What is Remote Au­then­ti­ca­tion Dial-In User Service (RADIUS)?

Remote Au­then­ti­ca­tion Dial-In User Service (RADIUS) is a network protocol used to centrally manage user au­then­ti­ca­tion, au­tho­riza­tion and con­nec­tion logging in IP-based networks. In simple terms, it helps networks verify who is allowed to log in and what level of access they should receive.

What is RADIUS?

When someone connects to a corporate Wi-Fi network, a VPN or an internal company network, the system first needs to verify who they are and what they are allowed to access. This is where Remote Au­then­ti­ca­tion Dial-In User Service (or RADIUS for short) comes in. RADIUS was orig­i­nal­ly developed in the 1990s to manage dial-up modem con­nec­tions centrally. Today, it is an es­tab­lished au­then­ti­ca­tion standard for networks, es­pe­cial­ly for:

• Corporate Wi-Fi networks where each user logs in with their own cre­den­tials
• VPN access, when employees connect to internal systems from outside the company network
• Office network ports, which are only activated after a suc­cess­ful login
• Internet service providers, which use RADIUS to manage customer access and billing
• Cloud and data center en­vi­ron­ments, where large numbers of user accounts need to be managed centrally

A RADIUS server can be set up on different operating systems, including Linux and Windows. It can also run on Unix systems or in con­tainer­ized en­vi­ron­ments. Many network devices and firewalls also have built-in RADIUS support or can be con­fig­ured to use an external RADIUS server.

How does RADIUS work?

RADIUS works through a clear request-response process. When a user tries to log in, the system sends the login details to a central RADIUS server. The server checks the in­for­ma­tion and decides whether access should be granted and which per­mis­sions the user should receive. From a technical per­spec­tive, RADIUS follows a client-server model, with both sides com­mu­ni­cat­ing via the User Datagram Protocol (UDP). Modern ex­ten­sions such as RadSec can also use TLS-secured TCP con­nec­tions. Here, the RADIUS server acts as the central decision point for au­then­ti­ca­tion and access control.

RADIUS allows access to be managed centrally rather than con­fig­ured sep­a­rate­ly on each device. The process works as follows:

1. A user tries to connect to a network.
2. The Network Access Server (such as a Wi-Fi con­troller or VPN gateway) sends an au­then­ti­ca­tion request to the RADIUS server.
3. The RADIUS server checks the login cre­den­tials, often against a central directory.
4. The server sends a response back: Access-Accept, Access-Reject or Access-Challenge.

If the login is suc­cess­ful, the server also sends au­tho­riza­tion details, such as which network segments (VLAN) the user can access and which re­stric­tions apply.

What are the three core pillars of RADIUS?

RADIUS is based on the AAA principle: au­then­ti­ca­tion, au­tho­riza­tion and ac­count­ing. These three pillars determine who can log in, what they are allowed to do and how their con­nec­tions are recorded.

Au­then­ti­ca­tion

Au­then­ti­ca­tion answers the question: “Who are you?” At this stage, the system checks whether a person or device is allowed to log in. The RADIUS server verifies the login cre­den­tials itself or checks them against a connected backend system. Typical au­then­ti­ca­tion methods include:

• Username and password
• Cer­tifi­cate-based methods, such as EAP-TLS
• Token-based or multi-factor au­then­ti­ca­tion

Au­tho­riza­tion

Au­tho­riza­tion answers the question: “What are you allowed to do?” After a user has been suc­cess­ful­ly au­then­ti­cat­ed, the RADIUS server de­ter­mines which per­mis­sions they should receive. It sends this in­for­ma­tion back to the network device as at­trib­ut­es, such as:

• Access to specific VLANs
• Per­mis­sion to use only certain parts of the network
• Bandwidth limits

This allows access to be managed in detail based on the user’s role, user group or device.

