RADIUS
By IETF
RADIUS, Remote Authentication Dial-In User Service, is a networking protocol that centralizes authentication, authorization, and accounting for users connecting to a network, such as VPN gateways, Wi-Fi access points, or dial-up servers. A…
Definition
RADIUS, Remote Authentication Dial-In User Service, is a networking protocol that centralizes authentication, authorization, and accounting for users connecting to a network, such as VPN gateways, Wi-Fi access points, or dial-up servers. A network device acts as a client to a RADIUS server, which checks credentials against a central user database and returns an accept or reject decision along with any access policies to apply.
Overview
RADIUS was created to solve a practical problem for internet service providers and enterprise networks with many access points: rather than configuring every dial-up modem bank, VPN concentrator, or wireless access point with its own list of valid users, RADIUS centralizes that decision in one server that all the network devices can consult. This meant a user's credentials, and any policy about what they're allowed to do once connected, lived in one place instead of being duplicated across every piece of network hardware. Mechanically, a RADIUS deployment has three roles: the user or supplicant trying to connect, the network access server acting as a RADIUS client, such as a Wi-Fi controller or VPN gateway, and the RADIUS server itself, which holds or has access to the actual user database. When a user attempts to connect, the network access server packages their credentials into a RADIUS Access-Request message and sends it to the RADIUS server, which checks them against a directory, often via LDAP or a local database, and responds with Access-Accept, Access-Reject, or Access-Challenge for additional steps like multi-factor authentication. Once accepted, RADIUS also handles accounting, logging session start and stop times and data usage, which is why the protocol bundles authentication, authorization, and accounting into one system rather than treating them separately. RADIUS differs from Kerberos and LDAP in that it is purpose-built for network access control rather than general-purpose directory queries or ticket-based service authentication; it is the protocol specifically spoken between network infrastructure devices and a central policy server. It is commonly deployed alongside a directory service, using LDAP or Active Directory as its backing user store while RADIUS itself handles the network-facing accept/reject decision and accounting. In practice, enterprise Wi-Fi networks use RADIUS with the 802.1X standard to authenticate devices joining the network, VPN gateways use it to check remote worker credentials before granting network access, and internet service providers historically used it to authenticate dial-up and broadband subscribers. Network switches also use RADIUS for port-based access control, restricting which devices are allowed to communicate on a wired network segment. Its main limitation is that RADIUS was designed in an era of trusted internal networks and, in its original form, has weaker cryptographic protections than modern protocols, which is why it is typically run over secured internal links or tunneled through additional encryption such as RADIUS over TLS in modern deployments. It also does not itself manage user identities, relying on an external directory for that, so RADIUS is best understood as a network access control layer rather than a full identity system.
Specification
- Centralizes authentication and accounting for network access devices
- Access-Accept, Access-Reject, and Access-Challenge response model
- Commonly paired with 802.1X for enterprise Wi-Fi authentication
- Delegates user directory lookups to LDAP or Active Directory
- Logs session accounting data including start, stop, and usage
- Widely used by VPN gateways and network switches for access control
- Originated with dial-up and broadband ISP subscriber authentication