What is a RADIUS server? 

A RADIUS server is the software that decides who is allowed onto a network. When someone connects to corporate Wi-Fi, a VPN, or a wired network port, a RADIUS server checks their credentials and either grants or denies access. It is the single most widely deployed authentication system in the world, used by nearly every ISP, university, and enterprise network. 

What is RADIUS and why do I care?

RADIUS is a networking protocol which lets organizations control who accesses their network.  It isn't a web portal (which needs a network to work).  RADIUS operates at a lower level than that.  It got its start in the 1990s, with dial-up Internet, and PPP!

Today, RADIUS can be used in almost any environment, even enterprise networking.  Without access control, your network is wide open to anyone.  The person delivering lunch for a meeting can drop a Raspberry Pi on your network, and you'll never know.  The person who just got laid off can access the corporate Wi-Fi from the parking lot, and cause devastation after they're no longer an employee.

Your office has locks on the doors for a reason.  RADIUS is the lock for the network.

The benefits of a RADIUS server on the efficiency of an entire network are wide-reaching. Although some businesses are unaware of the advantages of a RADIUS server as opposed to a pre-shared key, others have long benefited from the increased speed of RADIUS servers, as well as their ability to heighten security, to enhance reporting and tracking capabilities, and to personalize restrictions based on the user.

Here are just some of the key advantages of a RADIUS server:

• Each individual user session is encrypted uniquely, which prevents other users from acquiring private information. This differs from a Wi-Fi PSK network, in which each user shares the same encryption key.  Do you have private data or trade secrets?  If they go over unsecured Wi-Fi, you don't any more!
• A particular user or device can easily be deauthorized by removing them from the network. This step ensures that the deauthorized user can no longer access the network.
• Network permissions, such as firewall policy, scheduling, and QoS settings, can be assigned within a particular user or device profile, based on user identity.
• A RADIUS server does not require significant server horsepower and can be installed in a way that best fits your needs without changing your current system.

RADIUS is supported by pretty much every single access point, switch, and router made in the last twenty-five years.  Every user device (Windows, Mac, Linux, Android, iPhone) supports the features necessary to leverage RADIUS authentication.

Your network doesn't have to be open.  It can be secure.  All you have to do take the steps to make it secure.  

When to use a RADIUS server 

RADIUS makes sense any time you need to control network access for more than a handful of users. Specific scenarios include: 

• Wi-Fi for employees or guests. Replaces shared Wi-Fi passwords with per-user authentication, so you can revoke access without changing the password for everyone. 

• VPN remote access. Authenticates VPN users against a central directory and applies per-user policies. 

• ISP subscriber authentication. Nearly every ISP on earth uses RADIUS to authenticate and account for subscriber sessions. 

• University campus networks. Authenticates tens of thousands of students and staff across Wi-Fi and wired networks, often federated through eduroam. 

• 802.1X port-based network access. Authenticates devices at the switch port or access point before they are allowed onto the network. 

If your network has more than 20 or 30 users and you care about knowing who is on it, you need a RADIUS server. 

Frequently asked questions about RADIUS servers 

What does a RADIUS server do? 

A RADIUS server controls who is allowed onto a network. It receives authentication requests from network access devices (access points, VPN concentrators, switches), checks the user's credentials against a central database, and returns an access decision. RADIUS servers also handle authorisation policies and session accounting, making them the central authority for all three AAA functions. 

Do I need a RADIUS server for my business? 

Most businesses with more than 20-30 network users benefit from a RADIUS server. If you use a shared Wi-Fi password, struggle to revoke access when employees leave, or cannot track who is on your network, a RADIUS server solves these problems. Universities, ISPs, and enterprises almost universally use RADIUS; smaller businesses often adopt it once they outgrow pre-shared key Wi-Fi. 

What is the difference between a RADIUS server and a firewall? 

A firewall controls what traffic can flow between network segments once a user is connected. A RADIUS server controls who is allowed to connect in the first place. The two work together: RADIUS authenticates the user at the edge of the network, the firewall enforces policies on the traffic once they are inside. Most secure networks use both. 

What authentication methods does a RADIUS server support? 

RADIUS servers support a wide range of authentication methods, including PAP (Password Authentication Protocol), CHAP (Challenge-Handshake Authentication Protocol), MS-CHAP, and EAP (Extensible Authentication Protocol) with its many sub-methods. The right choice depends on your security requirements and infrastructure. For technical guidance, see our guide to the RADIUS protocol. 

Is FreeRADIUS a RADIUS server? 

Yes. FreeRADIUS is the most widely deployed RADIUS server in the world, powering authentication for the majority of ISPs, universities, and Fortune 500 companies globally. InkBridge Networks is the team behind FreeRADIUS and provides enterprise support, customisation, and consulting services around it. 

Need more help?

InkBridge Networks has been at the forefront of network security for over two decades, tackling complex challenges across various protocols and infrastructures. Our team of seasoned experts has encountered and solved nearly every conceivable network security issue. If you're looking for insights from the architects behind some of the internet's most foundational authentication systems, you can request a quote for network security solutions here. 

How Does RADIUS Authentication Work?

A RADIUS server controls who gets on your network. When someone tries to connect, whether over Wi-Fi, VPN, or a wired port, the RADIUS server decides whether to let them in, what they are allowed to do once connected, and how to record the session. This article walks through exactly how that process works. 

The RADIUS protocol: How it works and why it's secure

Learn how security-by-design improvements have transformed RADIUS into a more secure protocol than the expensive platforms built on top of it.