How RADIUS Authentication Works & Why You Should Use It

In an enterprise network, you cannot trust that every person or device requesting access is who they claim to be.

Shared passwords get stolen, personal devices slip onto corporate Wi-Fi, and a single compromised credential can put your entire infrastructure at risk. RADIUS authentication solves this by running every connection request through a centralized server that verifies identity before access is granted.

This guide covers how RADIUS works, the step-by-step authentication process, EAP methods and deployment options for enterprise networks.

What Is RADIUS Authentication?

RADIUS is an acronym that stands for Remote Authentication Dial-In User Service, although it is also often known as an AAA (Authentication, Authorization, and Accounting) server.

AAA summarizes what RADIUS servers do:

• granting/denying access to your network
• providing varying levels of authorization to users
• keeping a record of all attempts to establish a network connection

RADIUS is a networking protocol for identity verification, access management and recording services. It runs between RADIUS clients (network access servers or NAS) and RADIUS servers (a server running the RADIUS protocol).

The easiest way to imagine where RADIUS fits into your network is to picture a bouncer at the door to a club. When someone tries to connect to your Wi-Fi or VPN, the RADIUS confirms that they should have access first by checking their credentials (username and password) or certificate. Then, the RADIUS rejects or accepts the user accordingly.

Prefer a visual explanation? The video below breaks down what is RADIUS authentication and how it works.

Functions of the RADIUS Protocol

The three primary functions of the RADIUS protocol are:

1. Authentication: RADIUS servers examine encrypted credentials (username and password) or digital certificates to verify identities. The server checks what the user provides against a separate user database or certificate revocation list (CRL) to confirm or deny authentication.
2. Authorization: Once a RADIUS server authenticates credentials or certificates, it determines what data the user can access and what actions they can take. Organizations typically use role-based access, such as Administrator or Guest designations, to govern these controls.
3. Accounting: RADIUS servers monitor and log all access; this recording process is called accounting. Accounting includes event records such as time of access, specific data accessed, actions performed and the reason each session ends. Accounting is useful for usage-based billing, resource utilization records, trend analysis and forecasting data needs.

The video below explains the three A’s of RADIUS, authentication, authorization and accounting, and their role in secure network access.

Origin of the RADIUS Protocol

In 1987, the National Science Foundation issued a grant to Merit Networks to develop a protocol for dial-up service that could configure tens of thousands of users with just one server.

Merit awarded the protocol development contract to Livingston Enterprises, who delivered the first version of RADIUS in 1991.

After significant changes, the protocol launched to the public in 1994. Then, the Internet Engineering Task Force (IETF) helped standardize RADIUS with the release of RFC 2058, and later RFC 2138, both in 1997.

Issued in 2000, RFC 2865 set standards for RADIUS to support authentication and authorization between NAS and RADIUS servers. Soon, it also became part of the Institute of Electrical and Electronics Engineers (IEEE) 802.1X authentication protocol.

Watch the video below to learn why IEEE 802.1X relies on a RADIUS server for secure, scalable network authentication.

Today, RADIUS supports credential-based authentication and passwordless certificate-based authentication. Modern RADIUS authentication features stronger encryption and improved authentication.

Key Components of the RADIUS Protocol

A RADIUS deployment requires three components:

• A RADIUS server: on-premises hardware running FreeRADIUS, Microsoft NPS, Cisco ISE or a cloud-hosted service.
• A network access server (NAS): the device that receives connection requests and forwards them to the RADIUS server, such as a wireless access point, VPN concentrator or managed switch.
• A supplicant: software on the connecting device that handles the authentication exchange. Most operating systems include a built-in 802.1X supplicant.

You’ll also need the expertise to set up and maintain a RADIUS server, which can be difficult. Expertise and infrastructure management are the main barriers to self-hosting RADIUS.

Organizations that lack dedicated network engineering staff often choose a cloud-hosted RADIUS service to reduce operational overhead.

How Does RADIUS Authentication Work?

The RADIUS authentication process follows a defined sequence of packet exchanges between the supplicant (the device requesting access), the NAS (the access point or VPN gateway), and the RADIUS server.

The illustration provides a overview of the RADIUS authentication process.

The steps below describe a standard EAP-TLS exchange, the most widely deployed certificate-based method.

