How Does RADIUS Work?

RADIUS (Remote Authentication Dial-In User Service) works as a client-server protocol for network access control. When a user attempts to access a network service (e.g., Wi-Fi, VPN), the client device (RADIUS client) sends an authentication request to the RADIUS server. The RADIUS server validates the user’s credentials, such as username and password, against its user database or an external authentication source. If the credentials are valid, the RADIUS server sends an authentication success response back to the client, granting access to the requested network service.

Additionally, RADIUS can enforce access policies based on user attributes and accounting capabilities to track user activities for auditing and billing purposes.

Here’s how RADIUS works and why it is important for network security:

Authentication: When a user tries to access a network service, such as connecting to a Wi-Fi network or logging into a remote server, their device (like a laptop or smartphone) sends their credentials (username and password) to a RADIUS server.

Authorization: The RADIUS server checks the submitted credentials against its database, which could be local or linked to an external directory service like LDAP (Lightweight Directory Access Protocol). If the credentials are valid, the RADIUS server sends an “Access-Accept” message back to the network device, allowing access to the requested service. Otherwise, an “Access-Reject” message is sent, denying access.

Accounting: RADIUS also provides accounting functionality, where it can track user activity and session details, such as the duration of the connection, data transferred, and other relevant information. This data is useful for billing purposes, monitoring network usage, and analyzing potential security incidents.

Why is RADIUS important for network security?

Centralized Authentication: RADIUS offers a centralized authentication mechanism, which means that user credentials are stored in a single secure location. This reduces the risk of unauthorized access and simplifies the management of user accounts.

Stronger Security: With RADIUS, passwords and sensitive information are not transmitted directly across the network. Instead, the authentication process involves secure protocols, making it harder for attackers to intercept or steal credentials during transmission.

Enhanced Access Control: RADIUS enables administrators to define access policies and control who can access specific network resources. This helps prevent unauthorized users from gaining access to sensitive data or critical systems.

Accountability and Auditing: The accounting feature of RADIUS allows organizations to keep track of user activity, providing valuable audit logs for investigating security incidents and identifying potential threats or anomalies.

Integration with Other Systems: RADIUS can integrate with various other security systems, such as VPNs (Virtual Private Networks), firewalls, and wireless access points, to enforce consistent security policies across the network.

Scalability: RADIUS is designed to handle a large number of users and devices, making it suitable for enterprise-level networks and service providers.

RADIUS plays a crucial role in enhancing network security by providing centralized authentication, authorization, and accounting, reducing the risk of unauthorized access and enabling better control and monitoring of network resources.

The Components of RADIUS

RADIUS Server

The RADIUS server is the core component of the RADIUS system. It is a centralized authentication, authorization, and accounting (AAA) server responsible for processing authentication requests from network clients (RADIUS clients) and making decisions based on the information stored in its user database. When a user attempts to access a network service, the RADIUS server receives the authentication request from the RADIUS client and validates the user’s credentials against the user database.

What is Remote Code Execution (RCE)?

If the credentials are valid, the server sends an “Access-Accept” message to the client, granting access to the requested service. If the credentials are invalid or the user is not authorized to access the service, the server sends an “Access-Reject” message, denying access.

RADIUS Client

The RADIUS client, also known as a Network Access Server (NAS), acts as an intermediary between the user device and the RADIUS server. It is the device or gateway that controls the user’s access to network resources. When a user attempts to access a network service, the RADIUS client forwards the user’s authentication request to the RADIUS server for validation.

RADIUS clients are typically networking devices such as routers, switches, wireless access points, VPN gateways, or other devices that provide network access. These devices are configured to communicate with the RADIUS server and direct authentication requests to it.

User Database

The user database contains the credentials and user information needed for the RADIUS server to perform authentication and authorization. This database is stored on the RADIUS server and can be local to the server or linked to an external directory service, such as LDAP (Lightweight Directory Access Protocol) or Active Directory.

The user database stores user account information, including usernames, passwords (or password hashes), and any additional attributes that define the user’s access privileges, such as group memberships or role assignments. During the authentication process, the RADIUS server uses this user information to verify the user’s identity and determine what network resources the user is allowed to access.

Together, these components work in concert to provide a secure and efficient authentication and access control mechanism for users attempting to access network services. RADIUS is widely used in various networking scenarios, such as Wi-Fi authentication, VPN access, and dial-up connections, to ensure secure user access and network resource management.

The Authentication Process

The authentication process in RADIUS (Remote Authentication Dial-In User Service) involves two main steps: the user authentication request and the RADIUS server response. Let’s break down each step:

User Authentication Request

Step 1: A user (such as an individual with a laptop or smartphone) attempts to access a network service, such as connecting to a Wi-Fi network, logging into a remote server, or establishing a VPN connection.

Step 2: The network device or gateway that the user is trying to access, known as the RADIUS client or Network Access Server (NAS), receives the authentication request from the user’s device.

