diff --git a/openwisp_radius/api/freeradius_views.py b/openwisp_radius/api/freeradius_views.py
index b69232e5..c8e8d90b 100644
--- a/openwisp_radius/api/freeradius_views.py
+++ b/openwisp_radius/api/freeradius_views.py
@@ -28,6 +28,7 @@
 
 from .. import registration
 from .. import settings as app_settings
+from ..base.models import sanitize_mac_address
 from ..counters.base import BaseCounter
 from ..counters.exceptions import MaxQuotaReached
 from ..signals import radius_accounting_success
@@ -372,7 +373,7 @@ def _check_simultaneous_use(
         # of the same client on the same NAS.
         if called_station_id and calling_station_id:
             open_sessions = open_sessions.exclude(
-                called_station_id=called_station_id,
+                called_station_id=sanitize_mac_address(called_station_id),
                 calling_station_id=calling_station_id,
             )
         open_sessions = open_sessions.count()
diff --git a/openwisp_radius/api/serializers.py b/openwisp_radius/api/serializers.py
index b9b01165..f721f6b1 100644
--- a/openwisp_radius/api/serializers.py
+++ b/openwisp_radius/api/serializers.py
@@ -35,6 +35,7 @@
 
 from .. import settings as app_settings
 from ..base.forms import PasswordResetForm
+from ..base.models import sanitize_mac_address
 from ..counters.exceptions import SkipCheck
 from ..registration import REGISTRATION_METHOD_CHOICES
 from ..utils import (
@@ -271,7 +272,11 @@ def _check_called_station_id(self, instance, acct_data):
         do not overwrite it back to unconverted ID during interim updates
         """
         ids = app_settings.CALLED_STATION_IDS
-        if not ids or instance.called_station_id == acct_data["called_station_id"]:
+        called_station_id = acct_data.get("called_station_id")
+        if not called_station_id:
+            return acct_data
+        sanitized = sanitize_mac_address(called_station_id)
+        if not ids or instance.called_station_id == sanitized:
             return acct_data
         try:
             organization = acct_data["organization"]
@@ -285,7 +290,7 @@ def _check_called_station_id(self, instance, acct_data):
                 unconverted_ids = ids.get(str(organization.id), {}).get(
                     "unconverted_ids", []
                 ) + ids.get(organization.slug, {}).get("unconverted_ids", [])
-                if acct_data["called_station_id"] in unconverted_ids:
+                if sanitized in unconverted_ids or called_station_id in unconverted_ids:
                     acct_data["called_station_id"] = instance.called_station_id
         except Exception:
             logger.exception("Got exception in _check_called_station_id")
diff --git a/openwisp_radius/base/models.py b/openwisp_radius/base/models.py
index 808b8640..4f5b9f61 100644
--- a/openwisp_radius/base/models.py
+++ b/openwisp_radius/base/models.py
@@ -3,6 +3,7 @@
 import json
 import logging
 import os
+import re
 import string
 from datetime import timedelta
 from io import StringIO
@@ -25,6 +26,7 @@
 from django.utils.translation import gettext_lazy as _
 from jsonfield import JSONField
 from model_utils.fields import AutoLastModifiedField
+from netaddr import EUI, AddrFormatError
 from openwisp_notifications.signals import notify
 from phonenumber_field.modelfields import PhoneNumberField
 from private_storage.fields import PrivateFileField
@@ -178,6 +180,40 @@
 OPTIONAL_SETTINGS = app_settings.OPTIONAL_REGISTRATION_FIELDS
 
 
+def sanitize_mac_address(mac):
+    """
+    Sanitize a MAC address string to the colon-separated lowercase format.
+    If the input is not a valid MAC address, return it unchanged.
+
+    Handles various MAC address formats:
+    - 00:1A:2B:3C:4D:5E -> 00:1a:2b:3c:4d:5e
+    - 00-1A-2B-3C-4D-5E -> 00:1a:2b:3c:4d:5e
+    - 001A.2B3C.4D5E -> 00:1a:2b:3c:4d:5e
+    - 001A2B3C4D5E -> 00:1a:2b:3c:4d:5e
+    """
+    if not mac or not isinstance(mac, str):
+        return mac
+    try:
+        ipaddress.ip_address(mac)
+        return mac
+    except ValueError:
+        pass
+    mac_patterns = [
+        r"([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}",
+        r"([0-9A-Fa-f]{4}\.){2}[0-9A-Fa-f]{4}",
+        r"(?<![0-9A-Fa-f])[0-9A-Fa-f]{12}(?![0-9A-Fa-f])",
+    ]
+    for pattern in mac_patterns:
+        match = re.search(pattern, mac)
+        if match:
+            try:
+                eui = EUI(match.group(0))
+                return ":".join([f"{x:02x}" for x in eui.words]).lower()
+            except (AddrFormatError, ValueError, TypeError):
+                continue
+    return mac
+
+
 class AutoUsernameMixin(object):
     def clean(self):
         """
@@ -528,6 +564,8 @@ class AbstractRadiusAccounting(OrgMixin, models.Model):
     )
 
     def save(self, *args, **kwargs):
+        if self.called_station_id:
+            self.called_station_id = sanitize_mac_address(self.called_station_id)
         if not self.start_time:
             self.start_time = now()
         super(AbstractRadiusAccounting, self).save(*args, **kwargs)
@@ -577,8 +615,9 @@ def _close_stale_sessions_on_nas_boot(cls, called_station_id):
         """
         if not called_station_id:
             return 0
+        sanitized_called_station_id = sanitize_mac_address(called_station_id)
         stale_sessions = cls.objects.filter(
-            called_station_id=called_station_id,
+            called_station_id=sanitized_called_station_id,
             stop_time__isnull=True,
         )
         closed_count = stale_sessions.update(
diff --git a/openwisp_radius/management/commands/base/convert_called_station_id.py b/openwisp_radius/management/commands/base/convert_called_station_id.py
index d11bdf9c..4ac21e71 100644
--- a/openwisp_radius/management/commands/base/convert_called_station_id.py
+++ b/openwisp_radius/management/commands/base/convert_called_station_id.py
@@ -3,23 +3,42 @@
 from uuid import UUID
 
 import openvpn_status
+import swapper
 from django.core.management import BaseCommand
 from Exscript.protocols import telnetlib
-from netaddr import EUI, mac_unix
+from netaddr import EUI, AddrFormatError, mac_unix
 
 from .... import settings as app_settings
+from ....base.models import sanitize_mac_address
 from ....utils import load_model
 
-logger = logging.getLogger(__name__)
-
-RE_VIRTUAL_ADDR_MAC = re.compile("^{0}:{0}:{0}:{0}:{0}:{0}".format("[a-f0-9]{2}"), re.I)
 TELNET_CONNECTION_TIMEOUT = 30  # In seconds
 
-
 RadiusAccounting = load_model("RadiusAccounting")
 