• Connection Request: The supplicant sends an EAP-Start message to the NAS when attempting to join the network.

• Identity Request: The NAS forwards an EAP-Request/Identity message to the supplicant, asking it to identify itself. The NAS encapsulates this in a RADIUS Access-Request packet when communicating with the RADIUS server.
• Identity Response and Server Challenge: The supplicant returns its identity. The RADIUS server receives the Access-Request, selects the EAP method (EAP-TLS in this case), and sends an Access-Challenge packet containing the EAP-Request/TLS-Start message.

• TLS Handshake: The supplicant and RADIUS server exchange TLS Client Hello and Server Hello messages, negotiate cipher suites, and present their certificates. The RADIUS server validates the client certificate against its configured CA and checks the CRL or OCSP status.

• Authorization and Access Decision: If the certificate is valid and the identity is found in the directory, the RADIUS server returns an Access-Accept packet. This packet contains RADIUS attributes that instruct the NAS to assign a VLAN, set a session timeout, or apply other policies. If validation fails at any step, the server returns Access-Reject and the NAS blocks the connection.

For credential-based flows using PEAP-MSCHAPv2, the process is similar, but the supplicant presents a username and password inside a TLS tunnel rather than a certificate. The RADIUS server forwards the credentials to Active Directory or LDAP for validation.

RADIUS Authorization in the RADIUS Protocol

Within the RADIUS protocol, a RADIUS server does more than verify identity, it enforces access control through RADIUS authorization. After a user or device connects to a network, the RADIUS server evaluates policies to determine the level of access to grant.

RADIUS authorization uses inputs such as user identity, device type, group membership, and security posture to apply granular access controls.

Instead of granting full network access, the RADIUS server can assign VLANs, enforce segmentation, restrict access to specific resources or apply conditional policies. This ensures that every connection is not only verified but also aligned with organizational security requirements.

How RADIUS Authentication and Authorization Work Together

RADIUS authentication and authorization are two steps in the same process. The RADIUS server handles both as part of the AAA framework.

• Identity verification first: RADIUS authentication validates the user or device against a directory such as Active Directory, LDAP, or a cloud identity provider before any access is granted.
• Authorization follows immediately: Once the RADIUS server confirms identity, RADIUS authorization applies the matching access policy in the same exchange with no additional steps or manual intervention.
• Policy inputs determine access level: The RADIUS server evaluates user identity, device type, group membership, and security posture to decide what level of network access to grant.
• Granular access control over full access: Instead of granting unrestricted network access, the RADIUS server assigns VLANs, enforces segmentation or restricts access to specific resources based on real-time attributes.
• Consistent enforcement across infrastructure: The same RADIUS authentication process applies across Wi-Fi, VPN and wired connections, ensuring uniform policy enforcement regardless of how a user connects.
• Supports zero trust principles: Because every connection request is verified and authorized individually, RADIUS server authentication aligns with zero trust frameworks that require continuous identity validation before granting access.

Is RADIUS Server Authentication Encrypted

RADIUS certainly boosts the security of your network, but it’s not a one-stop solution for authentication security. The RADIUS protocol relies on the encryption of the credentials themselves when communicating them over the air. In some scenarios, that’s not sufficient.

That’s where RadSec, also known as RADIUS over TLS, comes in.

RadSec is an 802.11x protocol for transporting RADIUS packets through Transmission Control Protocol (TCP) and Transport Layer Security (TLS).

In a nutshell, RadSec increases the security of RADIUS even further by encrypting the communication between the RADIUS server and the access point (or switch).

The video below breaks down RADIUS vs. RadSec, including how RadSec encrypts RADIUS traffic and protects authentication data.

How RadSec Works

RadSec moves RADIUS traffic from User Datagram Protocol (UDP) to TCP and encrypts every packet using TLS.

Unlike standard RADIUS, which only obfuscates the password field, RadSec encrypts the entire exchange, including usernames and policy attributes.

The NAS and RADIUS server authenticate each other using certificates, making man-in-the-middle attacks significantly harder. This makes RadSec the standard transport for RADIUS traffic crossing untrusted networks and roaming environments like eduroam.

The diagram below illustrates how RadSec encrypts RADIUS traffic between the NAS and RADIUS server using TLS.