Step 3: The RADIUS client encapsulates the user’s credentials (usually a username and password) and other relevant information, such as the network service being requested, into a RADIUS authentication request packet.

Step 4: The RADIUS client sends the authentication request packet to the RADIUS server for validation. This communication typically occurs over a secure transport layer, such as RADIUS over Transport Layer Security (RADIUS/TLS) or RADIUS over Datagram Transport Layer Security (RADIUS/DTLS), to protect the user’s credentials during transmission.

RADIUS Server Response

Step 5: The RADIUS server receives the authentication request packet from the RADIUS client.

Step 6: The RADIUS server processes the incoming request and checks the user’s credentials against its user database, which contains the stored user information, including usernames and corresponding passwords (or password hashes).

Step 7: If the user’s credentials are valid, the RADIUS server generates an “Access-Accept” message and sends it back to the RADIUS client.

Step 8: Upon receiving the “Access-Accept” message, the RADIUS client grants the user access to the requested network service. The user can now proceed to use the network resources they are authorized to access.

Step 9: If the user’s credentials are invalid, or if the user is not authorized to access the requested service, the RADIUS server generates an “Access-Reject” message and sends it back to the RADIUS client.

Step 10: Upon receiving the “Access-Reject” message, the RADIUS client denies the user access to the network service, and the user’s authentication attempt fails.

The RADIUS server response also includes other attributes that define the user’s access privileges, such as the user’s assigned IP address, session duration limits, or permitted network services. These attributes are sent to the RADIUS client as part of the response, and the client uses this information to enforce the appropriate access control policies for the user.

The authentication process in RADIUS involves the user’s device sending an authentication request to the RADIUS server, which validates the user’s credentials and responds with an “Access-Accept” message for successful authentication or an “Access-Reject” message for authentication failure. This process helps ensure secure and controlled access to network resources.

RADIUS Authentication Methods

PAP (Password Authentication Protocol)

PAP is one of the simplest authentication methods supported by RADIUS. In PAP, the user’s credentials, including the username and password, are transmitted in plain text format from the client (user device) to the RADIUS server. Because of this, PAP is considered a weak authentication method and is susceptible to eavesdropping attacks. As the credentials are transmitted in clear text, there is no encryption to protect them during transmission.

Despite its security limitations, PAP is still used in some scenarios where stronger authentication methods are not feasible or necessary, such as legacy systems or environments with limited security requirements.

CHAP (Challenge Handshake Authentication Protocol)

CHAP is a more secure authentication method than PAP and provides protection against eavesdropping attacks. Instead of transmitting the actual password, CHAP uses a one-way hash function to generate a “challenge-response” mechanism.

During the initial authentication, the RADIUS server sends a random challenge to the client (user device).
The client uses its password along with the challenge to generate a hash value, which is sent back to the RADIUS server as the response.
The RADIUS server performs the same hash calculation using the stored password and compares the result with the received response. If they match, the user is authenticated.

CHAP is more secure than PAP because the actual password is never transmitted over the network. However, it still has some limitations, such as the lack of mutual authentication (the server doesn’t verify the client’s identity), making it susceptible to certain attacks.

EAP (Extensible Authentication Protocol)

EAP is a framework that supports various authentication methods and is widely used with RADIUS for more robust and secure authentication. Unlike PAP and CHAP, EAP does not specify a single authentication protocol. Instead, it defines a framework that allows for the integration of various authentication methods, such as EAP-TLS (Transport Layer Security), EAP-PEAP (Protected Extensible Authentication Protocol), EAP-TTLS (Tunneled Transport Layer Security), and more.

What is an Intrusion Prevention System (IPS)?

EAP allows for mutual authentication, where both the client and the server validate each other’s identity during the authentication process. This mutual authentication capability significantly enhances security.

The choice of the specific EAP method used in RADIUS authentication depends on the security requirements and the supported capabilities of the client devices and RADIUS server.

Authorization and Accounting

In the context of RADIUS (Remote Authentication Dial-In User Service), both authorization and accounting are important aspects of the overall AAA (Authentication, Authorization, and Accounting) framework. They play a crucial role in controlling user access to network resources and tracking user activity for auditing and billing purposes.

Authorization

Authorization is the process of determining what actions or network resources a user is allowed to access after they have been successfully authenticated. Once the RADIUS server has verified a user’s credentials, the server uses the information from its user database to determine the user’s access privileges and permissions. These access privileges are conveyed to the RADIUS client (Network Access Server) through the RADIUS response.

The RADIUS server sends an “Access-Accept” message to the RADIUS client, along with various attributes that define the user’s access rights. These attributes can include:

Assigned IP address: The IP address that the user is assigned for the current session.
Session duration limits: The maximum allowed time for the user’s session.
Filter-ID refers to a network filter that specifies which network resources the user can access.
Tunnel attributes: Information used for establishing secure tunnels, such as VPN connections.