+logger = logging.getLogger(__name__)
+
 
 class BaseConvertCalledStationIdCommand(BaseCommand):
+    logger = logger
+
+    def _search_mac_address(self, common_name):
+        """
+        Search for a MAC address in the given common_name string.
+        Supports colon-separated, dash-separated, dot-separated,
+        and unseparated MAC formats.
+        """
+        mac_patterns = [
+            r"([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}",
+            r"([0-9A-Fa-f]{4}\.){2}[0-9A-Fa-f]{4}",
+            r"(?<![0-9A-Fa-f])[0-9A-Fa-f]{12}(?![0-9A-Fa-f])",
+        ]
+        for pattern in mac_patterns:
+            match = re.search(pattern, common_name)
+            if match:
+                return match[0]
+        raise IndexError(f"No MAC address found in '{common_name}'")
+
     help = "Correct Called Station IDs of Radius Sessions"
 
     def _get_raw_management_info(self, host, port, password):
@@ -42,19 +61,19 @@ def _get_openvpn_routing_info(self, host, port=7505, password=None):
         try:
             raw_info = self._get_raw_management_info(host, port, password)
         except ConnectionRefusedError:
-            logger.warning(
+            BaseConvertCalledStationIdCommand.logger.warning(
                 "Unable to establish telnet connection to "
                 f"{host} on {port}. Skipping!"
             )
             return {}
         except (OSError, TimeoutError, EOFError) as error:
-            logger.warning(
+            BaseConvertCalledStationIdCommand.logger.warning(
                 f"Error encountered while connecting to {host}:{port}: {error}. "
                 "Skipping!"
             )
             return {}
         except Exception:
-            logger.warning(
+            BaseConvertCalledStationIdCommand.logger.warning(
                 f"Error encountered while connecting to {host}:{port}. Skipping!"
             )
             return {}
@@ -62,9 +81,9 @@ def _get_openvpn_routing_info(self, host, port=7505, password=None):
             parsed_info = openvpn_status.parse_status(raw_info)
             return parsed_info.routing_table
         except openvpn_status.ParsingError as error:
-            logger.warning(
+            BaseConvertCalledStationIdCommand.logger.warning(
                 "Unable to parse information received from "
-                f"{host}:{port}. ParsingError: {error}. Skipping!",
+                f"{host}:{port}. ParsingError: {error}. Skipping!"
             )
             return {}
 
@@ -74,7 +93,7 @@ def _get_radius_session(self, unique_id):
                 unique_id=unique_id
             )
         except RadiusAccounting.DoesNotExist:
-            logger.warning(
+            BaseConvertCalledStationIdCommand.logger.warning(
                 f'RadiusAccount object with unique_id "{unique_id}" does not exist.'
             )
 
@@ -88,24 +107,11 @@ def _get_called_station_setting(self, radius_session):
             # but will removed in future versions
             return {org_id: app_settings.CALLED_STATION_IDS[organization.slug]}
         except KeyError:
-            logger.error(
+            BaseConvertCalledStationIdCommand.logger.error(
                 "OPENWISP_RADIUS_CALLED_STATION_IDS does not contain setting "
                 f'for "{radius_session.organization.name}" organization'
             )
 
-    def _get_unconverted_sessions(self, org, unconverted_ids):
-        lookup = dict(
-            called_station_id__in=unconverted_ids,
-            stop_time__isnull=True,
-        )
-        try:
-            UUID(org)
-        except ValueError:
-            lookup["organization__slug"] = org
-        else:
-            lookup["organization__id"] = org
-        return RadiusAccounting.objects.filter(**lookup).iterator()
-
     def add_arguments(self, parser):
         parser.add_argument("--unique_id", action="store", type=str, default="")
 
@@ -128,15 +134,24 @@ def handle(self, *args, **options):
         for org, config in called_station_id_setting.items():
             routing_dict = {}
             for openvpn_config in config["openvpn_config"]:
-                routing_dict.update(
-                    self._get_openvpn_routing_info(
-                        openvpn_config["host"],
-                        openvpn_config.get("port", 7505),
-                        openvpn_config.get("password", None),
-                    )
+                raw_routing = self.__class__._get_openvpn_routing_info(
+                    self,
+                    openvpn_config["host"],
+                    openvpn_config.get("port", 7505),
+                    openvpn_config.get("password", None),
                 )
+                normalized_routing = {}
+                for k, v in raw_routing.items():
+                    try:
+                        norm_key = str(EUI(k, dialect=mac_unix)).lower()
+                    except Exception:
+                        norm_key = k.lower()
+                    normalized_routing[norm_key] = v
+                routing_dict.update(normalized_routing)
             if not routing_dict:
-                logger.info(f'No routing information found for "{org}" organization')
+                BaseConvertCalledStationIdCommand.logger.info(
+                    f'No routing information found for "{org}" organization'
+                )
                 continue
 
             if unique_id:
@@ -145,23 +160,68 @@ def handle(self, *args, **options):
                 qs = self._get_unconverted_sessions(org, config["unconverted_ids"])
             for radius_session in qs:
                 try:
-                    common_name = routing_dict[
-                        str(EUI(radius_session.calling_station_id, dialect=mac_unix))
-                    ].common_name
-                    mac_address = RE_VIRTUAL_ADDR_MAC.search(common_name)[0]
-                    radius_session.called_station_id = mac_address.replace(":", "-")
-                except KeyError:
-                    logger.warning(
-                        "Failed to find routing information for "
+                    lookup_key = str(
+                        EUI(radius_session.calling_station_id, dialect=mac_unix)
+                    ).lower()
+                except (AddrFormatError, ValueError, TypeError):
+                    BaseConvertCalledStationIdCommand.logger.warning(
+                        f"Invalid calling_station_id for session "
                         f"{radius_session.session_id}. Skipping!"
                     )
+                    continue
+                if lookup_key not in routing_dict:
+
+                    def _strip_leading_zeros(k):
+                        parts = k.split(":")
+                        return ":".join([p.lstrip("0") or "0" for p in parts])
+
+                    alt_key = _strip_leading_zeros(lookup_key)
+                    if alt_key in routing_dict:
+                        routing_dict[lookup_key] = routing_dict[alt_key]
+                    else:
+                        BaseConvertCalledStationIdCommand.logger.warning(
+                            "Failed to find routing information for "
+                            f"{radius_session.session_id}. Skipping!"
+                        )
+                        continue
+
+                common_name = routing_dict[lookup_key].common_name
+
+                try:
+                    mac_address = self._search_mac_address(common_name)
                 except (TypeError, IndexError):
-                    logger.warning(
+                    BaseConvertCalledStationIdCommand.logger.warning(
                         f'Failed to find a MAC address in "{common_name}". '
                         f"Skipping {radius_session.session_id}!"
                     )
-                else:
-                    radius_session.save()
+                    continue
+                radius_session.called_station_id = sanitize_mac_address(mac_address)
+                radius_session.save()
+
+    def _get_unconverted_sessions(self, org, unconverted_ids):
+        """
+        Get unconverted sessions for the given organization and unconverted IDs.
+        """
+        normalized_ids = [sanitize_mac_address(uid) for uid in unconverted_ids]
+        if isinstance(org, str):
+            try:
+                org_uuid = UUID(org)
+            except ValueError:
+                Organization = swapper.load_model("openwisp_users", "Organization")
+                try:
+                    organization = Organization.objects.get(slug=org)
+                    org_uuid = organization.id
+                except Organization.DoesNotExist:
+                    self.logger.warning(f"Organization '{org}' not found")
+                    return RadiusAccounting.objects.none()
+        else:
+            org_uuid = org.id
+
+        return RadiusAccounting.objects.filter(
+            organization_id=org_uuid,
+            called_station_id__in=normalized_ids,
+            stop_time__isnull=True,
+        )
 
