Support Library

RADIUS Explained: AAA for Network Access

RADIUS is the protocol switches, Wi-Fi access points and VPN gateways use to ask a central server whether a user or device may connect. The server answers with accept or reject plus access policy, and records each session for accounting.

Author
CategoryZero Trust & Network Access
Length8 minute read
UpdatedOctober 24, 2026

The short answer

Remote Authentication Dial In User Service (RADIUS) dates from the dial-up era, but it is still the protocol behind almost every 802.1X, Wi-Fi Enterprise and VPN login. It is defined in RFC 2865, with accounting in RFC 2866, and runs over UDP port 1812 for authentication and 1813 for accounting. Some older equipment still uses the unofficial ports 1645 and 1646.

RADIUS does the three jobs known as AAA:

JobQuestion it answersRADIUS messages
AuthenticationIs this user or device who it claims to be?Access-Request, Access-Challenge
AuthorizationWhat may it do: which VLAN, access list or session length?Attributes inside Access-Accept
AccountingWhen did the session start and stop, and how much did it use?Accounting-Request, Accounting-Response

The switch, access point or VPN gateway is the RADIUS client, also called the network access server (NAS). The user's laptop never talks RADIUS; it talks EAP or a VPN protocol to the NAS, which talks RADIUS to the server.

The conversation

Three separate exchanges share the protocol: authentication and authorization, accounting, and server-initiated changes to a session that is already running.

RADIUS messages between a network access server, a RADIUS server and an identity store Authentication on UDP 1812: the network access server, a switch, access point or VPN gateway, sends Access-Request with the user, port and EAP data. The RADIUS server checks credentials against an identity store over LDAP or Kerberos, or checks a certificate. It may send Access-Challenge for more EAP rounds, then Access-Accept with VLAN and access list, or Access-Reject. Accounting on UDP 1813: the access server sends Accounting-Request Start, Interim-Update and Stop records, and the server acknowledges each with Accounting-Response. Change of Authorization on UDP 3799: the server sends CoA-Request or Disconnect-Request to re-authenticate, change or end a session, and the access server answers with ACK or NAK. Each client shares a secret with the server. Classic RADIUS protects packets with MD5 and leaves most attributes readable, so require Message-Authenticator and use RADIUS over TLS where possible. RADIUS client Switch, access point or VPN gateway RADIUS server Policy, logs, and the certificate checks Identity store AD, LDAP, IdP Authentication · UDP 1812 Access-Request User, port, EAP data LDAP · Kerberos or a certificate check Access-Challenge More EAP rounds, if needed Access-Accept or Access-Reject Accept carries VLAN, access list, timeouts Accounting · UDP 1813 Accounting-Request Start, Interim-Update, Stop Accounting-Response Change of Authorization · UDP 3799 CoA-Request or Disconnect Server-initiated: reauth, new VLAN, end ACK or NAK Triggered by an EDR alert, admin or policy Shared secret Classic RADIUS protects packets with MD5 and the client's shared secret. Require Message-Authenticator on every packet, and prefer RADIUS over TLS. RADIUS messages between a network access server and a RADIUS server Authentication on UDP 1812: the client sends Access-Request, the server checks an identity store and may send Access-Challenge, then Access-Accept with policy or Access-Reject. Accounting on UDP 1813: the client sends Accounting-Request Start, Interim-Update and Stop, and the server answers each with Accounting-Response. Change of Authorization on UDP 3799: the server sends CoA-Request or Disconnect-Request and the client answers with ACK or NAK. Classic RADIUS relies on MD5 and a shared secret, so require Message-Authenticator and prefer RADIUS over TLS. → client to server← server to client Authentication · UDP 1812 →Access-Request User, port and EAP data ⇄Identity store lookup LDAP, Kerberos or a certificate check ←Access-Challenge More EAP rounds, if needed ←Access-Accept or Reject Accept carries VLAN and access list Accounting · UDP 1813 →Accounting-Request Start, Interim-Update, Stop ←Accounting-Response CoA · UDP 3799 ←CoA-Request or Disconnect Reauth, change VLAN or end session →ACK or NAK Shared secret Classic RADIUS relies on MD5. Require Message-Authenticator on every packet, and prefer RADIUS over TLS.
Authentication and accounting are started by the client. Change of Authorization runs the other way, so the server can act on a session that is already running.

Packet types

CodePacketSent byMeaning
1Access-RequestClientPlease authenticate this user or device
11Access-ChallengeServerI need more information; used for every EAP round
2Access-AcceptServerAllowed, with the attributes to apply
3Access-RejectServerNot allowed
4 and 5Accounting-Request and Accounting-ResponseClient, then serverSession start, interim updates and stop, and their acknowledgements
40 to 42Disconnect-Request, ACK and NAKServer, then clientEnd this session now (RFC 5176)
43 to 45CoA-Request, ACK and NAKServer, then clientChange this session's authorization (RFC 5176)

Attributes that matter

Everything in a RADIUS packet after the header is an attribute: a type number, a length and a value. These are the ones you will see most in network access logs:

Attribute (type)Used for
User-Name (1)The identity being authenticated; with EAP, the outer identity, which may be anonymous
User-Password (2)A password hidden with the shared secret; used for PAP and for MAB
NAS-IP-Address (4), NAS-Port-Id (87)Which switch and port the request came from
Service-Type (6)The kind of session requested, for example Framed or Call-Check
Called-Station-Id (30), Calling-Station-Id (31)The access point or switch MAC (and SSID on Wi-Fi) and the device MAC
Session-Timeout (27), Filter-Id (11)How long the session lasts before re-authentication, and which access list to apply
Tunnel-Private-Group-ID (81)The VLAN to assign, together with Tunnel-Type and Tunnel-Medium-Type (RFC 3580)
EAP-Message (79), Message-Authenticator (80)EAP data carried through RADIUS, and an HMAC-MD5 over the whole packet (RFC 3579)
Vendor-Specific (26)A container for vendor attributes, such as downloadable access lists or security group tags

Shared secrets and how RADIUS is protected

Each RADIUS client is configured on the server by its IP address and a shared secret. Classic RADIUS uses that secret in three ways: to hide the User-Password attribute, to compute the Response Authenticator that proves a reply came from the server, and in the Message-Authenticator attribute. All of them are built on MD5. Every other attribute, including user names, MAC addresses and VLANs, crosses the network as readable text.

