RADIUS Authentication, Authorization and Accounting
Learn what RADIUS is, why it matters for network access, how the server and client talk to each other, and how accounting records help administrators track sessions.
In This Lesson
Follow a RADIUS request from the access device to the policy server and back. You will connect authentication, authorization, accounting, ports, security, and troubleshooting into one operational flow.
Quick Learning Map
Keep this three-step view in mind as you work through the detailed lesson.
Identify the roles
The user, network access server, and RADIUS server each own a different part of the exchange.
Read the exchange
Requests and responses decide access policy and record session activity.
Secure and verify
Protect shared secrets and transport, limit clients, check clocks, and inspect logs.
RADIUS Authentication, Authorization and Accounting at a Glance
Use this summary to establish the big picture before moving into the detailed explanations, commands, and checks.
Core focus
Follow a RADIUS request from the access device to the policy server and back.
Key connection
Identify the roles → Read the exchange → Secure and verify
Practical outcome
You will connect authentication, authorization, accounting, ports, security, and troubleshooting into one operational flow.
What Is RADIUS?
RADIUS stands for Remote Authentication Dial-In User Service. It is a protocol used to control who can connect to a network, what they are allowed to do after they connect, and how their session is recorded.
In simple terms, RADIUS lets network devices ask one central server, "Should this user or device be allowed in?" That is useful for Wi-Fi, VPN, firewall login, switch port authentication, remote access, and many enterprise access-control systems.
The Three Jobs of RADIUS: AAA
RADIUS is commonly described with the term AAA: authentication, authorization, and accounting. These three functions work together to control access and produce a useful record of what happened.
Confirms the identity of the user or device before network access is allowed.
Decides what access the user receives, such as VLAN, IP pool, group policy, or session limits.
Records session details such as start time, stop time, duration, bytes, packets, and assigned address.
Main RADIUS Components
A RADIUS deployment has a few key parts. The names can be confusing at first, but the roles are simple once you see the flow.
| Component | What it means | Examples |
|---|---|---|
| Supplicant | The user device or software trying to connect. | Laptop, phone, VPN client, 802.1X client. |
| RADIUS client or NAS | The network device that receives the access attempt and asks the RADIUS server what to do. | Wireless access point, switch, firewall, VPN gateway, router. |
| RADIUS server | The server that validates credentials, checks policy, and returns a decision. | NPS, FreeRADIUS, Cisco ISE, Aruba ClearPass, FortiAuthenticator. |
| Identity store | The user or device database used during authentication. | Active Directory, LDAP, certificate authority, local user database. |
What Is a RADIUS Server?
A RADIUS server is the system that receives access requests from network devices and decides whether access should be allowed. It usually runs as a background service and connects to an identity source such as Active Directory, LDAP, a certificate authority, or a local user database.
The RADIUS server does not normally sit between the user and the network traffic path. Instead, it answers access-control questions from devices that are already in the path, such as switches, VPN gateways, and wireless controllers.
How RADIUS Authentication Works
RADIUS uses a client/server model. The access device collects login or device information and sends a request to the RADIUS server. The server checks identity and policy, then sends back a decision.
A user connects to Wi-Fi, opens a VPN, plugs into a switch port, or logs in through a network device.
The network access server sends user, device, and connection details to the RADIUS server.
The RADIUS server validates credentials and compares the request against access rules.
The response is Access-Accept, Access-Reject, or Access-Challenge if more information is needed.
The device applies returned attributes such as VLAN, ACL, session timeout, IP pool, or group policy.
RADIUS Messages and Ports
| Item | Meaning | Notes |
|---|---|---|
| Access-Request | Sent by the NAS to ask whether access should be allowed. | Includes attributes such as username, NAS IP, calling station ID, and authentication method details. |
| Access-Accept | Access is allowed. | May include VLAN, ACL, IP address, session timeout, or vendor-specific attributes. |
| Access-Reject | Access is denied. | Used when credentials, policy, device status, or group membership does not match. |
| Access-Challenge | The server needs more information. | Common with multi-step authentication or challenge-response flows. |
| UDP 1812 and 1813 | Modern standard ports for authentication and accounting. | Older deployments may still use UDP 1645 and 1646. |
How RADIUS Accounting Works
RADIUS accounting records what happened during a session. It can show when a session started, when it ended, how long it lasted, how much data moved, and which address or session ID was used.