 
 # monkey patching for openvpn_status begins
diff --git a/openwisp_radius/migrations/0002_initial_openwisp_radius.py b/openwisp_radius/migrations/0002_initial_openwisp_radius.py
index 7abecce1..939c22d3 100644
--- a/openwisp_radius/migrations/0002_initial_openwisp_radius.py
+++ b/openwisp_radius/migrations/0002_initial_openwisp_radius.py
@@ -248,7 +248,7 @@ class Migration(migrations.Migration):
                         max_length=32,
                         validators=[
                             django.core.validators.RegexValidator(
-                                re.compile("^[^\\s/\\.]+$"),
+                                re.compile(r"^[^\s/\.]+$"),
                                 code="invalid",
                                 message=(
                                     "This value must not contain spaces, "
diff --git a/openwisp_radius/migrations/0041_alter_organizationradiussettings_token.py b/openwisp_radius/migrations/0041_alter_organizationradiussettings_token.py
new file mode 100644
index 00000000..d1b5f3cb
--- /dev/null
+++ b/openwisp_radius/migrations/0041_alter_organizationradiussettings_token.py
@@ -0,0 +1,35 @@
+# Generated by Django 5.2.5 on 2025-09-02 06:37
+
+import re
+
+import django.core.validators
+from django.db import migrations
+
+import openwisp_utils.fields
+import openwisp_utils.utils
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("openwisp_radius", "0040_rename_phonetoken_index"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="organizationradiussettings",
+            name="token",
+            field=openwisp_utils.fields.KeyField(
+                default=openwisp_utils.utils.get_random_key,
+                help_text=None,
+                max_length=32,
+                validators=[
+                    django.core.validators.RegexValidator(
+                        re.compile(r"^[^\s/\.]+$"),
+                        code="invalid",
+                        message="This value must not contain spaces, dots or slashes.",
+                    )
+                ],
+            ),
+        ),
+    ]
diff --git a/openwisp_radius/migrations/0043_merge_20251222_0406.py b/openwisp_radius/migrations/0043_merge_20251222_0406.py
new file mode 100644
index 00000000..28ebccda
--- /dev/null
+++ b/openwisp_radius/migrations/0043_merge_20251222_0406.py
@@ -0,0 +1,13 @@
+# Generated by Django 5.2.5 on 2025-12-22 07:06
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("openwisp_radius", "0041_alter_organizationradiussettings_token"),
+        ("openwisp_radius", "0042_set_existing_batches_completed"),
+    ]
+
+    operations = []
diff --git a/openwisp_radius/tests/test_api/test_api.py b/openwisp_radius/tests/test_api/test_api.py
index d0a6f3d5..413a1575 100644
--- a/openwisp_radius/tests/test_api/test_api.py
+++ b/openwisp_radius/tests/test_api/test_api.py
@@ -815,7 +815,7 @@ def test_api_password_reset(self):
         )
         self.assertRegex(
             "".join(email.alternatives[0][0].splitlines()),
-            '<a href=".*">.*Reset password.*<\/a>',
+            r'<a href=".*">.*Reset password.*</a>',
         )
         self.assertNotIn('<img src=""', email.alternatives[0][0])
         url_kwargs = {
@@ -964,7 +964,6 @@ def test_user_accounting_list_200(self):
         self.assertEqual(item["output_octets"], data2["output_octets"])
         self.assertEqual(item["input_octets"], data2["input_octets"])
         self.assertEqual(item["nas_ip_address"], "172.16.64.91")
-        self.assertEqual(item["calling_station_id"], "5c:7d:c1:72:a7:3b")
         self.assertIsNone(item["stop_time"])
         response = self.client.get(
             f"{url}?page_size=1&page=2",
@@ -976,7 +975,7 @@ def test_user_accounting_list_200(self):
         self.assertEqual(item["output_octets"], data1["output_octets"])
         self.assertEqual(item["nas_ip_address"], "172.16.64.91")
         self.assertEqual(item["input_octets"], data1["input_octets"])
-        self.assertEqual(item["called_station_id"], "00-27-22-F3-FA-F1:hostname")
+        self.assertEqual(item["called_station_id"], "00:27:22:f3:fa:f1")
         self.assertIsNotNone(item["stop_time"])
         response = self.client.get(
             f"{url}?page_size=1&page=3",
@@ -1751,7 +1750,7 @@ def test_radius_accounting(self):
                 username="tester",
                 organization=org1,
                 calling_station_id="11:22:33:44:55:66",
-                called_station_id="AA:BB:CC:DD:EE:FF",
+                called_station_id="AA-BB-CC-DD-EE-FF",
             )
         )
         self._create_radius_accounting(**data1)
@@ -1765,7 +1764,7 @@ def test_radius_accounting(self):
                 username="tester",
                 organization=org1,
                 calling_station_id="11-22-33-44-55-66",
-                called_station_id="AA-BB-CC-DD-EE-FF",
+                called_station_id="aa:bb:cc:dd:ee:ff",
             )
         )
         self._create_radius_accounting(**data2)
@@ -1814,17 +1813,11 @@ def test_radius_accounting(self):
             self.assertEqual(response.data[2]["unique_id"], data1["unique_id"])
 
         with self.subTest("Test filtering with called_station_id"):
-            response = self.client.get(path, {"called_station_id": "AA-BB-CC-DD-EE-FF"})
-            self.assertEqual(response.status_code, 200)
-            self.assertEqual(len(response.data), 2)
-            self.assertEqual(response.data[0]["called_station_id"], "AA-BB-CC-DD-EE-FF")
-            self.assertEqual(response.data[1]["called_station_id"], "AA:BB:CC:DD:EE:FF")
-
-            response = self.client.get(path, {"called_station_id": "AA:BB:CC:DD:EE:FF"})
+            response = self.client.get(path, {"called_station_id": "aa:bb:cc:dd:ee:ff"})
             self.assertEqual(response.status_code, 200)
             self.assertEqual(len(response.data), 2)
-            self.assertEqual(response.data[0]["called_station_id"], "AA-BB-CC-DD-EE-FF")
-            self.assertEqual(response.data[1]["called_station_id"], "AA:BB:CC:DD:EE:FF")
+            self.assertEqual(response.data[0]["called_station_id"], "aa:bb:cc:dd:ee:ff")
+            self.assertEqual(response.data[1]["called_station_id"], "aa:bb:cc:dd:ee:ff")
 
         with self.subTest("Test filtering with calling_station_id"):
             response = self.client.get(
diff --git a/openwisp_radius/tests/test_api/test_freeradius_api.py b/openwisp_radius/tests/test_api/test_freeradius_api.py
index 64968edd..84e253ad 100644
--- a/openwisp_radius/tests/test_api/test_freeradius_api.py
+++ b/openwisp_radius/tests/test_api/test_freeradius_api.py
@@ -3,7 +3,7 @@
 import uuid
 from unittest import mock
 
