NAS Troubleshooting
Common problems with routers (NAS) and how to solve them.
No user can log in through a router
- The router is not in the NAS List, or its IP Address is not the address the router sends from. Check the router's
src-address, or the tunnel IP if it connects over a VPN. - The Shared Secret is different on the router.
- UDP ports 1812 (authentication) and 1813 (accounting) are blocked between the router and SAS Radius.
- The router has two RADIUS servers configured, or uses MS-CHAP authentication. See Connecting a MikroTik Router.
Online users count in SAS Radius is different from the router
- Interim update on the router is longer than User Idle Timeout in Settings → Advanced. Sessions are closed between updates. Keep the idle timeout 2–3 times the interim interval.
- Accounting is disabled on the router (
/ppp aaa set accounting=yes). - Two RADIUS servers are configured on the router.
- The router was rebooted or lost power. Sessions are updated after the next interim updates.
- SAS server performance: There may be a server-side performance issue. The SAS vendor team needs to investigate and check the server performance.
Expired users stay online / Disconnect doesn't work
See Disconnect and CoA.
Users get the wrong IP pool
Check that Pool Name in the NAS form is empty. If it is filled, it replaces the profile pool for all users of that router. Also check that the pool names in the profiles exist on the router, with the same spelling (names are case-sensitive).
Live Traffic chart stays empty
Enable SNMP on the router, enter the same SNMP Community in the NAS form, and check that the sas_userlivetraffic service is running in Tools → System Services.
Ping shows "Mikrotik API error, unable to ping"
Ping works only for NAS type Mikrotik. Fill in the SSH username, password and port in the NAS form and make sure the SSH service is enabled on the router and reachable from SAS Radius.
RTT shows timeout / 100% packet loss
SAS Radius can't ping the router. Check the route or VPN tunnel between them, and that the router doesn't block ICMP from SAS Radius. If you don't need monitoring, turn off Monitor (ping).