🔐Remote Authentication Dial-In User Service

NEW

Also known as: RADIUS

A client–server networking protocol providing centralized authentication, authorization, and accounting for network access.

DESCRIPTION

RADIUS centralizes user authentication, authorization, and accounting (AAA) across network access servers. It uses a client–server model where the NAS forwards credentials and requests to a RADIUS server. Common deployments include VPNs, Wi‑Fi (802.1X), and remote access. RADIUS supports shared secrets and attribute–value pairs to convey policies. Alternatives include TACACS+ and Diameter, with Diameter considered an evolutionary successor. RADIUS remains widely used due to simplicity, broad vendor support, and mature implementations like FreeRADIUS and Microsoft NPS.

ALTERNATIVE DEFINITIONS

IETF RFC 2865

The Remote Authentication Dial In User Service (RADIUS) is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server (NAS) which desires to authenticate its links and a shared Authentication Server.

Defines RADIUS formally as an AAA protocol between NAS and authentication server.

Source

Cisco

RADIUS (Remote Authentication Dial-In User Service) is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate remote users and authorize their access to the requested system or service.

Highlights client/server model and practical remote access usage.

Source

Microsoft Learn

Network Policy Server (NPS) uses RADIUS to perform centralized authentication, authorization, and accounting for network access.

Describes Windows NPS integrating RADIUS for centralized AAA.

Source

RELATED TERMS

AAA 802.1X Kerberos LDAP SAML OAuth 2.0 Network Access Server FreeRADIUS

COMPETING TERMS

TACACS+ Diameter

KNOWLEDGE AREAS

Data Security Infrastructure Cloud Data Privacy & Compliance

TARGET AUDIENCE

Security Architect Cybersecurity Engineer IT Manager DevOps Engineer Application Administrator

EXTERNAL SOURCES

• Wikipedia - RADIUS
• IETF RFC 2865 - Core RADIUS authentication specification
• IETF RFC 2866 - RADIUS accounting specification
• FreeRADIUS - Open-source RADIUS server documentation
• Microsoft Learn - NPS overview for RADIUS deployments

TOP QUESTIONS

Where is RADIUS commonly used?

RADIUS is used in Wi‑Fi (802.1X), VPNs, dial-in access, and device administration. It centralizes AAA for consistent policies across network access points.

Category: Examples

How does RADIUS improve security?

It centralizes authentication and authorization, enforces consistent policies, and logs accounting events. Shared secrets and attributes enable granular access control.

Category: Security

What are RADIUS attributes?

Attributes are key–value pairs that carry policy information, like VLAN IDs, session timeouts, or user roles. They enable flexible authorization decisions.

Category: Concepts

How does RADIUS compare to TACACS+?

TACACS+ separates authentication and authorization more clearly and encrypts the entire payload, often preferred for device administration. RADIUS is widely adopted and simpler for network access.

Category: Comparison

What is the relationship between RADIUS and Diameter?

Diameter is considered a successor that addresses RADIUS limitations, offering improved reliability and capabilities. RADIUS remains dominant due to existing infrastructure.

Category: Alternatives

What are common mistakes in RADIUS deployments?

Weak shared secrets, misconfigured client IPs, and inconsistent attribute handling cause failures. Lack of redundancy leads to outages.

Category: Mistakes

How do you scale RADIUS?

Use multiple servers, load balancing, and caching. Segment clients and enforce timeouts. Monitor accounting performance and latency.

Category: Management

How does RADIUS support 802.1X?

It receives EAP messages via the authenticator and makes centralized AAA decisions. Policies can assign VLANs, ACLs, or roles on successful authentication.

Category: Integration

What logs does RADIUS produce for compliance?

Accounting records include session start/stop, bytes transferred, and device identifiers. These support auditing and incident response.

Category: Compliance