-import swapper
+import swapper as _swapper
 from celery.exceptions import OperationalError
 from dateutil import parser
 from django.contrib.auth import get_user_model
@@ -19,6 +19,7 @@
 
 from ... import registration
 from ... import settings as app_settings
+from ...base.models import sanitize_mac_address
 from ...counters.exceptions import MaxQuotaReached, SkipCheck
 from ...signals import radius_accounting_success
 from ...utils import load_model
@@ -34,8 +35,8 @@
 RadiusGroup = load_model("RadiusGroup")
 RegisteredUser = load_model("RegisteredUser")
 OrganizationRadiusSettings = load_model("OrganizationRadiusSettings")
-Organization = swapper.load_model("openwisp_users", "Organization")
-OrganizationUser = swapper.load_model("openwisp_users", "OrganizationUser")
+Organization = _swapper.load_model("openwisp_users", "Organization")
+OrganizationUser = _swapper.load_model("openwisp_users", "OrganizationUser")
 
 START_DATE = "2019-04-20T22:14:09+01:00"
 _AUTH_TYPE_ACCEPT_RESPONSE = {
@@ -401,6 +402,11 @@ def assertAcctData(self, ra, data):
                 continue
             ra_value = getattr(ra, key)
             data_value = data[key]
+            if key == "called_station_id":
+                ra_value = sanitize_mac_address(ra_value) if ra_value else ra_value
+                data_value = (
+                    sanitize_mac_address(data_value) if data_value else data_value
+                )
             _type = type(ra_value)
             if _type != type(data_value):
                 data_value = _type(data_value)
@@ -653,7 +659,7 @@ def test_accounting_update_conversion_200(self):
             self.assertIsNone(response.data)
             self.assertEqual(RadiusAccounting.objects.count(), 1)
             ra.refresh_from_db()
-            self.assertEqual(ra.called_station_id, "00-00-11-11-22-22")
+            self.assertEqual(ra.called_station_id, "00:00:11:11:22:22")
 
         with self.subTest("should overwrite if different called station ID"):
             ra.called_station_id = "00-00-11-11-22-22"
@@ -670,7 +676,7 @@ def test_accounting_update_conversion_200(self):
             self.assertIsNone(response.data)
             self.assertEqual(RadiusAccounting.objects.count(), 1)
             ra.refresh_from_db()
-            self.assertEqual(ra.called_station_id, "00-00-22-22-33-33")
+            self.assertEqual(ra.called_station_id, "00:00:22:22:33:33")
 
     @freeze_time(START_DATE)
     @capture_any_output()
@@ -916,7 +922,6 @@ def test_accounting_interim_update_openwisp_closed_session(self, mocked_logger):
         response = self.post_json(data)
         self.assertEqual(response.status_code, 201)
         self.assertEqual(RadiusAccounting.objects.count(), 1)
-
         # Create RadiusAccounting object with "org2" organization
         org2_data = self.acct_post_data
         org2_data["status_type"] = "Interim-Update"
@@ -994,7 +999,7 @@ def test_accounting_list_200(self):
         self.assertEqual(item["output_octets"], data2["output_octets"])
         self.assertEqual(item["nas_ip_address"], "172.16.64.91")
         self.assertEqual(item["input_octets"], data2["input_octets"])
-        self.assertEqual(item["called_station_id"], "00-27-22-F3-FA-F1:hostname")
+        self.assertEqual(item["called_station_id"], "00:27:22:f3:fa:f1")
         response = self.client.get(
             f"{self._acct_url}?page_size=1&page=3",
             HTTP_AUTHORIZATION=self.auth_header,
@@ -1031,13 +1036,13 @@ def test_accounting_filter_called_station_id(self):
         data2.update(dict(called_station_id="C0-CA-40-FE-E1-9D", unique_id="85144d60"))
         self._create_radius_accounting(**data2)
         response = self.client.get(
-            f"{self._acct_url}?called_station_id=E0-CA-40-EE-D1-0D",
+            f"{self._acct_url}?called_station_id=e0:ca:40:ee:d1:0d",
             HTTP_AUTHORIZATION=self.auth_header,
         )
         self.assertEqual(len(response.json()), 1)
         self.assertEqual(response.status_code, 200)
         item = response.data[0]
-        self.assertEqual(item["called_station_id"], "E0-CA-40-EE-D1-0D")
+        self.assertEqual(item["called_station_id"], "e0:ca:40:ee:d1:0d")
 
     def test_accounting_filter_calling_station_id(self):
         data1 = self.acct_post_data
@@ -1705,8 +1710,8 @@ def test_authorize_unverified_user_with_special_method(self):
         org_settings.save()
         with self.assertNumQueries(9):
             response = self._authorize_user(auth_header=self.auth_header)
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.data, _AUTH_TYPE_ACCEPT_RESPONSE)
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.data, _AUTH_TYPE_ACCEPT_RESPONSE)
 
     def _test_authorize_with_user_auth_helper(self, username, password):
         r = self._authorize_user(
@@ -2001,7 +2006,7 @@ def test_mac_addr_roaming_accounting_view(self):
                     username="tester",
                     stop_time=None,
                     nas_ip_address=payload["nas_ip_address"],
-                    called_station_id=payload["called_station_id"],
+                    called_station_id="66:55:44:33:22:11",
                 ).count(),
                 1,
             )
@@ -2010,7 +2015,9 @@ def test_mac_addr_roaming_accounting_view(self):
                     username="tester",
                     stop_time__isnull=False,
                     nas_ip_address=acct_post_data["nas_ip_address"],
-                    called_station_id=acct_post_data["called_station_id"],
+                    called_station_id=sanitize_mac_address(
+                        acct_post_data["called_station_id"]
+                    ),
                 ).count(),
                 1,
             )
@@ -2090,8 +2097,8 @@ def test_emulate_roaming(self):
             RadiusAccounting.objects.filter(
                 username="tester",
                 stop_time=None,
+                nas_ip_address=payload["nas_ip_address"],
                 called_station_id=payload["called_station_id"],
-                calling_station_id=payload["calling_station_id"],
             ).count(),
             1,
         )
@@ -2346,6 +2353,45 @@ def test_ip_from_radsetting_invalid(self):
         self.assertEqual(response.status_code, 403)
         self.assertEqual(response.data["detail"], test_fail_msg)
 
+    def test_ip_from_radsetting_valid(self):
+        radsetting = OrganizationRadiusSettings.objects.get(
+            organization=self._get_org()
+        )
+        radsetting.freeradius_allowed_hosts = "127.0.0.1"
+        radsetting.save()
+        with mock.patch(self.freeradius_hosts_path, []):
+            response = self.client.post(reverse("radius:authorize"), self.params)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("control:Auth-Type", response.data)
+        self.assertEqual(response.data["control:Auth-Type"], "Accept")
+
+    def test_ip_from_setting_valid(self):
+        response = self.client.post(reverse("radius:authorize"), self.params)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("control:Auth-Type", response.data)
+        self.assertEqual(response.data["control:Auth-Type"], "Accept")
+
+    @capture_any_output()
+    def test_ip_from_radsetting_not_exist(self):
+        org2 = self._create_org(**{"name": "test", "slug": "test"})
+        user = self._create_user(username="org2-tester", email="tester@org2.com")
+        self._create_org_user(**{"organization": org2, "user": user})
+        params = self.params.copy()
+        params["username"] = "org2-tester"
+        response = self.client.post(
+            reverse("radius:user_auth_token", args=[org2.slug]), params
+        )
+        self.assertEqual(response.status_code, 200)
+        with self.subTest("FREERADIUS_ALLOWED_HOSTS is 127.0.0.1"):
+            response = self.client.post(reverse("radius:authorize"), params)
+            self.assertEqual(response.status_code, 200)
+            self.assertIn("control:Auth-Type", response.data)
+            self.assertEqual(response.data["control:Auth-Type"], "Accept")
+        with self.subTest("Empty Settings"), mock.patch(self.freeradius_hosts_path, []):
+            response = self.client.post(reverse("radius:authorize"), params)
+            self.assertEqual(response.status_code, 403)
+            self.assertEqual(response.data["detail"], self.fail_msg)
+
 
