Skip to main content
Altostrat Radius is the managed access-control workspace for networks that authenticate users through RADIUS or RadSec. You use it to register the network devices that send authentication requests, create the users who sign in, apply policy through groups and attributes, and monitor authentication outcomes in real time. Open the RADIUS UI at radius.altostrat.app. The UI is organized around the same operational objects you manage day to day: folders, users, groups, devices, realms, live logs, and settings.

​
What You Manage

Users

Create RADIUS identities, reset credentials, assign groups, place users in folders, suspend access, and review per-user sessions and usage.

Folders

Organize users into nested containers, pin important folders, set priority, move users, merge folders, and manage bulk onboarding.

Groups and Attributes

Define reusable check and reply attributes, then assign those policy sets directly to users or automatically through realms.

Supported Dictionaries

Pick from the Standard, MikroTik, WISPr, Ubiquiti, Cisco, Aruba, Ruckus, Juniper, Microsoft, and System attributes surfaced by the UI.

NAS Devices

Register routers, switches, access points, VPN gateways, firewalls, wireless controllers, and other RADIUS clients.

CoA and PoD

Configure dynamic authorization for manual disconnects, quota-triggered disconnects, and supported session control workflows.

Architecture and Scale

Understand the global RadSec data plane, mTLS device identity, control plane, analytics plane, multi-region storage, and streaming imports.

Limits and Availability

Review feature coverage, retention, availability targets, throughput limits, migration limits, and default account limits.

Realms

Match usernames such as tim@example.com and automatically apply group attributes to users in that realm.

Live Monitoring

Watch authentication volume, failures, active sessions, device logs, and per-user behavior from the Live View and entity dashboards.

​
App Map

​
Platform Architecture

Altostrat Radius separates live packet handling from policy management and analytics. The ArcRadius data plane uses global ingress, regional load balancing, RadSec mutual TLS, and horizontally scalable RADIUS workers to process authentication close to the nearest healthy regional deployment. The control plane stores and evaluates users, folders, groups, realms, NAS devices, quotas, metadata, and logs. The analytics plane streams accounting and post-authentication events into time-series storage for dashboards, triggers, search, quotas, and reporting. This separation keeps authentication traffic isolated from operator activity, imports, accounting bursts, and long-running queries.

Architecture and Scale

See how RadSec, mTLS identity, caching, sharding, quotas, metrics, and imports fit together.

Supported Dictionaries

Review the current Standard, MikroTik, WISPr, Ubiquiti, Cisco, Aruba, Ruckus, Juniper, Microsoft, and System attributes.

Limits and Availability

See availability targets, authentication throughput limits, migration ceilings, retention, and object limits.
1

Add a NAS device

Start by registering the router, VPN gateway, access point, wireless controller, or other RADIUS client that will send authentication requests.
2

Create groups

Build groups for the common policies you want to reuse, such as access tiers, device roles, customer plans, or operational exceptions.
3

Add users

Create users manually or in bulk, generate credentials, assign groups, and place users in folders when you need hierarchy.
4

Add realms when usernames use domains

Create realms for suffix-based policy, such as example.com, so matching usernames automatically inherit selected group attributes.
5

Enable dynamic authorization only where needed

Configure CoA and PoD settings on NAS devices when active sessions must be disconnected manually or after quota enforcement.
6

Watch live authentication

Use Live View and entity dashboards to confirm accepts, rejects, missing attributes, bad passwords, suspended accounts, and active sessions.

​
Terminology

The UI lets admins customize labels for users, folders, devices, and groups. If your workspace uses different labels, the workflows are the same even when the nouns differ.

​
Where To Go Next

Set Up Your First RADIUS Workspace

Follow the first-run path from NAS registration through test authentication.

Organize Users and Folders

Learn how to create users, use folders, bulk add records, and manage user details.

Build Policy Groups

Understand check attributes, reply attributes, inheritance, and quota-aware presence modes.

Configure CoA and PoD

Enable dynamic authorization for manual disconnects, quota-triggered disconnects, and session control.

Monitor Authentication

Use Live View, logs, metrics, sessions, and dashboards for day-two operations.

Plan Capacity

Check availability targets, retention, throughput, migration, and object limits before a rollout.