Blast-RADIUS (CVE-2024-3596)

Published in July 2024, this attack uses an MD5 collision to let an attacker who sits between a RADIUS client and server turn an Access-Reject into an Access-Accept for requests that do not carry a Message-Authenticator. EAP-based logins already had to include it under RFC 3579, so 802.1X was less exposed than PAP, CHAP and MS-CHAP logins used by many VPNs and device-admin setups. The fix is to update both sides and configure the server to require Message-Authenticator on every Access-Request, and the client to require it on every response. The longer-term fix is to stop running RADIUS over plain UDP across untrusted networks.

Two transports wrap RADIUS in modern encryption: RADIUS over TLS, often called RadSec, on TCP port 2083 (RFC 6614), and RADIUS over DTLS (RFC 7360). Both were first published as experimental, and IETF work is under way to make TLS-based transport the expected way to run RADIUS and to deprecate MD5-based protection. In the meantime, keep plain RADIUS on trusted management networks or inside an encrypted tunnel, use long random shared secrets that differ per client, and turn on Message-Authenticator checks.

Proxying and roaming

A RADIUS server can forward a request to another server based on the realm in the user name, the part after the @ in a Network Access Identifier (RFC 7542). This is how eduroam lets a student from one university join Wi-Fi at another: the visited campus forwards anonymous@example.edu through a chain of proxies to the home university's server, which runs the EAP method with the device. The inner credentials stay inside the EAP tunnel, so the proxies never see them, but they do see the outer identity and accounting data.

RADIUS, TACACS+ and Diameter

RADIUSTACACS+Diameter
Main useNetwork access: 802.1X, Wi-Fi, VPNAdministrator logins to network devicesMobile and carrier networks
TransportUDP 1812/1813, or TLS/DTLSTCP 49TCP or SCTP 3868
ProtectionPassword attribute only, unless run over TLSWhole packet body obfuscated with the shared secret; TLS is being addedTLS or IPsec
AuthorizationReturned with the acceptSeparate, can approve each command an admin typesReturned per application
Defined inRFC 2865RFC 8907RFC 6733

Running RADIUS reliably

  • Run at least two servers and configure every client with both. Clients detect a dead server after a few unanswered retries, and that wait adds to login time, so tune timeouts rather than leaving vendor defaults.
  • Keep accounting. Accounting records tie an IP address and MAC to a user and a port at a point in time, which is what an incident responder needs.
  • Watch the dependencies. A RADIUS server is only as available as its directory, certificate revocation lists and time source. Clock drift breaks certificate checks and Kerberos.
  • Plan for server outages at the edge. Decide what switches do when no server answers, for example a critical VLAN with limited access.

Testing and troubleshooting

Command or logWhereWhat it shows
radtest alice 'Passw0rd' 192.0.2.10 0 'SharedSecret'FreeRADIUS utilities on any Linux hostSends a PAP Access-Request to the server at 192.0.2.10 and prints the reply. Test with a dedicated test account
freeradius -XFreeRADIUS server (named radiusd -X on some systems)Runs the server in the foreground with full debug output for each request
Security log events 6272 and 6273Windows Network Policy ServerAccess granted and access denied, with the reason code and the policy that matched
test aaa group radius alice Passw0rd new-codeCisco IOS XEWhether the switch can reach the server and get an accept

The most common causes of failure are simple: the client's IP address is not registered on the server, the shared secrets do not match, a firewall blocks UDP 1812 or 1813, or the request matches a different policy than intended. A mismatched secret usually shows up as the server silently dropping requests or reporting a bad authenticator.

FAQ

What ports does RADIUS use?

UDP 1812 for authentication and authorization, UDP 1813 for accounting, and UDP 3799 for Change of Authorization and Disconnect messages. Some older equipment uses the unofficial ports 1645 and 1646. RADIUS over TLS uses TCP 2083.

Is RADIUS traffic encrypted?

Not in classic RADIUS. Only the User-Password attribute is hidden, using MD5 and the shared secret, and other attributes travel as readable text. EAP methods such as EAP-TLS and PEAP encrypt the credentials inside the EAP exchange, and RADIUS over TLS or DTLS encrypts the whole RADIUS packet.

Am I affected by Blast-RADIUS?

You are most at risk if RADIUS crosses untrusted networks over UDP and uses PAP, CHAP or MS-CHAP without Message-Authenticator. Update RADIUS servers and clients, configure the server to require Message-Authenticator on all requests and clients to require it on responses, and move to RADIUS over TLS where possible.

What is the difference between RADIUS and TACACS+?

RADIUS is built for network access such as 802.1X, Wi-Fi and VPN logins, and returns authorization with the accept. TACACS+ is built for administrators logging in to network devices, runs over TCP, and can authorize each command separately.

Sources and further reading

Related support articles

802.1X ExplainedMAC Authentication Bypass (MAB)Certificate-Based AuthenticationZero Trust Networking ExplainedCommon TCP and UDP Ports ExplainedTCP vs UDP and Why DNS Uses Both