RADIUS CoA / Disconnect Builder

Build Change-of-Authorization and Disconnect-Request packets to change a live subscriber session speed or kick it, without touching the NAS CLI.

Config generator RADIUS & AAA Runs in your browser
Most precise way to identify a session.
Try:

Result

Packet type
CoA-Request (43)
Destination port
UDP 3799
Session identified by
User-Name only
Expected reply
CoA-ACK (44) or CoA-NAK (45)
radclient command
echo "User-Name = "subscriber01", NAS-IP-Address = 10.10.0.1, Mikrotik-Rate-Limit = "50000k/200000k"" | \
  radclient -x 10.10.0.1:3799 coa nas-secret
MikroTik NAS configuration
# RouterOS must accept incoming CoA/Disconnect first
/radius incoming
set accept=yes port=3799

# Verify the active session before and after
/ppp active print where name="subscriber01"
Cisco NAS configuration
aaa server radius dynamic-author
 client <radius-server-ip> server-key nas-secret
 port 3799
 auth-type all
Session identification
Identify the session as precisely as you can. User-Name alone is ambiguous when a subscriber has multiple simultaneous sessions - the NAS may act on the wrong one, or reject the request entirely with a NAK.

About RADIUS CoA / Disconnect Builder

RFC 5176 lets a RADIUS server push changes into a session that is already up. CoA modifies it in place - a speed change without a drop. Disconnect tears it down so the subscriber reconnects and picks up fresh policy. Both arrive at the NAS on UDP 3799, and both need the NAS explicitly configured to accept them.

CoA or disconnect?

CoA is the better experience when the NAS supports changing that particular attribute live - rate limits usually work, address assignment usually does not. Disconnect is blunt but universal: every NAS supports it, and it guarantees the new policy is applied because the session is rebuilt from scratch. Many ISP billing systems use disconnect precisely for that certainty.

Why you get a NAK

A NAK carries an Error-Cause attribute. 401 (unsupported attribute) means the NAS will not change that value live. 404 (invalid request) usually means malformed attributes. 503 (session context not found) means your identification attributes did not match an active session - the usual culprit when only User-Name is supplied.

Common use cases

  • Applying a plan upgrade the moment a customer pays, without waiting for reconnect.
  • Throttling a subscriber who has crossed a fair-use threshold.
  • Forcing reauthentication after a policy or credential change.
  • Clearing a stuck session that accounting shows as active but the customer cannot use.

Edge cases and gotchas

  • Port 3799 must be reachable from the RADIUS server to the NAS, and the NAS must be configured to accept dynamic authorisation.
  • The shared secret for CoA is the same one the NAS uses for auth - a mismatch produces silence, not an error.
  • Sending CoA to the wrong NAS in a redundant pair silently fails; the session lives on exactly one of them.

Frequently asked questions

Nothing happens and I get no reply - why?
Either UDP 3799 is filtered, or dynamic authorisation is not enabled on the NAS. On RouterOS, /radius incoming must have accept=yes. The NAS drops unsolicited packets silently otherwise.
Can I change the IP address with CoA?
Almost never. Framed-IP-Address is fixed at session establishment on most platforms - use a disconnect and let the new address apply on reconnect.