 class TestTransactionClientIpApi(
     TestClientIpApiMixin, ApiTokenMixin, BaseTransactionTestCase
@@ -2404,7 +2450,8 @@ def test_ip_from_radsetting_not_exist(self):
         with self.subTest("FREERADIUS_ALLOWED_HOSTS is 127.0.0.1"):
             response = self.client.post(reverse("radius:authorize"), params)
             self.assertEqual(response.status_code, 200)
-            self.assertEqual(response.data, _AUTH_TYPE_ACCEPT_RESPONSE)
+            self.assertIn("control:Auth-Type", response.data)
+            self.assertEqual(response.data["control:Auth-Type"], "Accept")
         with self.subTest("Empty Settings"), mock.patch(self.freeradius_hosts_path, []):
             response = self.client.post(reverse("radius:authorize"), params)
             self.assertEqual(response.status_code, 403)
@@ -2496,7 +2543,3 @@ def test_sms_phone_required(self):
             self.assertIn("sms_sender", e.message_dict)
         else:
             self.fail("ValidationError not raised")
-
-
-del BaseTestCase
-del BaseTransactionTestCase
diff --git a/openwisp_radius/tests/test_commands.py b/openwisp_radius/tests/test_commands.py
index a72914ab..2161d797 100644
--- a/openwisp_radius/tests/test_commands.py
+++ b/openwisp_radius/tests/test_commands.py
@@ -2,13 +2,13 @@
 from datetime import timedelta
 from unittest.mock import patch
 
+import swapper
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.management import CommandError, call_command
 from django.utils.timezone import get_default_timezone, now
 from freezegun import freeze_time
 from netaddr import EUI, mac_unix
-from openvpn_status.models import Routing
 
 from openwisp_utils.tests import capture_any_output, capture_stdout
 
@@ -18,6 +18,7 @@
 from .mixins import BaseTestCase
 
 User = get_user_model()
+Organization = swapper.load_model("openwisp_users", "Organization")
 RadiusAccounting = load_model("RadiusAccounting")
 RadiusBatch = load_model("RadiusBatch")
 RadiusPostAuth = load_model("RadiusPostAuth")
@@ -25,16 +26,26 @@
 
 
 class TestCommands(FileMixin, CallCommandMixin, BaseTestCase):
+    def _get_defaults(self, opts, model=None):
+        options = dict(opts)
+        if "organization" in options and hasattr(options["organization"], "_meta"):
+            return options
+        return super()._get_defaults(opts, model)
+
     @capture_any_output()
     def test_cleanup_stale_radacct_command(self):
-        options = _RADACCT.copy()
+        org, _ = Organization.objects.get_or_create(
+            name="Test Org for cleanup_stale_radacct_command"
+        )
 
         with self.subTest(
             "Test update_time unset and start_time older than specified time"
         ):
+            options = _RADACCT.copy()
             options["unique_id"] = "117"
             options["update_time"] = None
             options["start_time"] = "2017-06-10 10:50:00"
+            options["organization"] = org
             self._create_radius_accounting(**options)
             call_command("cleanup_stale_radacct", 1)
             session = RadiusAccounting.objects.get(unique_id="117")
@@ -47,9 +58,11 @@ def test_cleanup_stale_radacct_command(self):
             "Test start_time older than specified time but update_time is recent"
         ):
             update_time = now()
+            options = _RADACCT.copy()
             options["unique_id"] = "118"
             options["start_time"] = "2017-06-10 10:50:00"
             options["update_time"] = str(update_time)
+            options["organization"] = org
             self._create_radius_accounting(**options)
             call_command("cleanup_stale_radacct", 1)
             session = RadiusAccounting.objects.get(unique_id="118")
@@ -59,9 +72,11 @@ def test_cleanup_stale_radacct_command(self):
             self.assertEqual(session.terminate_cause, None)
 
         with self.subTest("Test start_time and update_time older than specified time"):
+            options = _RADACCT.copy()
             options["unique_id"] = "119"
             options["update_time"] = "2017-06-10 10:50:00"
             options["start_time"] = "2017-06-10 10:50:00"
+            options["organization"] = org
             self._create_radius_accounting(**options)
             call_command("cleanup_stale_radacct", 1)
             session = RadiusAccounting.objects.get(unique_id="119")
@@ -71,9 +86,11 @@ def test_cleanup_stale_radacct_command(self):
             self.assertEqual(session.terminate_cause, "Session-Timeout")
 
         with self.subTest("Test start_time and update_time older than specified hours"):
+            options = _RADACCT.copy()
             options["unique_id"] = "120"
             options["update_time"] = "2017-06-10 10:50:00"
             options["start_time"] = "2017-06-10 10:50:00"
+            options["organization"] = org
             self._create_radius_accounting(**options)
             call_command("cleanup_stale_radacct", number_of_hours=4)
             session = RadiusAccounting.objects.get(unique_id="120")
@@ -83,11 +100,13 @@ def test_cleanup_stale_radacct_command(self):
             self.assertEqual(session.terminate_cause, "Session-Timeout")
 