Accounting

Accounting is the process of tracking and recording user activities and resource usage during a network session. The RADIUS accounting feature allows network administrators to collect valuable data about user behavior, session duration, data transferred, and more. This information is typically used for billing, auditing, and monitoring network usage.

During the accounting process, the RADIUS server generates accounting records (sometimes called accounting packets) that contain information about the user’s session. These records include:

Start records: Generated when a user session begins, providing details like the start time, user identity, and session identifier.
Stop records: Generated when a user session ends, containing information about the session’s duration and any additional usage statistics.
Interim records: Generated periodically during an ongoing session, providing updates on resource usage.

The accounting records can be sent to a central accounting server for storage and analysis. This allows network administrators to keep track of user activity, detect unusual behavior, identify potential security threats, and allocate network resources efficiently.

While authentication establishes a user’s identity, RADIUS authorization ensures that the user is granted appropriate access to network resources based on their credentials and attributes. RADIUS accounting records user activity and resource usage, aiding in auditing and billing while also enhancing network security and resource management.

RADIUS vs. TACACS+

Criteria	RADIUS	TACACS+
Authentication	Supports PAP, CHAP, EAP, and more	Supports its own proprietary method, which can include stronger encryption and mutual authentication
Authorization	Supports limited authorization attributes	Supports fine-grained authorization with extensive control over command-level access and privileges
Accounting	Basic accounting (start, stop, interim records)	Comprehensive accounting with detailed logging of user commands and actions
Security	Less secure due to the use of PAP and CHAP (weak authentication methods)	More secure due to the use of its own strong encryption and built-in mutual authentication
Use Cases	Commonly used in Wi-Fi and dial-up access scenarios	Commonly used in network device management (routers, switches) and for administrative access control
Port Support	Uses UDP ports (1812 for authentication, 1813 for accounting)	Uses TCP port (49) for communication, providing reliability
Packet Structure	Uses UDP datagrams with authentication request/response	Uses TCP packets with separate authentication, authorization, and accounting (AAA) packets
Connection Management	Connectionless protocol (UDP)	Connection-oriented protocol (TCP)
Device Compatibility	Widely supported by various networking devices and services	Mostly used for network device management and may require specific device support for TACACS+ implementation

Authentication

RADIUS: Supports various authentication methods, including PAP, CHAP, and the extensible EAP framework. However, some of these methods, such as PAP and CHAP, are considered less secure due to the transmission of credentials in clear text or using a one-way hash.
TACACS+: Utilizes its own proprietary authentication method, which can include stronger encryption and mutual authentication, making it more secure than some RADIUS authentication methods.

Authorization

RADIUS: Supports limited authorization attributes, typically controlling user access at the network service level.
TACACS+: Provides fine-grained authorization with extensive control over command-level access and privileges. This granularity allows administrators to define precise access control policies based on specific commands or actions.

Accounting

RADIUS: Offers basic accounting with start, stop, and interim records that track session details and data usage.
TACACS+: Provides comprehensive accounting with detailed logging of user commands and actions, facilitating auditing and monitoring of user activities.

Security

RADIUS: May be less secure due to the use of weak authentication methods like PAP and CHAP.
TACACS+: Offers higher security through its own robust encryption and built-in mutual authentication, making it more resistant to attacks.

Use Cases

RADIUS: Commonly used in scenarios like Wi-Fi authentication and dial-up access where simple authentication and authorization are sufficient.
TACACS+: Primarily used for network device management, especially in environments where fine-grained control over administrative access is critical.

Port Support

RADIUS: Uses UDP ports 1812 for authentication and 1813 for accounting, making it a connectionless protocol.
TACACS+: Uses TCP port 49 for communication, providing reliability through a connection-oriented protocol.

Packet Structure

RADIUS: Uses UDP datagrams for transmitting authentication requests and responses.
TACACS+: Utilizes TCP packets and separates authentication, authorization, and accounting (AAA) functions into distinct packets.

Connection Management

RADIUS: Connectionless protocol, suitable for authentication and accounting over UDP.
TACACS+: Connection-oriented protocol over TCP, ensuring reliable data transmission.

What is Air Gap?

Device Compatibility

RADIUS: Supported by a wide range of networking devices and services, making it a more versatile solution.
TACACS+: Primarily used for network device management and may require specific device support for TACACS+ implementation.

RADIUS and TACACS+ serve different purposes and are tailored to different use cases. RADIUS is commonly used for user authentication and basic authorization, while TACACS+ excels in providing fine-grained authorization and detailed accounting for network device management.

Organizations often choose between RADIUS and TACACS+ based on their specific security and access control requirements.

Advantages of RADIUS

Centralized Authentication

RADIUS provides centralized authentication, meaning that user credentials and authentication policies are stored on a single, dedicated RADIUS server.