Ac­count­ing

Ac­count­ing answers the question: “What happened?” RADIUS can record session data, which is often used for billing, security audits or trou­bleshoot­ing. This can include:

• Start time, end time and session duration
• Amount of data trans­ferred
• Assigned IP address

Ac­count­ing is es­pe­cial­ly important for internet service providers, large corporate networks and any en­vi­ron­ment where access needs to be doc­u­ment­ed and traceable.

How has RADIUS evolved over time?

RADIUS was developed in the 1990s for dial-up con­nec­tions. Since then, en­ter­prise Wi-Fi, VPN access, IEEE 802.1X and cloud in­fra­struc­tures have changed what networks need from au­then­ti­ca­tion systems. As a result, the original protocol has been expanded to support stronger au­then­ti­ca­tion methods, better en­cryp­tion and greater scal­a­bil­i­ty. These ex­pan­sions allow RADIUS to support modern security re­quire­ments, including multi-factor au­then­ti­ca­tion, network seg­men­ta­tion and zero-trust access control.

Extended au­then­ti­ca­tion methods

One major step in the evolution of RADIUS was the in­te­gra­tion of the Ex­ten­si­ble Au­then­ti­ca­tion Protocol (EAP). EAP allows RADIUS to support modern login methods, including cer­tifi­cate-based ones such as EAP-TLS. With EAP-TLS, devices and servers au­then­ti­cate each other using digital cer­tifi­cates. This is much more secure than password-only au­then­ti­ca­tion because passwords do not need to be trans­mit­ted or stored. It also makes attacks such as phishing and automated password guessing much harder. In practice, tunnel-based EAP methods are also used alongside cer­tifi­cate-based methods:

Data trans­mis­sion and security en­hance­ments

RADIUS has also been expanded to make data trans­mis­sion more secure. The original protocol uses UDP and only encrypts certain password-related in­for­ma­tion. The password itself is disguised using an MD5-based mechanism, but the rest of the com­mu­ni­ca­tion remains un­en­crypt­ed.

RADIUS/TLS, defined in RFC 6614 and often referred to as RadSec, addresses this lim­i­ta­tion. With RadSec, all com­mu­ni­ca­tion between the network device and the RADIUS server is sent over an encrypted TLS con­nec­tion. This helps protect the data against unau­tho­rized in­ter­cep­tion and tampering, so it meets modern security re­quire­ments. RadSec is used mainly in larger corporate networks, by internet service providers and in highly in­ter­con­nect­ed or­ga­ni­za­tions with strict security re­quire­ments.

Other RADIUS en­hance­ments

As well as new au­then­ti­ca­tion methods and more secure data trans­mis­sion, RADIUS has also been expanded over time to make it more flexible for modern corporate networks. Some of the main en­hance­ments include:

• Ad­di­tion­al at­trib­ut­es (attribute-value pairs): RADIUS uses at­trib­ut­es (i.e. in­for­ma­tion elements) within each request. Over time, many new at­trib­ut­es have been added, allowing the server to process much more in­for­ma­tion than before.
• Support for VLAN as­sign­ments: After a suc­cess­ful login, RADIUS can au­to­mat­i­cal­ly assign users to specific network segments, known as VLANs. Guests might receive internet access only, while employees can access internal systems. This sep­a­ra­tion improves security and sim­pli­fies ad­min­is­tra­tion.
• Dynamic access controls: Access rights can be assigned based on specific con­di­tions during login. For example, the RADIUS server can consider which network or device someone is con­nect­ing from, the time of day or which user group they belong to. This makes it possible to apply different security levels depending on the situation.
• In­te­gra­tion of multi-factor au­then­ti­ca­tion: Modern RADIUS servers can be combined with ad­di­tion­al security factors, such as one-time codes, au­then­ti­ca­tor apps or hardware tokens. This provides stronger pro­tec­tion, es­pe­cial­ly for VPN and remote access.

What are the ad­van­tages and dis­ad­van­tages of RADIUS?