MonsterOps logo MonsterOps
Docs / Network / NAS

NAS

Overview

A NAS (Network Access Server) entry is what lets a device — a router, BRAS, switch, or access point — speak RADIUS to the server. It maps to the FreeRADIUS nas table: a name, IP or subnet, a shared secret, and a vendor. Nothing authenticates without a matching NAS entry.

Don't confuse this with the NAS Manager — that's a separate SSH/Telnet layer that logs into devices to manage their config. A NAS entry is purely the RADIUS-client record.

Where things are

  • NAS list — every registered client with its address, vendor, and status. Toolbar: New NAS.
  • New / edit NAS — name, IP address or subnet, shared secret, and vendor. Vendor presets (Cisco, Huawei, MikroTik, …) auto-fill the type and community fields.
  • NAS Groups tab — cluster devices into groups for realm routing and for access control (linking a NAS group to a RADIUS group).
  • Reachability — a background ICMP probe reports a true up/down state per device, shown on the Dashboard's NAS Status widget and on the NAS row (with a "check now" action).

Common tasks

  • Register a device — New NAS → pick the vendor preset → enter the device's IP and a shared secret → Save. Set the same secret on the device.
  • Group devices — create a NAS Group and add members for realm routing or access control.
  • Force a reachability check — use the row action to probe immediately instead of waiting for the interval.

Reachability vs. "idle"

These are independent, and conflating them causes confusion:

  • Activity (active / idle) — whether the device has live sessions or sent RADIUS traffic in the last 15 minutes. A quiet NAS at 3 a.m. is idle; that says nothing about whether it's up.
  • Reachability (up / down) — the ICMP probe pings each NAS on an interval (default 60s) and reports whether it answers. A down (red) device has genuinely stopped responding.

Problems you may hit

A client is marked skipped for reachability

Only a single, individually addressable NAS can be pinged. Entries that are a subnet or wildcard (10.0.0.0/24, *) can't be probed and are marked skipped — that's expected, not a fault.

  • Authentication rejected for a whole device — the shared secret doesn't match on both ends, or the device's source IP isn't covered by any NAS entry. Check the Logs.
  • RADIUS stopped for one NAS after a firewall change — a Firewall block can drop that NAS's packets before FreeRADIUS sees them. Read the firewall safety notes.
  • Disable the probe — set MONSTEROPS_NAS_PROBE_ENABLED=false (Configuration).
  • NAS Manager — manage device config over SSH/Telnet
  • Realms — route NAS groups to realms
  • Firewall — why a block can silently stop a NAS