Simplified Management: Having user credentials stored in one place streamlines user account management, reducing administrative overhead. Changes to user accounts and access policies can be made at the central RADIUS server and propagate across the network.
Consistent User Experience: Regardless of where users attempt to access network services, they can log in using the same credentials. This uniformity simplifies the user experience and reduces confusion.
Single Sign-On (SSO) Capabilities: By integrating RADIUS with other services like LDAP or Active Directory, organizations can achieve Single Sign-On, allowing users to access multiple services with a single set of credentials.

Enhanced Security

Encrypted Transmission: RADIUS supports the use of secure protocols like RADIUS/TLS and RADIUS/DTLS, which encrypt the authentication data during transmission. This prevents unauthorized parties from intercepting and deciphering sensitive user credentials.
Mutual Authentication: In some RADIUS implementations, mutual authentication can be configured, ensuring that both the client (user device) and the server authenticate each other before proceeding with the authentication process. This feature adds an extra layer of security to prevent man-in-the-middle attacks.
Stronger Authentication Methods: RADIUS supports multiple authentication methods, including the more secure Extensible Authentication Protocol (EAP) variants, allowing organizations to choose stronger authentication mechanisms based on their security requirements.

Flexible Authentication Methods

PAP, CHAP, and EAP: RADIUS can handle traditional authentication methods like Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP), as well as more advanced and secure methods through Extensible Authentication Protocol (EAP) variants like EAP-TLS, EAP-PEAP, and EAP-TTLS.
Wired and Wireless Networks: RADIUS is used in both wired and wireless network environments, making it suitable for diverse deployment scenarios, such as Wi-Fi networks and Virtual Private Networks (VPNs).
Multi-factor Authentication (MFA): With the support of EAP, RADIUS enables organizations to implement multi-factor authentication, requiring users to provide multiple forms of identification (e.g., something they know, something they have, something they are) to access the network.

RADIUS offers centralized authentication, enhanced security features, and support for flexible authentication methods. These advantages make it a reliable and versatile protocol for network access control, user management, and security enforcement in a variety of networking environments.

Implementing RADIUS in Wi-Fi Networks

Implementing RADIUS (Remote Authentication Dial-In User Service) in Wi-Fi networks can significantly enhance network security and provide centralized user authentication and authorization.

Setting Up RADIUS Server

Choose a RADIUS server: Select a RADIUS server software or appliance that fits your organization’s needs. Popular options include FreeRADIUS, Microsoft NPS (Network Policy Server), and Cisco ISE (Identity Services Engine).
Install and configure the RADIUS server: Follow the installation instructions provided by the RADIUS server vendor. Configure the basic settings, such as server IP address, ports, and authentication methods (e.g., PAP, CHAP, EAP).
Set up the user database: Create user accounts and corresponding passwords on the RADIUS server or link it to an external user directory, such as LDAP or Active Directory, for centralized user management.

Configuring Wi-Fi Access Points

Access Point (AP) configuration: Access the configuration interface of each Wi-Fi access point and enable WPA2-Enterprise (or WPA3-Enterprise) security mode. This will allow the access points to communicate with the RADIUS server for user authentication.
RADIUS server settings on access points: Configure the RADIUS server IP address and shared secret on each access point. The shared secret acts as a secure passphrase that is shared between the RADIUS server and the access points to establish trust.

Configuring RADIUS Clients (Wi-Fi devices)

Register access points as RADIUS clients: In the RADIUS server configuration, add each Wi-Fi access point as a trusted RADIUS client by providing the access point’s IP address and the shared secret used during AP configuration.

Defining Network Policies on the RADIUS Server

Create network policies: Define network access policies on the RADIUS server that specify which users and user groups are allowed access to the Wi-Fi network and what level of access they have (e.g., VLAN assignment, bandwidth limits).
Use RADIUS attributes: Utilize RADIUS attributes to control access and apply specific settings to authenticated users. For example, use VLAN assignment attributes to place users in designated network segments.

Securing Wireless Networks with RADIUS

Strong Authentication: Use EAP-based authentication methods (e.g., EAP-TLS, EAP-PEAP, EAP-TTLS) for stronger security, especially if you require user certificate-based authentication.
Certificate Management: If implementing EAP-TLS, ensure proper certificate management for both the RADIUS server and Wi-Fi clients. This involves issuing and renewing certificates to authenticate devices and users.
Mutual Authentication: Enable mutual authentication between the RADIUS server and Wi-Fi clients to prevent man-in-the-middle attacks.
Logging and Auditing: Enable accounting on the RADIUS server to log user activity and access events for auditing and security analysis.
Regular Updates: Keep the RADIUS server software and Wi-Fi access point firmware up to date to patch any security vulnerabilities.

