Disconnect and CoA
SAS Radius sends two kinds of requests to the router:
- Disconnect-Request: ends a user's session. Used for the Disconnect button, and automatically when a user expires, is renamed, deleted, or changes profile.
- CoA (Change of Authorization): changes an online user's settings (for example speed by time-based policies) without disconnecting.
Requests are sent to the router's IP address and Incoming (COA) Port, signed with the Shared Secret. They are queued and sent within a few seconds.
Requirements
- The router accepts incoming RADIUS requests on the same port as in the NAS form (MikroTik:
/radius incoming set accept=yes port=3799). - The shared secret is the same on both sides.
- There is no NAT between SAS Radius and the router, and no firewall blocking that UDP port.
- On a BNG with a CoA client list, the SAS Radius server IP is allowed.
When users are not disconnected
Typical signs: expired users stay online with full speed, the Disconnect button has no effect, or many disconnects are waiting. Check:
| Cause | Fix |
|---|---|
| Router not listening for incoming requests | Enable RADIUS incoming on the router with the right port. |
| Port mismatch | Make Incoming (COA) Port in the NAS form equal to the router's incoming port. |
| Secret mismatch | Set the same Shared Secret on both sides. |
| NAT between SAS Radius and the router | Use a VPN tunnel, or add NAT-bypass rules on the router above the masquerade rules (for example /ip firewall nat add chain=srcnat src-address=SAS_IP action=accept place-before=0). |
| Firewall | Allow UDP to the incoming port from the SAS Radius server. |
| Cisco routers | Enable RFC-compliant CoA: subscriber service coa-rfc-compliant. |
| BNG CoA client list | Add the IP address the SAS Radius server sends from. |
When a router doesn't answer, each request waits for a timeout, and requests for all users queue up behind it. Fixing one unreachable router can speed up disconnects on all other routers.