Accounting is useful for troubleshooting, compliance, usage tracking, billing, capacity planning, and incident investigation. For example, if a VPN user account is suspected of misuse, accounting logs can help show when the user connected and how much traffic moved during the session.
Sent when a session begins.
Sent during long sessions to report ongoing usage.
Sent when the session ends.
Common RADIUS Use Cases
- Enterprise Wi-Fi: authenticate users or devices with 802.1X and assign VLANs dynamically.
- VPN access: centralize remote-user authentication and apply group-based policies.
- Switch port access: allow, deny, or quarantine devices based on identity and posture.
- Firewall administrator login: validate admin access against a central identity system.
- Guest network access: issue temporary credentials and track session usage.
- ISP and service-provider access: track user sessions, assigned addresses, and resource usage.
RADIUS Security Best Practices
Classic RADIUS is widely used, but it must be deployed carefully. It uses shared secrets and protects some credential material, but it does not encrypt the full packet like a modern TLS session would.
- Use long, unique shared secrets for every RADIUS client.
- Restrict RADIUS traffic to trusted management or control-plane networks.
- Use certificate-based EAP methods for 802.1X where possible.
- Keep RADIUS servers redundant so authentication does not become a single point of failure.
- Log authentication failures and unusual access patterns to a SIEM.
- Protect RADIUS traffic with RadSec, DTLS, IPsec, or a secure tunnel where the network path is not trusted.
- Use least privilege authorization attributes, not one broad access policy for everyone.
RADIUS vs TACACS+
RADIUS and TACACS+ both support AAA, but they are commonly used for different jobs. RADIUS is popular for network access, especially Wi-Fi, VPN, and 802.1X. TACACS+ is often preferred for administrator access to routers, switches, and firewalls.
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Common use | User or device network access. | Network device administration. |
| Transport | Usually UDP. | Usually TCP. |
| AAA separation | Authentication and authorization are often combined. | Authentication, authorization, and accounting are more clearly separated. |
| Command authorization | Limited for network device commands. | Strong support for per-command authorization. |
| Typical choice | Wi-Fi, VPN, 802.1X, subscriber access. | Router, switch, firewall admin control. |
RADIUS Troubleshooting Checklist
When RADIUS login fails, the issue is usually one of five things: reachability, shared secret, identity, policy, or attributes.
- Confirm the NAS can reach the RADIUS server on UDP 1812 and 1813.
- Verify the RADIUS client IP and shared secret match on both sides.
- Check whether the user, group, certificate, or device identity is valid.
- Review policy order because the first matching rule may not be the intended rule.
- Inspect returned attributes such as VLAN ID, ACL name, IP pool, and session timeout.
- Check server logs for Access-Reject reasons and NAS logs for timeout or malformed response errors.
Trending RADIUS FAQs
What is RADIUS in simple words?
RADIUS is a central login and access-control system for networks. Devices like VPN gateways, switches, and access points ask the RADIUS server whether a user or device should be allowed in.
What ports does RADIUS use?
Modern RADIUS usually uses UDP 1812 for authentication and authorization and UDP 1813 for accounting. Older systems may use UDP 1645 and 1646.
What is a RADIUS client?
A RADIUS client is the network device that sends requests to the RADIUS server. Examples include wireless access points, switches, firewalls, routers, and VPN gateways.
What is RADIUS accounting?
RADIUS accounting records session details such as start time, stop time, session duration, assigned IP address, bytes, packets, and sometimes termination reason.
Is RADIUS the same as LDAP?
No. LDAP is commonly used to query directory information. RADIUS is an access-control protocol. A RADIUS server may use LDAP or Active Directory as its identity source.
Should I use RADIUS or TACACS+?
Use RADIUS for user network access such as Wi-Fi, VPN, and 802.1X. Use TACACS+ when you need stronger command-level control for administrators logging in to routers, switches, and firewalls.
RADIUS Authentication, Authorization and Accounting: Tags and Keywords
RADIUS, Remote Authentication Dial-In User Service, RADIUS protocol, RADIUS server, RADIUS client, network access server, NAS, AAA, authentication, authorization, accounting, RADIUS accounting, Access-Request, Access-Accept, Access-Reject, Access-Challenge, UDP 1812, UDP 1813, 802.1X, EAP, LDAP, Active Directory, VPN authentication, Wi-Fi authentication, TACACS+.