RadSec and Upgraded RADIUS Security in 2026

For years, RadSec has been recommended as a more secure alternative to traditional RADIUS by encrypting authentication traffic with TLS instead of sending it over unencrypted UDP.

While the technology itself is not new, 2026 marks an important milestone as the IETF works to replace the original experimental RadSec specification with a more mature and security-focused standard.

The original RadSec specification was published in 2012 as RFC 6614 and provided a framework for running RADIUS over TLS. Although widely adopted in environments such as eduroam and other large roaming networks, the specification was classified as experimental and left some implementation details open to interpretation.

Over the past decade, organizations have gained significant real-world experience with RadSec, leading to a clearer understanding of best practices and security requirements.

To reflect these lessons, the IETF is developing an updated RadSec standard that strengthens security requirements and improves interoperability between vendors. The goal is to provide a more consistent and reliable foundation for secure RADIUS communications across enterprise, education, government and service provider environments.

The push toward RadSec has become even more important following the disclosure of the BlastRADIUS vulnerability in 2024.

That attack demonstrated how traditional RADIUS deployments running over UDP could be vulnerable to authentication response forgery under certain conditions. Because RadSec encrypts and protects traffic using TLS, it prevents the type of network interception and manipulation required for BlastRADIUS-style attacks.

As a result, RadSec is increasingly viewed as more than just a recommendation for roaming and federation deployments. Many security professionals now consider it a foundational security control for protecting authentication traffic.

Organizations planning RADIUS deployments in 2026 should view RadSec as a key part of their modernization strategy, helping improve security, support evolving standards, and reduce exposure to risks associated with legacy RADIUS communications.

How Does RADIUS Accounting Work?

RADIUS accounting logs every network session from start to finish, giving administrators a complete record of who accessed the network, for how long and what they did.

• Accounting Start: When a user gains access, the RADIUS client sends an Accounting-Request packet containing the user’s network address, MAC address, credentials or certificate, access point and a unique session identifier.
• Accounting Response: The RADIUS server acknowledges receipt and begins tracking the session. The client continues sending interim updates with details like current session duration.
• Accounting Stop: When the session ends, the RADIUS client sends a final packet with the total session duration, bytes transferred, data accessed, packet count and the reason the session ended.
• Server storage: The RADIUS server stores all accounting data, creating an auditable log of every connection across the network.

What RADIUS Accounting Data is Used For

The following are how RADIUS Accounting data is used:

• Access management: Administrators use session logs to monitor who is on the network and revoke access when needed.
• Security audits: Accounting records provide forensic detail for investigating suspicious activity or policy violations.
• Usage-based billing: ISPs and managed service providers use byte and session data to invoice customers accurately.
• Capacity planning: Session duration and traffic volume data helps predict future network resource needs.

Benefits of RADIUS Authentication

RADIUS authentication helps organizations centralize identity verification, enforce consistent access policies and securely scale network access across users and devices.

Key benefits include:

• Comprehensive AAA services: RADIUS features reliable Authentication, Authorization, and Accounting services all in one package. It allows for multiple authentication methods including credentials or certificates.

• Centralized management: A single centralized system lets you navigate access request messages, reference user databases and customize role-based access controls. It also allows you to revoke access as needed with real-time revocation.

• Strong encryption and integration: RADIUS works with 802.1X authentication for superior encryption. It is also easy to integrate with your existing infrastructure.

• Enhanced scalability: You can upgrade scalability with cloud-based RADIUS. This lets you add high volumes of users and devices without performance issues.

Challenges of RADIUS Authentication

Like any enterprise authentication solution, RADIUS requires proper planning, configuration and ongoing management to maximize its effectiveness.

Common challenges include:

• High cost and complexity: Opting for legacy RADIUS tools with on-premises hardware requires purchasing, installing and maintaining servers. This can be expensive and complex, requiring skilled in-house staff.

• Implementation difficulties: RADIUS is highly customizable. While flexibility is a benefit, it also adds complexity during implementation.

• Cybersecurity vulnerabilities: If you do not properly maintain RADIUS cybersecurity requirements, you expose yourself to severe vulnerabilities. Failing to maintain it leads to the same security risks as less secure methods.

