the following in Access-Accept:

Static IP assignment:

Framed-IP-Address = 100.64.5.42

Pool-based assignment:

Framed-Pool = broadband-standard

Force dynamic from default profile pool:

Framed-IP-Address = 127.0.0.1

PPP Profile Integration

The PPP profile provides a default pool when RADIUS does not specify one. This is the fallback, not an override:

/ppp profile
add name=isp-default \
    local-address=10.0.0.1 \
    remote-address=broadband-standard \
    use-compression=no

When RADIUS returns Framed-Pool=broadband-premium, the client receives an address from broadband-premium, ignoring the profile’s remote-address.

Verifying Address Assignment

Check which addresses are currently allocated from each pool:

/ip pool used print

Find the address assigned to a specific PPP client:

/ppp active print where name=subscriber1

Check DHCP leases assigned via RADIUS:

/ip dhcp-server lease print where radius=yes

Common Issues

Framed-Pool name not resolving

RouterOS silently falls back to the profile pool if the pool named in Framed-Pool does not exist locally. Always verify pool names match:

/ip pool print

Client receives wrong address

Confirm what RADIUS is actually returning by enabling PPP logging:

/system logging
add topics=ppp,debug action=memory

Then review /log print after a client connects.

DHCP client not receiving RADIUS-assigned address

Ensure the DHCP server has use-radius=yes and that /radius has service=dhcp. DHCP does not use /ppp aaa — each service has its own RADIUS enable flag.

Related Documentation

• RADIUS Client — Server configuration and attribute handling
• RADIUS Accounting and CoA — Session tracking and dynamic policy updates
• IP Pools — Pool creation and management
• ISP Subscriber Management — End-to-end PPPoE/DHCP service design