RADIUS (Remote Authentication Dial-In User Service) is a distributed client-server protocol that centralizes authentication, authorization, and accounting for network access. A network device forwards a user’s or device’s credentials to a RADIUS server, which checks them against an external database and returns an accept, reject, or challenge decision.
Key takeaways
- RADIUS centralizes authentication, authorization, and accounting (AAA).
- Access-Request, Access-Accept, and Access-Reject drive authentication.
- 802.1X uses RADIUS as the authentication server behind the authenticator.
- RADIUS Accounting and CoA extend the protocol beyond login decisions.
- VOS devices and Versa Director both authenticate users through RADIUS.
On this page: Why it mattersHow it worksTypesRADIUS & VersaFAQ
Why is RADIUS important?
Before RADIUS, every network device kept its own list of usernames and passwords, so adding a user or revoking access meant touching every switch or VPN concentrator individually. RADIUS centralized that job: devices stop making authentication decisions themselves and ask a trusted authority instead, so one policy change propagates everywhere at once, and one credential store is what an attacker would need to compromise, not dozens.
That centralization is why RADIUS outlived the dial-up era it was named for, becoming the default authentication backend for 802.1X port access, VPN concentrators, and administrative logins – lightweight, vendor-neutral, and spoken by every major network OS. Its accounting half adds a second benefit: every session is logged centrally, which is what makes usage audits possible without instrumenting each device.
What is RADIUS?
A RADIUS exchange has three roles: a supplicant (the user or device requesting access), a network access server or NAS (the switch, controller, or gateway acting as the RADIUS client), and the RADIUS server itself. The NAS packages the supplicant’s credentials into an Access-Request UDP packet – traditionally sent to port 1812 – with attributes describing the request, such as NAS-IP-Address, NAS-Port, and Service-Type. The RADIUS server replies with Access-Accept, Access-Reject, or Access-Challenge.
A shared secret configured on both the NAS and the server protects the exchange: it obfuscates the password field and lets the server verify the message wasn’t tampered with, via the Message-Authenticator attribute. Because the protocol is attribute-based, an Access-Accept can carry more than a yes/no answer – it can hand back a VLAN assignment, a session timeout, or other authorization data the NAS then enforces.
Types of RADIUS
RADIUS is really a family of exchanges on the same protocol. Authentication is the core Access-Request/Access-Accept/Access-Reject/Access-Challenge exchange described above. Accounting, a separate exchange traditionally on port 1813, uses Start, Interim-Update, and Stop records so the server can track session duration and usage.
Change of Authorization (CoA), standardized in RFC 5176, lets the server push changes to an already-authenticated session – disconnecting it or changing its attributes – without the client reauthenticating. A fourth pattern, MAC Authentication Bypass (MAB), repurposes ordinary RADIUS authentication for devices that can’t run 802.1X: the NAS sends the device’s MAC address as both username and password, letting non-EAPOL clients like printers and IP phones authenticate the same way.
RADIUS & Versa
VOS devices use RADIUS as the authentication server behind IEEE 802.1X device authentication: the VOS interface acts as the authenticator, relaying supplicant credentials to a configured RADIUS server object (IP address, port, routing instance, shared secret, and a redundancy priority). An 802.1X authentication profile of type RADIUS carries the attributes exchanged with the server – NAS Identifier, NAS IP, NAS Port, COA Port, Framed MTU – plus optional RADIUS Accounting, RADIUS Fail Open (keeps clients online if the server is unreachable), and RADIUS Tracking (retries once a downed server returns). Non-EAPOL clients authenticate the same way via MAC Authentication Bypass, with VLAN assignment coming back dynamically in the response – all configurable per interface through LAN connection profiles.
At the organization level, Manage Organization Settings exposes an Enterprise RADIUS Profile for end-user authentication – attached to authentication rules the same way LDAP or SAML profiles are – plus a separate Wi-Fi RADIUS Profile for Wi-Fi access points. Versa Director itself also supports RADIUS for administrator authentication.
Frequently asked questions
What port does RADIUS use?
Traditionally, RADIUS authentication uses UDP port 1812 and accounting uses UDP port 1813, though both are configurable per server object rather than fixed by the protocol. Some older deployments still run on legacy ports 1645 and 1646, so a server may need to support both pairs.
What is the difference between RADIUS authentication and RADIUS accounting?
Authentication decides whether a user or device gets access, using Access-Request, Access-Accept, and Access-Reject messages exchanged before a session starts. Accounting is a separate exchange that records session usage – start, interim updates, and stop – after access is granted.
What is MAC Authentication Bypass (MAB)?
MAB authenticates devices that cannot run 802.1X, such as printers or IP phones, by sending the device’s MAC address to the RADIUS server as both username and password. It lets non-EAPOL clients reach the network through the same RADIUS infrastructure as 802.1X supplicants.
What is RADIUS Change of Authorization (CoA)?
CoA, defined in RFC 5176, lets a RADIUS server change or terminate an already-authenticated session without the client reauthenticating – for example, updating a VLAN assignment or disconnecting a user whose access must be revoked immediately, instead of waiting for a timeout.
How does RADIUS differ from LDAP?
RADIUS is an authentication and accounting protocol built around a request/accept/reject exchange for network access decisions. LDAP is a directory-access protocol for querying user and group information. Many deployments use both together: RADIUS handles the decision, LDAP supplies the identity data behind it.
More on RADIUS
If you want to learn more, these are sources we trust.
| RFC 2865: Remote Authentication Dial In User Service (RADIUS) | RFC 2866: RADIUS Accounting |
|---|---|
| The original IETF standard defining the RADIUS authentication and authorization protocol, its packet format, and its core attributes. | The companion standard defining RADIUS accounting: how session usage records are generated, sent, and acknowledged. |
Related terms
If you’re reading about RADIUS, these are worth looking at next.
| Authentication, Authorization, and Accounting | Lightweight Directory Access Protocol | Versa Director |
|---|---|---|
| The security framework RADIUS implements: verifying identity, deciding what’s permitted, and logging what happened. | A directory protocol often paired with RADIUS, supplying the user and group data an authentication decision draws on. | The Versa management console that can authenticate its own administrators through a configured RADIUS server. |