• Protocol risks: Basic options like PAP, PTP, or CHAP expose you to risks. To mitigate these risks, it is highly recommended to use a more secure protocol like EAP-TLS.

• Management overhead: Managing all the moving parts in-house presents significant operational challenges. Choosing a managed, cloud-based option like the SecureW2 JoinNow Cloud RADIUS provides all the benefits without those in-house difficulties.

See cloud RADIUS in action.

Explore how a cloud-hosted RADIUS solution delivers secure authentication without the hardware, maintenance or operational overhead.

Take a Free Product Tour  →

How to Set Up RADIUS Server Authentication

In the past, opting to use RADIUS server authentication meant that you had to build your own on-premises server. This can be inconvenient for a number of reasons:

• It requires expertise and experience with the RADIUS protocol.
• If you didn’t have the expertise, you may need to hire additional personnel.
• You need both equipment (physical servers) and space for that equipment.
• Setting up the server takes time initially, and maintaining it costs time perpetually

Some organizations still use on-premises RADIUS servers, but nowadays, there are also other options. Thanks to managed RADIUS services like Cloud RADIUS, the process is much simpler and more cost-effective.

Of course, the process of setting up a wireless RADIUS server varies based on your Wi-Fi provider, but the general process with Cloud RADIUS from SecureW2 is outlined below:

1. Create a RADIUS profile in your wireless controller.
2. Navigate to AAA management, then AAA configuration in the SecureW2 Management Portal.
3. Note the Primary IP Address, Port, and Shared Secret.
4. Input this information into the RADIUS profile you created.
5. Save the new RADIUS profile.

You can learn more about configuring RADIUS with an AP in one of our integration guides.

Common RADIUS Authentication Errors and How to Fix Them

Even a properly configured RADIUS deployment can experience authentication failures. Most issues trace back to a handful of common causes.

1. Access-Reject with valid credentials

The user enters the right password but still gets denied access. This usually means the RADIUS server received the request but rejected it based on a policy mismatch, not a wrong password.

Cause	Fix
Username format mismatch (user vs domain\user)	Match the identity format the NAS sends to what the directory expects
Wrong shared secret between NAS and RADIUS server	Re-enter the shared secret on both sides and test connectivity
User not in the correct directory group	Check RADIUS policy is pointing to the right group

2. “Can’t contact RADIUS server” or authentication timeout

The NAS is sending requests but hearing nothing back. The connection never reaches the RADIUS server, which means something between the two is blocking it.

Cause	Fix
Firewall blocking UDP 1812/1813	Open UDP 1812 (auth) and 1813 (accounting) between NAS and RADIUS server
NAS IP not registered as a RADIUS client	Add the NAS IP to the authorized clients list on the RADIUS server

3. EAP-TLS handshake failure

Certificate-based authentication fails before the session even starts. The TLS handshake breaks down because one side does not trust the other’s certificate.

Cause	Fix
Expired client or server certificate	Check OpenSSL logs for the exact cert, renew and redeploy via MDM
Root CA not trusted by the client device	Push the issuing CA certificate to endpoints via MDM or Group Policy

4. Expired or unreachable CRL

Every EAP-TLS connection starts failing at the same time with no obvious trigger. Logs show “RevocationStatusUnknown” or “unable to get certificate CRL,” which points directly to the CRL as the problem.

Cause	Fix
CRL past its validity date	Republish the CRL before expiry and automate renewal
CRL distribution point unreachable	Switch to OCSP for real-time revocation checking

5. Authentication timeouts under load

Authentication slows down or breaks entirely during peak hours but works fine at off-peak times. The server is getting overwhelmed, not misconfigured.

Cause	Fix
NAS retransmission timer too aggressive (under 1 second)	Set retransmission timers to at least 3 seconds with exponential backoff
No failover server configured	Add a secondary RADIUS server to prevent a single point of failure

Cloud RADIUS: RADIUS Server Authentication, Simplified

It’s vital that you ensure only authorized users can access your network, and a RADIUS server is inarguably the best solution.

In addition to preventing unauthorized access, RADIUS makes it possible for you to use the information already contained in your IdP for role-based access control and other policy enforcement options.

If you’re worried that RADIUS sounds complicated to set up, we have good news for you. It’s not hard to improve your network security with RADIUS server authentication thanks to solutions from SecureW2 like Cloud RADIUS.