Troubleshooting RADIUS Authentication Issues

Troubleshooting RADIUS authentication issues can be challenging, but ensuring the smooth functioning of your network access control is essential.

Common Authentication Problems

Incorrect Credentials: One of the most common issues is incorrect user credentials. Verify that the user is entering the correct username and password.
Connectivity Issues: Check for network connectivity problems between the RADIUS client (Wi-Fi access point) and the RADIUS server. Ensure that they can reach each other over the network.
RADIUS Server Status: Check if the RADIUS server is running and reachable. Restart the RADIUS server if necessary.
Shared Secret Mismatch: Make sure the shared secret configured on the RADIUS server matches the one set on the RADIUS client (Wi-Fi access point).
Firewall and Port Issues: Ensure that the required RADIUS ports (1812 for authentication, 1813 for accounting) are open on both the RADIUS server and the RADIUS client (Wi-Fi access point).
Certificate Issues: If using EAP-TLS for authentication, verify that the client’s certificate is valid and not expired. Ensure the RADIUS server’s certificate is also valid and trusted.
Directory Integration: If using an external directory service like LDAP or Active Directory, check the integration settings and verify that the RADIUS server can communicate with the directory server.
Network Time: Ensure that the clocks on the RADIUS server, RADIUS client, and user devices are synchronized. Time discrepancies can lead to authentication failures, especially when using time-based tokens for EAP authentication.
User Attributes: If using RADIUS attributes for authorization, check that the attributes are configured correctly and assigned to the appropriate user accounts.

What is LLDP (Link Layer Discovery Protocol)?

Debugging RADIUS

Enable RADIUS Debugging: Most RADIUS servers allow you to enable debugging or logging features. Enable debugging to capture detailed information about authentication attempts and RADIUS communication.
Review RADIUS Logs: Check the RADIUS server logs for any error messages, warnings, or other relevant information that can help pinpoint the cause of authentication issues.
Packet Capture: Use packet capturing tools (e.g., Wireshark) to capture and analyze RADIUS packets exchanged between the RADIUS client and the RADIUS server. This can provide insights into the authentication process and help identify any anomalies.
Test User Accounts: Create a test user account and attempt to authenticate with it. This can help isolate whether the issue is specific to certain user accounts or a broader problem.
Reach out to Vendor Support: If troubleshooting becomes complex and the issue persists, consider reaching out to the vendor’s support team for assistance.
Consider RADIUS Alternatives: If the RADIUS implementation continues to cause issues, evaluate other AAA protocols like TACACS+ or explore the possibility of using cloud-based authentication services.

Future of RADIUS

The future of RADIUS (Remote Authentication Dial-In User Service) has been influenced by several factors, including the evolving networking landscape, security requirements, and advancements in authentication technologies.

While RADIUS remains widely used, there are also alternative AAA protocols that offer certain advantages in specific scenarios. Let’s discuss the potential improvements and developments for RADIUS as well as some alternatives to consider:

Improvements and Developments for RADIUS

Enhanced Security: RADIUS has been historically associated with weaker authentication methods like PAP and CHAP. Future developments may focus on promoting the use of stronger authentication methods, such as EAP-TLS or EAP-PEAP, to bolster security.
Integration with Modern Authentication Mechanisms: As organizations adopt more modern authentication mechanisms like multi-factor authentication (MFA) and biometrics, RADIUS may need to evolve to better integrate and support these methods.
Scalability and Performance: To meet the demands of large-scale networks and high traffic volumes, RADIUS implementations may need further improvements in scalability and performance.
Interoperability: Efforts might be made to enhance RADIUS interoperability between different vendors’ equipment and implementations.
Continued Maintenance and Support: Despite the emergence of alternative protocols, RADIUS will likely continue to receive maintenance and support for legacy systems and use cases where its simplicity and broad support are still relevant.

Alternatives to RADIUS

TACACS+ (Terminal Access Controller Access-Control System Plus): TACACS+ is an alternative AAA protocol that offers finer-grained control over administrative access and extensive accounting capabilities. It is commonly used for network device management, especially in Cisco environments.
Diameter: Diameter is a AAA protocol that shares similarities with RADIUS but is designed for IP-based networks and provides improved security, scalability, and extensibility. It is used in 3G/4G/5G networks and other IP-centric environments.
OAuth: OAuth is an authorization framework used primarily for granting access to resources on web platforms and APIs. It is commonly used in the context of single sign-on (SSO) and access delegation scenarios.
SAML (Security Assertion Markup Language): SAML is an XML-based authentication and authorization protocol used for exchanging authentication and authorization data between different parties. It is widely used for web-based SSO in federated identity scenarios.
WebAuthn (Web Authentication): WebAuthn is a W3C standard for web-based authentication, providing strong user authentication using public key cryptography. It enables passwordless and multi-factor authentication on the web.
FIDO2 (Fast Identity Online 2): FIDO2 is a set of specifications developed by the FIDO Alliance for passwordless authentication. It uses public key cryptography and can be used in combination with WebAuthn for strong, user-friendly authentication.