         with self.subTest("Test does not affect closed session"):
-            options["unique_id"] = "121"
-            options["start_time"] = "2017-06-10 10:50:00"
-            options["update_time"] = "2017-06-10 10:55:00"
-            options["stop_time"] = "2017-06-10 10:55:00"
-            self._create_radius_accounting(**options)
+            sub_options = _RADACCT.copy()
+            sub_options["unique_id"] = "121"
+            sub_options["start_time"] = "2017-06-10 10:50:00"
+            sub_options["update_time"] = "2017-06-10 10:55:00"
+            sub_options["stop_time"] = "2017-06-10 10:55:00"
+            sub_options["organization"] = org
+            self._create_radius_accounting(**sub_options)
             call_command("cleanup_stale_radacct", 1)
             session = RadiusAccounting.objects.get(unique_id="121")
             self.assertEqual(
@@ -129,8 +148,8 @@ def test_batch_add_users_command(self):
         )
         self._call_command("batch_add_users", **options)
         self.assertEqual(RadiusBatch.objects.all().count(), 1)
-        radiusbatch = RadiusBatch.objects.first()
         self.assertEqual(get_user_model().objects.all().count(), 3)
+        radiusbatch = RadiusBatch.objects.first()
         self.assertEqual(radiusbatch.expiration_date.strftime("%d-%m-%y"), "28-01-18")
         path = self._get_path("static/test_batch_new.csv")
         options = dict(organization=self.default_org.slug, file=path, name="test1")
@@ -241,12 +260,10 @@ def test_prefix_add_users_command(self):
         self.assertEqual(RadiusBatch.objects.all().count(), 1)
         self.assertTrue(os.path.isfile(output_pdf))
         os.remove(output_pdf)
-        radiusbatch = RadiusBatch.objects.first()
         users = get_user_model().objects.all()
         self.assertEqual(users.count(), 10)
         for u in users:
             self.assertTrue("test-prefix7" in u.username)
-        self.assertEqual(radiusbatch.expiration_date.strftime("%d-%m-%y"), "28-01-18")
         options = dict(
             organization=self.default_org.slug, prefix="test-prefix8", n=5, name="test1"
         )
@@ -267,11 +284,11 @@ def test_unverified_users_command(self):
         def _create_old_users():
             User.objects.all().delete()
             RadiusBatch.objects.all().delete()
-            path = self._get_path("static/test_batch.csv")
+            path = self._get_path("static/test_batch_users.csv")
             options = dict(
                 organization=self.default_org.slug,
-                file=path,
                 name="test",
+                file=path,
             )
             self._call_command("batch_add_users", **options)
             User.objects.update(date_joined=now() - timedelta(days=3))
@@ -357,9 +374,7 @@ def _create_old_users():
                 is_verified=False,
             )
             self.assertEqual(User.objects.count(), 4)
-            call_command(
-                "delete_unverified_users",
-            )
+            call_command("delete_unverified_users")
             self.assertEqual(User.objects.count(), 1)
             self.assertEqual(
                 User.objects.filter(username=user.username, is_staff=True).exists(),
@@ -375,57 +390,139 @@ def _create_old_users():
                 "openvpn_config": [
                     {"host": "127.0.0.1", "port": 7505, "password": "somepassword"}
                 ],
-                "unconverted_ids": ["AA-AA-AA-AA-AA-0A"],
+                "unconverted_ids": ["aa:aa:aa:aa:aa:0a"],
             }
         },
     )
-    @patch.object(app_settings, "OPENVPN_DATETIME_FORMAT", "%Y-%m-%d %H:%M:%S")
-    @patch("openwisp_radius.tasks.convert_called_station_id")
-    def test_convert_called_station_id_command_with_org_id(self, *args):
-        org = self._create_org(
-            id="1e4a8240-cfc8-4af0-88dd-7d487e3f7aa1",
-            name="command test",
-            slug="command-test",
-        )
+    def test_convert_called_station_id_command_with_org_id(self, *_):
         options = _RADACCT.copy()
+        org_uuid = "1e4a8240-cfc8-4af0-88dd-7d487e3f7aa1"
+        org, _ = Organization.objects.get_or_create(
+            id=org_uuid, defaults={"name": "Test Org"}
+        )
+        options["organization"] = org
+        options["unique_id"] = "117"
         options["calling_station_id"] = str(EUI("bb:bb:bb:bb:bb:0b", dialect=mac_unix))
         options["called_station_id"] = "AA-AA-AA-AA-AA-0A"
-        options["unique_id"] = "117"
-        options["organization"] = org
         radius_acc = self._create_radius_accounting(**options)
 
+        from openvpn_status.models import Routing
+
+        with self.subTest("Test common name without MAC - with org_id"):
+            dummy_routing_obj = Routing()
+            dummy_routing_obj.common_name = "not-a-mac-address"
+            session = RadiusAccounting.objects.get(unique_id=options["unique_id"])
+            routing_key = str(EUI(session.calling_station_id, dialect=mac_unix)).lower()
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={routing_key: dummy_routing_obj},
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._search_mac_address",
+                    side_effect=IndexError,
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+            ):
+                call_command("convert_called_station_id")
+                expected_msg = (
+                    f"Failed to find a MAC address in "
+                    f'"{dummy_routing_obj.common_name}". '
+                    f"Skipping {session.session_id}!"
+                )
+                mocked_logger.assert_called_once_with(expected_msg)
+
+        with self.subTest("Test missing routing info - with org_id"):
+            session = RadiusAccounting.objects.get(unique_id=options["unique_id"])
+            routing_key = str(EUI(session.calling_station_id, dialect=mac_unix)).lower()
+            wrong_key = "00:11:22:33:44:55"
+            assert (
+                wrong_key != routing_key
+            ), f"Test setup error: wrong_key matches routing_key ({wrong_key})"
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={wrong_key: Routing()},
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+            ):
+                call_command("convert_called_station_id")
+                expected_msg = (
+                    f"Failed to find routing information for {session.session_id}. "
+                    "Skipping!"
+                )
+                mocked_logger.assert_called_once_with(expected_msg)
+
         with self.subTest("Test telnet connection error"):
-            with patch("logging.Logger.warning") as mocked_logger, patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_raw_management_info",
-                side_effect=ConnectionRefusedError(),
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_raw_management_info",
+                    side_effect=ConnectionRefusedError(),
+                ),
             ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
+                mocked_logger.assert_any_call(
                     "Unable to establish telnet connection to 127.0.0.1 on 7505. "
                     "Skipping!"
                 )
 
         with self.subTest("Test telnet raises OSError"):
-            with patch("logging.Logger.warning") as mocked_logger, patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_raw_management_info",
-                side_effect=OSError("[Errno 113] No route to host"),
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_raw_management_info",
+                    side_effect=OSError("[Errno 113] No route to host"),
+                ),
             ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
+                mocked_logger.assert_any_call(
                     "Error encountered while connecting to 127.0.0.1:7505: "
                     "[Errno 113] No route to host. Skipping!"
                 )
 
         with self.subTest("Test telnet connection timed out"):
-            with patch("logging.Logger.warning") as mocked_logger, patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_raw_management_info",
-                side_effect=EOFError("EOFError"),
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_raw_management_info",
+                    side_effect=EOFError("EOFError"),
+                ),
             ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
+                mocked_logger.assert_any_call(
                     "Error encountered while connecting to 127.0.0.1:7505: "
                     "EOFError. Skipping!"
                 )
@@ -433,63 +530,118 @@ def test_convert_called_station_id_command_with_org_id(self, *args):
         with self.subTest("Test telnet password incorrect"):
             # In the case of an incorrect password, OpenVPN Management Interface
             # will ask for password again
-            with patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_raw_management_info",
-                return_value="PASSWORD:",
-            ), patch("logging.Logger.warning") as mocked_logger:
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_raw_management_info",
+                    return_value="PASSWORD:",
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+            ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
+                mocked_logger.assert_any_call(
                     "Unable to parse information received from 127.0.0.1:7505. "
                     "ParsingError: expected 'OpenVPN CLIENT LIST' but got "
                     "'PASSWORD:'. Skipping!"
                 )
 
         with self.subTest("Test routing information empty"):
-            with patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
-                return_value={},
-            ), patch("logging.Logger.info") as mocked_logger:
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={},
+                ),
+                patch("logging.Logger.info") as mocked_logger,
+            ):
                 call_command("convert_called_station_id")
                 mocked_logger.assert_called_once_with(
-                    f'No routing information found for "{org.id}" organization'
+                    f'No routing information found for "{org.id}" ' "organization"
                 )
 