Schedule a personalized demo to see how simple RADIUS security can be.

---

Frequently Asked Questions

How does RADIUS differ from other authentication protocols?

The biggest differences between RADIUS and other authentication protocols such as LDAP and TACACS+ are:

• RADIUS provides full Authentication, Authorization, and Accounting (AAA) support, which is why RADIUS servers are sometimes called AAA servers. Neither LDAP nor TACACS+ includes accounting.
• RADIUS is a network access authentication protocol; other authentication protocols may manage devices or directories.
• RADIUS supports certificate-based authentication; LDAP doesn’t.
• RADIUS supports on-premises or cloud systems; LDAP is usually on-premises only.
• RADIUS supports 802.1X port-based access control; TACACS+ doesn’t.
• RADIUS uses User Datagram Protocol (UDP) as its Transport Layer Protocol, which is efficient but transmits packets regardless of whether there’s an established connection. Many other protocols use Transmission Control Protocol (TCP) instead, which is slower but more reliable since it requires a connection.

What is the difference between RADIUS and TACACS+?

RADIUS is an open-standard network access authentication protocol that includes authentication, authorization, and accounting (AAA) all in one. Its Transport Layer Protocol is the efficient User Datagram Protocol (UDP). RADIUS supports 802.1X and encrypts passwords.

Terminal Access Controller Access-Control System Plus (TACACS+) is a proprietary device administration protocol mostly used for Cisco network devices, such as routers and switches. It divides AAA into distinct processes. TACACS+ uses Transmission Control Protocol (TCP) and doesn’t support 802.1X. However, TACACS+ encrypts all packets during communication.

What is the difference between RADIUS and LDAP?

RADIUS regulates network access across multiple connection types, including Wi-Fi and VPN. It offers on-premises or cloud-based AAA support with either user credentials or digital certificates.

RADIUS uses User Datagram Protocol (UDP), which transmits data packets regardless of connection status — efficient, but not always reliable. Lightweight Directory Access Protocol (LDAP) is usually on-prem only and lacks accounting support. LDAP also doesn’t support certificate-based authentication.

What is the difference between SAML and RADIUS?

RADIUS is a protocol for network authentication, authorization, and accounting services. Network administrators deploy RADIUS on servers to manage access requests, communicate with directories including IdPs such as Active Directory and store access records.

Security Assertion Markup Language (SAML) is an assertion-based authentication protocol that connects servers (including RADIUS servers) to IdPs for identity verification requested by a service provider (SP). Since RADIUS servers don’t contain user databases, SAML is a crucial component of the RADIUS authentication process.

Is RADIUS authentication still used?

Yes, RADIUS authentication is very commonly used today. Regulated by standards created by the IETF and IEEE, RADIUS offers secure access with centralized authentication management and accounting processes. It’s highly customizable and scalable, making it a top choice for growing businesses and large-scale enterprises alike.

What is 3-step authentication?

3-step authentication is a security process that verifies identity through three sequential checks before granting access. The three steps are typically something you know (a password or PIN), something you have (a security token or mobile device), and something you are (a biometric, like a fingerprint or face scan).

Requiring all three makes unauthorized access significantly harder because an attacker would need to compromise all three factors simultaneously.

What is the difference between Kerberos and RADIUS?

Kerberos and RADIUS both handle authentication but serve different environments.

Kerberos is a ticket-based protocol designed for internal network authentication, most commonly used within Windows Active Directory environments to authenticate users to internal services without repeatedly entering credentials. RADIUS is built for network access control, verifying users and devices before they connect to Wi-Fi, VPN or wired infrastructure.

The key difference is scope. Kerberos manages access to internal resources after a user is already on the network, while RADIUS controls whether that user gets onto the network in the first place.

What are the three types of authentication?

The three types of authentication are knowledge-based, possession-based, and inherence-based.

Knowledge-based authentication relies on something the user knows, such as a password or security question. Possession-based authentication relies on something the user has, such as a hardware token, smart card or mobile device, receiving a one-time code. Inherence-based authentication relies on something the user is, verified through biometrics like fingerprints, facial recognition, or voice patterns.

Most modern security frameworks recommend combining at least two of these types, which is the foundation of multi-factor authentication.