Radius Server Windows

For Windows environments, Microsoft provides a built-in RADIUS server feature called Network Policy Server (NPS). Network Policy Server is a role service in Windows Server operating systems that allows you to configure and manage RADIUS-based network policies for authentication, authorization, and accounting.

Here’s how you can set up a RADIUS server using Network Policy Server on Windows Server:

Install Network Policy Server (NPS)

On a Windows Server machine, open the “Server Manager” and navigate to “Add Roles and Features.”
In the “Add Roles and Features Wizard,” select the “Network Policy and Access Services” role.
Within the role, select the “Network Policy Server” role service to install.

Configure Network Policy Server

After installing NPS, open “Network Policy Server” from the Administrative Tools or the Start menu.
In the NPS console, right-click on “RADIUS Clients” and choose “New RADIUS Client.”
Provide the necessary information, such as the Friendly Name, IP address or hostname of the Wi-Fi access point (RADIUS client), and a shared secret that will be used for communication between the RADIUS client and the NPS server.

Create Network Policies

Network policies define the conditions under which authentication and authorization take place. Right-click on “Policies” and choose “New Policy.”
Follow the wizard to create a new network policy, specifying conditions like authentication methods (EAP, PAP, CHAP), group memberships, or NAS (RADIUS client) IP addresses.
In the policy, you can define the access permissions and other attributes to be sent back to the RADIUS client.

Configure Wi-Fi Access Points (RADIUS Clients)

On your Wi-Fi access points or other network devices that support RADIUS authentication, configure them to use the IP address of the NPS server and the shared secret you set up in the RADIUS client configuration.

What is SAE (Simultaneous Authentication of Equals)?

Test the Configuration

Verify that the NPS server is running and reachable.
Attempt to connect a Wi-Fi client to the network, and ensure that it sends authentication requests to the NPS server.
Check the NPS logs to see if authentication attempts are successful and authorized based on the defined network policies.

Radius Server vs Active Directory

Criteria	RADIUS Server	Active Directory
Function	Authentication, Authorization, and Accounting (AAA) for network access control	Directory services and user management for Windows-based networks
Use Case	Used for network access control in diverse networking environments, including Wi-Fi, VPN, and dial-up	Primarily used as a user and resource directory for Windows domain-based networks
Authentication	Handles user authentication, supporting various methods like PAP, CHAP, and EAP	Supports authentication using NTLM, Kerberos, and LDAP-based authentication
Authorization	Enforces access control policies based on user attributes and policies	Allows assigning permissions, group memberships, and access to resources based on user/group settings
Accounting	Records user activity and usage statistics for auditing and billing purposes	Does not offer built-in accounting capabilities for tracking user activity
Protocol	Uses the RADIUS protocol for communication with network devices	Uses various protocols, including LDAP, Kerberos, and DNS for communication
Security	Supports secure communication through protocols like RADIUS/TLS and RADIUS/DTLS	Employs secure communication using encryption for LDAP (LDAPS) and Kerberos
Cross-Platform	Compatible with a wide range of networking devices and services	Specifically designed for Windows-based environments, limited cross-platform support
Scalability	Scalable and suitable for large-scale deployments	Scales well within Windows domain environments, may require additional considerations for very large deployments
User Management	Limited user management capabilities, primarily focused on authentication	Comprehensive user management with the ability to create, modify, and organize user accounts
Group Policies	Limited or no support for Group Policies	Supports Group Policies, allowing centralized configuration of user and computer settings
Integration	Can be integrated with external user databases, such as LDAP or Active Directory	Integrates seamlessly with Windows operating systems and Windows-based services
Multi-Protocol Support	Supports various authentication protocols like EAP, PAP, and CHAP	Supports multiple authentication and authorization protocols, including NTLM, Kerberos, and LDAP

Function

RADIUS Server: A RADIUS server is responsible for authentication, authorization, and accounting (AAA) in network access control scenarios. It handles user authentication and grants access to network services based on user credentials and predefined policies. RADIUS is widely used for Wi-Fi, VPN, and dial-up access control.
Active Directory: Active Directory is a directory service provided by Microsoft for Windows-based networks. It serves as a central repository for user accounts, groups, and resources in a Windows domain environment. Active Directory primarily focuses on user management and facilitates single sign-on (SSO) across Windows-based systems.

Use Case

RADIUS Server: The RADIUS server is commonly used in a variety of networking environments where centralized authentication and access control are required, such as in enterprise networks, public Wi-Fi hotspots, and remote access VPNs.
Active Directory: Active Directory is used in Windows domain-based networks and is the core service for user management, group policy management, and resource access control within the Windows ecosystem.