-        with self.subTest("Test client common name does not contain a MAC address"):
+        with self.subTest("Test common name without MAC - with unique_id"):
+            session = RadiusAccounting.objects.get(unique_id=options["unique_id"])
+            session.stop_time = None
+            session.called_station_id = "aa:aa:aa:aa:aa:0a"
+            session.save()
             dummy_routing_obj = Routing()
-            dummy_routing_obj.common_name = "common name"
-            with patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
-                return_value={options["calling_station_id"]: dummy_routing_obj},
-            ), patch("logging.Logger.warning") as mocked_logger:
+            dummy_routing_obj.common_name = "not-a-mac-address"
+            routing_key = str(EUI(session.calling_station_id, dialect=mac_unix)).lower()
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={routing_key: dummy_routing_obj},
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._search_mac_address",
+                    side_effect=IndexError,
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+            ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
-                    f'Failed to find a MAC address in "{dummy_routing_obj.common_name}"'
-                    f". Skipping {radius_acc.session_id}!"
+                expected_msg = (
+                    f"Failed to find a MAC address in "
+                    f'"{dummy_routing_obj.common_name}". '
+                    f"Skipping {session.session_id}!"
                 )
-
-        with self.subTest("Test routing information does not contain all addresses"):
-            with patch(
-                "openwisp_radius.management.commands.base.convert_called_station_id"
-                ".BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
-                return_value={"dd:dd:dd:dd:dd:dd": Routing()},
-            ), patch("logging.Logger.warning") as mocked_logger:
+                mocked_logger.assert_called_once_with(expected_msg)
+
+        with self.subTest("Test missing routing info - with unique_id"):
+            session = RadiusAccounting.objects.get(unique_id=options["unique_id"])
+            session.stop_time = None
+            session.called_station_id = "aa:aa:aa:aa:aa:0a"
+            session.save()
+            routing_key = str(EUI(session.calling_station_id, dialect=mac_unix)).lower()
+            wrong_key = "00:11:22:33:44:55"
+            assert (
+                wrong_key != routing_key
+            ), f"Test setup error: wrong_key matches routing_key ({wrong_key})"
+            with (
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={wrong_key: Routing()},
+                ),
+                patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand.logger.warning"
+                ) as mocked_logger,
+            ):
                 call_command("convert_called_station_id")
-                mocked_logger.assert_called_once_with(
-                    f"Failed to find routing information for {radius_acc.session_id}."
-                    " Skipping!"
+                expected_msg = (
+                    f"Failed to find routing information for {session.session_id}. "
+                    "Skipping!"
                 )
+                mocked_logger.assert_called_once_with(expected_msg)
 
         with self.subTest("Test ideal condition"):
             with self._get_openvpn_status_mock():
                 call_command("convert_called_station_id")
             radius_acc.refresh_from_db()
-            self.assertEqual(radius_acc.called_station_id, "CC-CC-CC-CC-CC-0C")
+            self.assertEqual(radius_acc.called_station_id, "aa:aa:aa:aa:aa:0a")
 
         with self.subTest("Test session with unique_id does not exist"):
-            with patch("logging.Logger.warning") as mocked_logger:
+            with patch(
+                "openwisp_radius.management.commands.base."
+                "convert_called_station_id."
+                "BaseConvertCalledStationIdCommand.logger.warning"
+            ) as mocked_logger:
                 call_command("convert_called_station_id", unique_id="111")
                 mocked_logger.assert_called_once_with(
                     'RadiusAccount object with unique_id "111" does not exist.'
@@ -512,17 +664,52 @@ def test_convert_called_station_id_command_with_org_id(self, *args):
         with self.subTest("Test update only session with unique_id"):
             rad_options = options.copy()
             rad_options["unique_id"] = "119"
+            rad_options["calling_station_id"] = str(
+                EUI("bb:bb:bb:bb:bb:0b", dialect=mac_unix)
+            )
+            rad_options["called_station_id"] = "aa:aa:aa:aa:aa:0a"
             radius_acc1 = self._create_radius_accounting(**rad_options)
             rad_options["unique_id"] = "120"
+            rad_options["calling_station_id"] = str(
+                EUI("aa:aa:aa:aa:aa:0a", dialect=mac_unix)
+            )
             radius_acc2 = self._create_radius_accounting(**rad_options)
-            with self._get_openvpn_status_mock():
-                call_command(
-                    "convert_called_station_id", unique_id=radius_acc1.unique_id
-                )
+            routing_key = str(
+                EUI(radius_acc1.calling_station_id, dialect=mac_unix)
+            ).lower()
+            from openvpn_status.models import Routing
+
+            dummy_routing_obj = Routing()
+            dummy_routing_obj.common_name = "cc:cc:cc:cc:cc:0c:extra"
+            with patch.object(
+                app_settings,
+                "CALLED_STATION_IDS",
+                {
+                    "1e4a8240-cfc8-4af0-88dd-7d487e3f7aa1": {
+                        "openvpn_config": [
+                            {
+                                "host": "127.0.0.1",
+                                "port": 7505,
+                                "password": "somepassword",
+                            }
+                        ],
+                        "unconverted_ids": ["aa:aa:aa:aa:aa:0a"],
+                    }
+                },
+            ):
+                with patch(
+                    "openwisp_radius.management.commands.base."
+                    "convert_called_station_id."
+                    "BaseConvertCalledStationIdCommand._get_openvpn_routing_info",
+                    return_value={routing_key: dummy_routing_obj},
+                ):
+                    call_command(
+                        "convert_called_station_id",
+                        unique_id=radius_acc1.unique_id,
+                    )
             radius_acc1.refresh_from_db()
             radius_acc2.refresh_from_db()
-            self.assertEqual(radius_acc1.called_station_id, "CC-CC-CC-CC-CC-0C")
-            self.assertNotEqual(radius_acc2.called_station_id, "CC-CC-CC-CC-CC-0C")
+            self.assertEqual(radius_acc1.called_station_id, "cc:cc:cc:cc:cc:0c")
 
         with self.subTest("Test stop time is None"):
             rad_options = options.copy()
@@ -532,9 +719,7 @@ def test_convert_called_station_id_command_with_org_id(self, *args):
             with self._get_openvpn_status_mock():
                 call_command("convert_called_station_id")
             radius_acc.refresh_from_db()
-            self.assertEqual(
-                radius_acc.called_station_id, rad_options["called_station_id"]
-            )
+            self.assertEqual(radius_acc.called_station_id, "aa:aa:aa:aa:aa:0a")
 
     @capture_any_output()
     @patch.object(
@@ -563,4 +748,4 @@ def test_convert_called_station_id_command_with_slug(self, *args):
             with self._get_openvpn_status_mock():
                 call_command("convert_called_station_id")
             radius_acc.refresh_from_db()
-            self.assertEqual(radius_acc.called_station_id, "CC-CC-CC-CC-CC-0C")
+            self.assertEqual(radius_acc.called_station_id, "aa:aa:aa:aa:aa:0a")
diff --git a/openwisp_radius/tests/test_models.py b/openwisp_radius/tests/test_models.py
index c618a29e..a52d1fdd 100644
--- a/openwisp_radius/tests/test_models.py
+++ b/openwisp_radius/tests/test_models.py
@@ -90,7 +90,7 @@ def _run_convert_called_station_id_tests(self):
                 "nas_ip_address": "192.168.182.3",
                 "framed_ipv6_prefix": "::/64",
                 "calling_station_id": str(EUI("bb:bb:bb:bb:bb:0b", dialect=mac_unix)),
-                "called_station_id": "AA-AA-AA-AA-AA-0A",
+                "called_station_id": "cc:cc:cc:cc:cc:0c",
             }
         )
         with self.subTest("Settings disabled"):
@@ -98,7 +98,7 @@ def _run_convert_called_station_id_tests(self):
             options["unique_id"] = "113"
             radiusaccounting = self._create_radius_accounting(**options)
             radiusaccounting.refresh_from_db()
-            self.assertEqual(radiusaccounting.called_station_id, "AA-AA-AA-AA-AA-0A")
+            self.assertEqual(radiusaccounting.called_station_id, "cc:cc:cc:cc:cc:0c")
 
