Monitoring

RADIUS Test

RADIUS Test lets you send a RADIUS Access-Request directly from the admin panel and inspect the response — without needing an actual WiFi client. Use it to verify that user credentials work, check RADIUS attribute assignments, and confirm your RADIUS server is responding correctly.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}
Image not uploaded yet public/assets/img/docs/radius-test/overview.png
RADIUS Test — send an Access-Request and inspect the full response attributes.

What It Does

Kiwire constructs a RADIUS Access-Request packet using the credentials you provide and the RADIUS connector configuration for the current tenant. The request is sent to the configured RADIUS server (which may be Kiwire's built-in FreeRADIUS or an external server). The full response — including all returned attributes — is displayed so you can verify the outcome.

Test Form Fields

FieldRequiredDescription
username Yes The account to test. Must exist in Kiwire (or the connected directory for AD/LDAP methods).
password Yes The password to authenticate with. Transmitted securely using RADIUS PAP/CHAP as configured.
nas_ip No Simulate which NAS/AP is sending the request. If left blank, the diagnostic NAS IP is used. Useful for testing zone-specific restrictions.
calling_station_id No Simulate a device MAC address in the standard RADIUS format (e.g., AA-BB-CC-DD-EE-FF). Used to test MAC-based restrictions or auto-login rules.

Response Display

The response panel shows:

  • Result — Access-Accept or Access-Reject
  • Reply-Message — the human-readable message returned by the RADIUS server (e.g., Your account has expired).
  • All Response Attributes — the complete list of RADIUS attributes in the reply, including:
    • Assigned VLAN (Tunnel-Private-Group-Id)
    • Bandwidth limits (WISPr-Bandwidth-Max-Up, WISPr-Bandwidth-Max-Down)
    • Session timeout (Session-Timeout)
    • Idle timeout (Idle-Timeout)
    • Any custom attributes configured in the user's profile

Common Use Cases

  • Verify a new user can log in — run a test immediately after creating an account to confirm credentials work before handing them to the user.
  • Test an AD/LDAP account — if using Active Directory or LDAP login, confirm the external account resolves correctly through the connector.
  • Check profile attributes — verify that bandwidth limits, VLAN assignments, and session timeouts in the assigned profile are being returned correctly in the RADIUS reply.
  • Diagnose login failures — if a user reports they cannot connect, test their credentials here to see the exact RADIUS rejection reason.
  • Test zone restrictions — supply a specific nas_ip to simulate a request from a particular AP and verify the user is allowed or blocked as expected.

Diagnostic Account

A built-in diagnostic user account is available for quick testing without using a real user's credentials. This account is always active and is excluded from usage counters and login logs. Use it to verify the RADIUS server is reachable and responding without disturbing any real user's session data.

If the diagnostic account returns Access-Reject but a real user's test also fails, the issue is likely with RADIUS server connectivity or shared secret configuration. Check your RADIUS connector settings.

RADIUS Test does not create a real network session. The Access-Accept response is evaluated by Kiwire only — no actual CoA or session is started on an AP.

Required Permissions

view-radius-test