📖 What is Remote Authentication Dial-In User Service (RADIUS)?
Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users connecting to a network service. It is commonly used for wireless access and VPN authentication to centralize user credentials.
"Remember that RADIUS only encrypts the password in the access-request packet, not the entire payload of the communication."
📚 Certification: CompTIA Network+ Certification Exam (N10-009)
🔑 What are the Key Concepts of Remote Authentication Dial-In User Service (RADIUS)?
- ▸ Implements the AAA framework, providing a centralized method for Authentication, Authorization, and Accounting to manage network access and track user activity.
- ▸ Uses a client-server model where the Network Access Server (NAS) acts as the client, forwarding user requests to the central RADIUS server.
- ▸ Relies on a shared secret between the client and server to authenticate the communication and encrypt the user's password during transmission.
- ▸ Typically utilizes UDP ports 1812 for authentication and authorization and port 1813 for accounting, ensuring a lightweight communication process.
- ▸ Enables scalable management by allowing administrators to update user permissions in one central location rather than on every individual network device.
🎯 How does Remote Authentication Dial-In User Service (RADIUS) appear on the N10-009 Exam?
You may be asked to identify the best protocol for implementing WPA3-Enterprise wireless security, where each user must authenticate with their own unique corporate credentials rather than a shared passphrase.
A scenario might describe a need to monitor the exact duration and data volume of VPN sessions for auditing purposes, requiring a protocol that supports the 'Accounting' portion of the AAA framework.
Expect questions comparing RADIUS and TACACS+, specifically focusing on which protocol is better for general network access control versus granular device administration and command-level authorization for network engineers.
❓ Frequently Asked Questions
What is the main security difference between RADIUS and TACACS+?
RADIUS only encrypts the user's password in the access-request packet, leaving the rest of the payload in cleartext. In contrast, TACACS+ encrypts the entire packet, providing significantly better security for administrative traffic.
Why is RADIUS often used for Wi-Fi instead of local authentication?
Local authentication requires managing users on every single Access Point. RADIUS centralizes this, allowing a user to roam across a campus while the APs simply proxy the authentication to a central server.