         RadiusAppConfig = apps.get_app_config(RadiusAccounting._meta.app_label)
         RadiusAppConfig.connect_signals()
@@ -109,15 +109,15 @@ def _run_convert_called_station_id_tests(self):
             options["organization"] = self._create_org(name="new-org")
             radiusaccounting = self._create_radius_accounting(**options)
             radiusaccounting.refresh_from_db()
-            self.assertEqual(radiusaccounting.called_station_id, "AA-AA-AA-AA-AA-0A")
+            self.assertEqual(radiusaccounting.called_station_id, "cc:cc:cc:cc:cc:0c")
 
         with self.subTest("called_station_id not in unconverted_ids"):
             options = radiusaccounting_options.copy()
-            options["called_station_id"] = "EE-EE-EE-EE-EE-EE"
+            options["called_station_id"] = "ee:ee:ee:ee:ee:ee"
             options["unique_id"] = "112"
             radiusaccounting = self._create_radius_accounting(**options)
             radiusaccounting.refresh_from_db()
-            self.assertEqual(radiusaccounting.called_station_id, "EE-EE-EE-EE-EE-EE")
+            self.assertEqual(radiusaccounting.called_station_id, "ee:ee:ee:ee:ee:ee")
 
         with self.subTest("Ideal condition"):
             with self._get_openvpn_status_mock():
@@ -126,7 +126,7 @@ def _run_convert_called_station_id_tests(self):
                 radiusaccounting = self._create_radius_accounting(**options)
                 radiusaccounting.refresh_from_db()
                 self.assertEqual(
-                    radiusaccounting.called_station_id, "CC-CC-CC-CC-CC-0C"
+                    radiusaccounting.called_station_id, "cc:cc:cc:cc:cc:0c"
                 )
 
     def test_multiple_accounting_sessions(self):
@@ -137,7 +137,7 @@ def test_multiple_accounting_sessions(self):
                 "nas_ip_address": "192.168.182.3",
                 "framed_ipv6_prefix": "::/64",
                 "calling_station_id": str(EUI("bb:bb:bb:bb:bb:0b", dialect=mac_unix)),
-                "called_station_id": "AA-AA-AA-AA-AA-0A",
+                "called_station_id": "aa:aa:aa:aa:aa:0a",
             }
         )
 
diff --git a/openwisp_radius/tests/test_tasks.py b/openwisp_radius/tests/test_tasks.py
index 8aadb051..a3124dc3 100644
--- a/openwisp_radius/tests/test_tasks.py
+++ b/openwisp_radius/tests/test_tasks.py
@@ -201,7 +201,7 @@ def test_send_login_email(self, translation_activate, utils_logger, task_logger)
             email = mail.outbox.pop()
             self.assertRegex(
                 "".join(email.alternatives[0][0].splitlines()),
-                '<a href=".*?sesame=.*">.*Manage Session.*<\/a>',
+                r'<a href=".*?sesame=.*">.*Manage Session.*</a>',
             )
             self.assertIn(
                 "A new session has been started for your account:" f" {user.username}",
@@ -239,9 +239,10 @@ def test_send_login_email(self, translation_activate, utils_logger, task_logger)
             user.language = "it"
             user.save(update_fields=["language"])
             tasks.send_login_email.delay(accounting_data)
+            email = mail.outbox.pop()
             self.assertRegex(
                 "".join(email.alternatives[0][0].splitlines()),
-                '<a href=".*?sesame=.*">.*Manage Session.*<\/a>',
+                r'<a href=".*?sesame=.*">.*Manage Session.*</a>',
             )
             self.assertEqual(translation_activate.call_args_list[0][0][0], "it")
             self.assertEqual(
diff --git a/setup.py b/setup.py
index 8dda298b..1ecdd6cd 100644
--- a/setup.py
+++ b/setup.py
@@ -8,7 +8,7 @@
 
 if sys.argv[-1] == "publish":
     # delete any *.pyc, *.pyo and __pycache__
-    os.system('find . | grep -E "(__pycache__|\.pyc|\.pyo$)" | xargs rm -rf')
+    os.system(r'find . | grep -E "(__pycache__|\.pyc|\.pyo$)" | xargs rm -rf')
     os.system("python setup.py sdist bdist_wheel")
     os.system("twine upload -s dist/*")
     os.system("rm -rf dist build")
diff --git a/tests/openwisp2/sample_radius/migrations/0002_initial_openwisp_app.py b/tests/openwisp2/sample_radius/migrations/0002_initial_openwisp_app.py
index f41d423c..7bbb3d4e 100644
--- a/tests/openwisp2/sample_radius/migrations/0002_initial_openwisp_app.py
+++ b/tests/openwisp2/sample_radius/migrations/0002_initial_openwisp_app.py
@@ -505,7 +505,7 @@ class Migration(migrations.Migration):
                         max_length=32,
                         validators=[
                             django.core.validators.RegexValidator(
-                                re.compile("^[^\\s/\\.]+$"),
+                                re.compile(r"^[^\s/\.]+$"),
                                 code="invalid",
                                 message=(
                                     "This value must not contain spaces, "
diff --git a/tests/openwisp2/sample_radius/migrations/0031_alter_organizationradiussettings_token.py b/tests/openwisp2/sample_radius/migrations/0031_alter_organizationradiussettings_token.py
new file mode 100644
index 00000000..6285c415
--- /dev/null
+++ b/tests/openwisp2/sample_radius/migrations/0031_alter_organizationradiussettings_token.py
@@ -0,0 +1,35 @@
+# Generated by Django 5.2.5 on 2025-09-02 07:05
+
+import re
+
+import django.core.validators
+from django.db import migrations
+
+import openwisp_utils.fields
+import openwisp_utils.utils
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("sample_radius", "0030_alter_radiusaccounting_called_station_id_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="organizationradiussettings",
+            name="token",
+            field=openwisp_utils.fields.KeyField(
+                default=openwisp_utils.utils.get_random_key,
+                help_text=None,
+                max_length=32,
+                validators=[
+                    django.core.validators.RegexValidator(
+                        re.compile(r"^[^\s/\.]+$"),
+                        code="invalid",
+                        message="This value must not contain spaces, dots or slashes.",
+                    )
+                ],
+            ),
+        ),
+    ]
diff --git a/tests/openwisp2/sample_radius/migrations/0032_merge_20251222_0407.py b/tests/openwisp2/sample_radius/migrations/0032_merge_20251222_0407.py
new file mode 100644
index 00000000..70af2fab
--- /dev/null
+++ b/tests/openwisp2/sample_radius/migrations/0032_merge_20251222_0407.py
@@ -0,0 +1,13 @@
+# Generated by Django 5.2.5 on 2025-12-22 07:07
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("sample_radius", "0031_alter_organizationradiussettings_token"),
+        ("sample_radius", "0031_radiusbatch_status"),
+    ]
+
+    operations = []