MikroTik PPPoE Automation for Kenyan ISPs: The Complete Guide

MikroTik routers power the access layer of the majority of Kenyan ISPs. Whether you are running a WISP in Kisumu, a fibre-to-the-home network in Nairobi, or a campus-wide PPPoE deployment in Mombasa, RouterOS is almost certainly involved. Yet most ISPs still manage MikroTik manually — logging in to the Winbox UI to disable or enable PPPoE secrets when subscribers don't pay.

What manual MikroTik management costs you

Manual router management is slow, error-prone, and doesn't scale. A single ISP with 200 subscribers might process 60–80 suspensions and reactivations per month. Each one requires an NOC engineer to log in to the correct router, find the correct PPPoE secret, toggle it, and log out. At 5 minutes per action, that is 6–7 hours of NOC time — every month — that could be automated.

The MikroTik RouterOS API

RouterOS exposes a binary API on TCP port 8728 (plain) and 8729 (TLS). Your billing system connects as an API-level admin user, sends command sentences, and receives response sentences. This API can do everything Winbox can do — including managing PPPoE secrets, setting speed profiles, and querying active sessions.

Core automation operations

• Create PPPoE secret on subscriber onboarding
• Set profile (speed tier) when subscriber upgrades or downgrades
• Disable secret on non-payment after grace period expires
• Enable secret immediately on payment receipt
• Query active sessions to detect offline subscribers
• Remove secret on subscription cancellation

Grace period: the right way to handle late payments

Hard suspension the moment a subscription lapses is too aggressive and leads to unnecessary support calls. A grace period engine adds a configurable buffer — typically 24–72 hours — during which the subscriber retains access while reminders are sent via SMS. Suspension only fires if no payment is received by the end of grace.

1. Day 0: Billing date — STK Push dispatched, SMS reminder sent
2. Day 1: No payment — second SMS reminder
3. Day 3: Grace period expires — PPPoE secret disabled, suspension SMS sent
4. Payment received — PPPoE secret re-enabled within 60 seconds, confirmation SMS sent

Multi-router deployments

Kenyan ISPs typically have multiple MikroTik routers — one per base station, sector, or building. Your billing system must know which router each subscriber is connected to and route API calls to the correct device. A subscriber in Karen should not trigger an API call to the router serving Westlands.

Handling router downtime

Routers go offline. If an API call to suspend a non-paying subscriber fails because the router is unreachable, your billing system must queue the command and retry when the router comes back online. Silently ignoring the failure leaves a non-paying subscriber active indefinitely.