Skip to Content

InkBridge Networks - A new name for Network RADIUS

How Does RADIUS Authentication Work?

A RADIUS server controls who gets on your network. When someone tries to connect, whether over Wi-Fi, VPN, or a wired port, the RADIUS server decides whether to let them in, what they are allowed to do once connected, and how to record the session. This article walks through exactly how that process works. 

RADIUS Authentication

The client-server model 

RADIUS is a client-server protocol. The "client" is not the end user's device. It is the network access server (NAS): the access point, switch, VPN concentrator, or router that receives the connection request. The NAS hands the credentials off to the RADIUS server, which does the actual authentication work and sends back a decision. 

This design matters because it centralises authentication. Instead of every access point and switch maintaining its own user database, they all consult a single RADIUS server.  

Adding a user, revoking access, or updating a policy happens in one place and takes effect everywhere. 

Step by step: The Authentication flow 

  1. Access request. A user attempts to connect to the network. The NAS receives the connection attempt and collects the user's credentials.
  2. Request forwarded. The NAS packages the credentials into an Access-Request packet and sends it to the RADIUS server. Sensitive fields like the user password are obfuscated using a shared secret known to both the NAS and the RADIUS server.
  3. Credentials validated. The RADIUS server checks the credentials against its user database. This might be a local file, an SQL database, an LDAP directory, or an Active Directory server.
  4. Decision returned. The server responds with one of three outcomes:
    • Access-Accept: The credentials are valid. The user is granted network access, often with attributes specifying VLAN assignment, bandwidth limits, or session timeout.
    • Access-Challenge: The server needs more information, such as a second factor, PIN, or token response.
    • Access-Reject: The credentials are invalid. Access is denied.
  5. Session begins. If access was granted, the NAS applies any attributes returned by the server and the user is connected. If accounting is enabled, the NAS then sends periodic updates to the RADIUS server throughout the session, recording connection duration, data transferred, and when the session ends.

AAA: Authentication, Authorisation, Accounting 

The five-step flow above covers authentication. RADIUS is best known for providing all three AAA functions: 

  • Authentication verifies who the user is. 

  • Authorisation defines what the user is allowed to do once authenticated, such as which VLAN they join or what bandwidth they receive. 

  • Accounting tracks what happened during the session for billing, auditing, and troubleshooting. 

Centralising all three in one protocol is why RADIUS has been the default for network access control for over three decades. Every switch, access point, and VPN appliance made in the last 25 years supports it. 

For a deeper look at what makes the protocol itself secure, see our guide to the RADIUS protocol and how it works. 

Frequently asked questions about RADIUS authentication 

What is RADIUS authentication? 

RADIUS authentication is the process of verifying a user's identity before granting them access to a network. When someone tries to connect to Wi-Fi, a VPN, or a wired network port, the RADIUS server checks their credentials against a central user database and returns one of three responses: access granted, access denied, or a request for additional information. 

What does "Remote Authentication Dial-In User Service" stand for? 

RADIUS stands for Remote Authentication Dial-In User Service. The name reflects the protocol's 1991 origins in dial-up Internet access, but RADIUS has evolved into the dominant authentication protocol for modern networks including Wi-Fi, VPN, and 802.1X wired access. Nearly every ISP, university, and enterprise network uses RADIUS today. 

How does a RADIUS server work? 

A RADIUS server works as the central authentication authority for a network. When a user tries to connect, the network access server (such as an access point or VPN concentrator) forwards the user's credentials to the RADIUS server. The server checks the credentials against its user database, applies any authorisation policies, and returns a decision to the network access server, which either grants or denies access. 

What is the difference between RADIUS Authentication and Authorisation? 

Authentication verifies who the user is — confirming their identity through a password, certificate, or other credential. Authorisation determines what the authenticated user is allowed to do, such as which VLAN they join, what bandwidth they receive, or which network resources they can reach. RADIUS handles both functions as part of its AAA framework (Authentication, Authorisation, Accounting). 

Is RADIUS Authentication secure? 

Modern RADIUS authentication is highly secure when properly configured. Running RADIUS over TLS, using strong shared secrets, and choosing appropriate authentication methods (such as PAP with a secure database, or EAP-TLS with certificates) provides robust security. For detailed guidance, see our RADIUS security best practices guide. 

Need more help?


InkBridge Networks has been at the forefront of network security for over two decades, tackling complex challenges across various protocols and infrastructures. Our team of seasoned experts has encountered and solved nearly every conceivable network security issue. If you're looking for insights from the architects behind some of the internet's most foundational authentication systems, you can request a quote for network security solutions here. 

Related Articles

Authentication: Is it really you?

RADIUS security is composed of three components: authentication, authorization, and accounting. These three links in the RADIUS security chain are often referred to by their acronym, “AAA”. The first of these, authentication, is the process that determines whether a client (a person, a device, or a software process) is a legitimate user of the system.

How does RADIUS Accounting work?

RADIUS accounting is a critical component of the RADIUS protocol that collects data for statistical purposes, network monitoring, and accurate billing of users. This process works alongside RADIUS authentication and authorisation to create a comprehensive network security solution.

in Blog