How does the RADIUS protocol work and how do you secure it?

RADIUS is a protocol that lets network devices such as Wi-Fi controllers, switches and VPN gateways ask a central server to authenticate users and decide what they may do. The device sends a request, the server answers accept, reject or challenge. It is old, so protect the transport carefully.

How does a login work?

RFC 2865 defines RADIUS. The device that wants to authenticate someone is the Network Access Server, which acts as a RADIUS client. The flow:

1. A user connects and presents credentials to the access device.
2. The device sends an Access-Request to the RADIUS server, containing the username and the password in protected form, plus attributes such as which port the user arrived on.
3. The server checks its user store.
4. It replies with Access-Accept, Access-Reject or Access-Challenge. A challenge asks for more, such as a one time code, and the device repeats the request with the answer.
5. An accept can carry attributes: which VLAN to place the user on, a session timeout or a filter.

RADIUS combines authentication and authorization in this exchange. Accounting, tracking when sessions start and stop, is a related function defined separately.

How is it protected on the wire?

The RFC specifies UDP, with 1812 as the authentication port, and a shared secret known by the client and server and never sent across the network. That secret signs responses and is used with MD5 to hide the User-Password attribute. RFC 2865 also notes that requests from a client without a known shared secret are silently discarded.

This is where modern concern begins. MD5 is no longer regarded as a strong primitive, and a hidden password attribute is not the same as encryption of the entire conversation. Most attributes travel in the clear, which exposes usernames, device identifiers and network details. Weak or reused shared secrets make offline attacks easier for anyone who captured traffic. RADIUS over plain UDP should not cross untrusted networks.

What is RadSec?

RFC 6614 defines RADIUS over TLS, often called RadSec, which carries RADIUS over TCP wrapped in TLS, with TCP port 2083 as the default. It authenticates both peers with certificates and encrypts the whole conversation. Note that the RFC is classed as Experimental, though it is widely supported in practice. Check whether your equipment supports it.

Where does RADIUS show up?

Enterprise Wi-Fi using 802.1X, VPN and remote access logins, switch port access control and network device administration. Often the RADIUS server forwards to a directory or an identity provider behind the scenes.

Constructed example: a campus runs Wi-Fi controllers in six buildings, all pointing at one RADIUS server over plain UDP through a shared network segment, using the same short secret on every controller. Anyone who gets on that segment and captures traffic can mount offline guessing against the secret. Moving the links to RadSec, or at least to a dedicated management network with unique long secrets per controller, shrinks the exposure.

What about accounting?

RADIUS accounting, a companion function, records when sessions start and stop and how much data they used. Those records are useful in an investigation, since they show who was connected, from which device and for how long. They also contain usernames and addresses, so protect them like any other sensitive log and set a retention period you can defend.

How to check or apply this

1. Inventory every RADIUS client and server and the path between them.
2. Give each client its own long random shared secret. Rotate when staff with access leave.
3. Use RadSec where supported, or place plain UDP traffic only on isolated, controlled links.
4. Restrict which IP addresses may send requests to the server.
5. Require multi factor authentication where the access method allows it, and prefer certificate based EAP methods over password based ones for Wi-Fi.
6. Log accepts, rejects and challenges, and alert on bursts of failures.
7. Run at least two servers, so an outage does not lock everyone out or push admins to disable authentication.

Quick check

Sources

• RFC 2865, Remote Authentication Dial In User Service (RADIUS)
• RFC 6614, Transport Layer Security (TLS) Encryption for RADIUS

Last reviewed: 18 October 2026.