Authentication

RADIUS Server: RADIUS supports various authentication methods, including PAP, CHAP, and the extensible EAP framework. It is commonly used to authenticate users for network access.
Active Directory: Active Directory supports authentication through protocols like NTLM (NT LAN Manager) and Kerberos, providing secure authentication for Windows-based systems.

Authorization

RADIUS Server: RADIUS enforces access control policies based on user attributes received during authentication, allowing network administrators to control user access to specific resources and services.
Active Directory: Active Directory allows administrators to assign permissions, group memberships, and access rights to users and groups. Group Policies are a key feature of Active Directory, enabling centralized configuration management for users and computers.

Accounting

RADIUS Server: RADIUS provides accounting capabilities to track user activity, session durations, and data usage for auditing and billing purposes.
Active Directory: Active Directory does not have built-in accounting capabilities like RADIUS. It focuses on user management and resource access control.

Protocol

RADIUS Server: RADIUS uses the RADIUS protocol (RFC 2865 and RFC 2866) to communicate with network devices, such as Wi-Fi access points and VPN servers.
Active Directory: Active Directory uses various protocols, including LDAP (Lightweight Directory Access Protocol) for querying and modifying directory data, Kerberos for secure authentication, and DNS (Domain Name System) for name resolution.

Security

RADIUS Server: RADIUS offers secure communication options through protocols like RADIUS/TLS and RADIUS/DTLS, providing encryption and data integrity.
Active Directory: Active Directory employs secure communication using encryption for LDAP (LDAPS) and mutual authentication through Kerberos.

Cross-Platform

RADIUS Server: RADIUS is compatible with a wide range of networking devices and services, making it a more versatile solution across different platforms.
Active Directory: Active Directory is designed for Windows-based environments and is more tightly integrated with Windows operating systems and services.

Scalability

RADIUS Server: RADIUS is scalable and well-suited for large-scale deployments, making it a popular choice for enterprise networks and service providers.
Active Directory: Active Directory scales well within Windows domain environments. For very large deployments, additional considerations and planning may be required.

User Management

RADIUS Server: RADIUS has limited user management capabilities, primarily focusing on user authentication rather than user account creation and management.
Active Directory: Active Directory provides comprehensive user management functionalities, allowing administrators to create, modify, and organize user accounts and associated attributes.

Group Policies

RADIUS Server: RADIUS does not inherently support Group Policies, as it is primarily focused on authentication and authorization for network access.
Active Directory: Active Directory fully supports Group Policies, enabling centralized configuration management of user and computer settings across the Windows domain.

Integration

RADIUS Server: RADIUS can be integrated with external user databases, such as LDAP or Active Directory, to leverage existing user information for authentication.
Active Directory: Active Directory integrates seamlessly with Windows operating systems and Windows-based services, providing a single source of truth for user accounts and security settings.

What Is EDR? Understanding Endpoint Detection and Response !

Multi-Protocol Support

RADIUS Server: RADIUS supports various authentication protocols like EAP, PAP, and CHAP, providing flexibility for different authentication methods.
Active Directory: Active Directory supports multiple authentication and authorization protocols, including NTLM, Kerberos, and LDAP, ensuring compatibility with various Windows-based systems and services.

RADIUS Server and Active Directory serve different purposes within networking environments. RADIUS focuses on network access control through AAA services, while Active Directory is a comprehensive directory service for user and resource management in Windows domains.

Frequently Asked Questions

What does RADIUS stand for?

RADIUS stands for “Remote Authentication Dial-In User Service.” It is a networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users attempting to access network services, such as Wi-Fi networks, VPNs, and dial-up connections.

Can RADIUS be used for wired networks only?

No, RADIUS is not limited to wired networks. While RADIUS was originally designed for dial-up connections, it is widely used for both wired and wireless network access scenarios. RADIUS can be employed for various networking technologies, including Wi-Fi, Ethernet, VPNs, and more.

Is RADIUS more secure than TACACS+?

The security of RADIUS versus TACACS+ depends on the authentication methods and encryption mechanisms implemented by each protocol. TACACS+ is considered more secure than some RADIUS authentication methods (like PAP and CHAP) because it offers its own proprietary authentication method with stronger encryption and mutual authentication. However, RADIUS can also utilize more secure authentication methods like EAP-TLS and EAP-PEAP, making the security comparison dependent on the specific configuration and authentication methods employed.

How does RADIUS prevent unauthorized access?

RADIUS prevents unauthorized access by authenticating users based on their provided credentials (such as username and password) and validating those credentials against a central user database. The RADIUS server grants access only to users with valid credentials and authorized privileges. For any unauthorized access attempts, the RADIUS server will reject the authentication request with an “Access-Reject” message, denying access to the requested network service.

Can RADIUS use encryption for authentication?

Yes, RADIUS can use encryption for authentication. RADIUS/TLS (Transport Layer Security) and RADIUS/DTLS (Datagram Transport Layer Security) are secure protocols that provide encryption and data integrity for RADIUS communication.

