Cutting over a live router from another billing system

If a router already serves customers through another billing system, onboard it to ISPMan without disturbing live sessions, import the customers, then switch services over in one controlled step. For bringing customer records in, see Customers. This page covers the router side.

Before you start

Upgrade RouterOS to the latest stable version first. Older versions can fail during script import or WireGuard / RADIUS setup.
Back up the router (/export file=before-ispman plus a binary backup) so you can roll back.
Export existing PPPoE secrets, with passwords, if you’re moving PPPoE customers:
```
/ppp secret export show-sensitive file=ppp-secrets
```
Download the file from Files and treat it like a password list.

1. Onboard manually, step by step

On the device page in ISPMan, use More → Start Manual Onboarding. You get the setup scripts one at a time, in order, instead of one script that changes everything at once. That lets you review each step on a live router.

Read every script before pasting it. On a router with customers online, skip or adjust commands that would override settings your customers depend on:

DNS servers that differ from what your network uses today;
firewall drop rules on the input chain, which can lock out management paths you still rely on;
NTP settings, if the router already syncs time another way.

2. Don’t switch PPPoE authentication over yet

If the router already has active PPPoE users from the old system, keep PPPoE on local secrets until those users exist in ISPMan. If the RADIUS step contains:

/ppp aaa set use-radius=yes accounting=yes interim-update=10m

paste it with use-radius=no for now. Otherwise existing users are checked against ISPMan before they’ve been imported, and they’re disconnected.

3. Import the final script

The last step is a larger script. Paste it into a new file under Files (for example ispman.rsc), then check the device mode:

/system device-mode print

If the mode is advanced, import it:

/import ispman.rsc

If you get not allowed by device-mode, run:

/system device-mode update mode=advanced

Then power-cycle the router (unplug and plug back in) and import again.

Before clicking Complete Manual Onboarding on the device page, check that the WireGuard peer shows a recent handshake. That confirms the tunnel is stable.

4. Import customers and create the services

Create your packages in ISPMan first.
Import the customers (see Customers and PPPoE).
Create the ISPMan hotspot / hotspot server and PPPoE server on the router where needed, but leave them disabled until cutover.

5. Cut over

Do this in a quiet window. Customers reconnect within a minute or two.

Hotspot

If needed, move the LAN ports into the ISPMan bridge, or point the ISPMan hotspot at your existing LAN bridge.
In IP → Addresses, move the ISPMan gateway address onto the production interface and disable the old address on that interface.
In IP → Hotspot, disable the old hotspot server and enable the ISPMan one on the correct interface.
In IP → DHCP Server, disable the old DHCP server and keep ISPMan’s enabled on the correct interface.

PPPoE

Disable the old PPPoE server.
Enable the ISPMan PPPoE server on the correct production interface.
Now switch PPPoE to RADIUS: /ppp aaa set use-radius=yes.

Clean up leftovers

In RADIUS, keep only the ISPMan entries enabled; disable the old system’s servers.
In Interfaces → WireGuard, remove or disable the old system’s tunnels.
In System → Users, disable the old system’s users and keep the ISPMan user enabled.
If several routers share one switch, see the broadcast-domain section of Field notes: common onboarding issues.

6. Verify

The device shows Online in ISPMan and the WireGuard handshake is recent.
A test hotspot login works, and a PPPoE test account authenticates (check PPPoE → Auth Logs).
Imported customers show active sessions.

If PPPoE users fail after the switch, see PPPoE customer can’t connect. You can roll back by re-enabling the old servers and setting use-radius=no.