These protocols ensure that user credentials and sensitive information are transmitted securely between the RADIUS client and the RADIUS server, protecting them from eavesdropping and unauthorized interception during the authentication process. By using RADIUS/TLS or RADIUS/DTLS, organizations can enhance the security of RADIUS-based authentication.

What happens if the RADIUS server goes down?

If the RADIUS server goes down, the Wi-Fi access points or other network devices relying on RADIUS for authentication and authorization will no longer be able to communicate with the RADIUS server. As a result, users trying to access the network services may experience authentication failures, and they will not be able to connect to the Wi-Fi network or other resources that require RADIUS-based authentication.

During a RADIUS server outage, the Wi-Fi access points typically resort to a backup authentication method (if configured), such as local user accounts or a pre-shared key, to allow some level of access until the RADIUS server is back online.

Is RADIUS compatible with all Wi-Fi access points?

RADIUS is a widely used and standardized protocol, so most modern Wi-Fi access points and networking equipment support RADIUS for authentication and authorization. This compatibility ensures that RADIUS can be used with a wide range of Wi-Fi access points from different vendors. However, it is essential to verify the specific model and firmware of the access points to confirm their support for RADIUS authentication.

Can RADIUS be used for VPN authentication?

Yes, RADIUS can be used for VPN authentication. Many VPN solutions support RADIUS as an authentication method. When users attempt to connect to the VPN server, the VPN client communicates with the RADIUS server to validate their credentials before allowing access to the VPN service. RADIUS can be a secure and centralized way to manage VPN user authentication and access control.

What other protocols work alongside RADIUS for enhanced security?

For enhanced security and multi-factor authentication, RADIUS can be used alongside other authentication protocols or technologies. Some common combinations include:

EAP (Extensible Authentication Protocol) with RADIUS: EAP provides a framework for various authentication methods and can be used with RADIUS to enable strong authentication mechanisms like EAP-TLS, EAP-PEAP, or EAP-TTLS.
MFA (Multi-Factor Authentication) Solutions: RADIUS can be integrated with MFA solutions that add an extra layer of security by requiring users to provide multiple authentication factors, such as a password and a one-time token.
VPN Protocols: RADIUS can work alongside VPN protocols like IPsec or SSL/TLS VPNs to provide user authentication and authorization for secure remote access.
WebAuthn and FIDO2: These modern authentication protocols can be used in combination with RADIUS to enable passwordless and strong cryptographic authentication on the web.

Is RADIUS suitable for small businesses?

RADIUS can be suitable for small businesses, especially if they require centralized user authentication and access control for their Wi-Fi networks or other network services. RADIUS implementations are scalable, and various open-source RADIUS server options can be cost-effective for small business deployments. By using RADIUS, small businesses can improve network security, simplify user management, and ensure consistent authentication across their network infrastructure. However, it’s essential to assess the specific needs and resources of the small business to determine if RADIUS is the right solution for their networking environment.

Conclusion

In conclusion, RADIUS (Remote Authentication Dial-In User Service) is a widely used networking protocol that provides centralized authentication, authorization, and accounting (AAA) for network access control. Its key components include the RADIUS server, RADIUS client (e.g., Wi-Fi access point), and user database.

The authentication process involves the client sending an authentication request to the RADIUS server, which verifies user credentials and responds with an authentication success or failure. RADIUS supports various authentication methods, such as PAP, CHAP, and EAP, and offers enhanced security through encryption and mutual authentication. Additionally, RADIUS can enforce access policies based on user attributes and record user activity for auditing and billing purposes.

Final recommendation:

RADIUS continues to be a reliable and effective solution for network access control, especially in scenarios where centralized user authentication and access management are essential. Its flexibility in supporting various authentication methods and compatibility with a wide range of network devices make it suitable for different networking environments. For organizations seeking to implement a robust and proven AAA protocol, RADIUS is a recommended option.

However, it’s important to consider the network’s specific requirements and security needs. For environments with a heavy focus on Windows-based systems and domain-based user management, Active Directory integration might be a compelling option. For highly secure networks or those with complex administrative access requirements, TACACS+ could be a worthy alternative to explore.

In summary, RADIUS remains a valuable and widely adopted AAA protocol for network access control. Organizations should assess their unique networking needs, security considerations, and compatibility requirements to decide whether to deploy RADIUS or explore alternative AAA solutions.

RADIUS course on Udemy: Microsoft Windows Radius server (NPS) : Configure and Manage

Information Security Asia

Information Security Asia is the go-to website for the latest cybersecurity and tech news in various sectors. Our expert writers provide insights and analysis that you can trust, so you can stay ahead of the curve and protect your business. Whether you are a small business, an enterprise or even a government agency, we have the latest updates and advice for all aspects of cybersecurity.

What is RADIUS?