RADIUS (Remote Authentication Dial-In User Service) is an open-standard AAA protocol for centralized network-access control. It authenticates users, authorizes access, and records activity through a central server. section 11.4.2
Key RADIUS characteristics include:
- Combines authentication and authorization into one Access Request operation, while accounting remains an AAA function. section 11.4.2 section 11.6
- Uses UDP port 1812 for authentication and authorization and UDP port 1813 for accounting. section 11.4.2
- Encrypts the password in the Access Request but sends other message contents in cleartext. section 11.4.2
- Typically supports network access, including wired and wireless clients, rather than device administration. section 11.4.2 section 11.6
RADIUS commonly serves as the authentication server in 802.1X. The supplicant is the client, the authenticator is the connecting network device, and RADIUS verifies the supplicant’s credentials. Before authentication, an 802.1X-secured port permits only authentication traffic. section 11.4.3
WPA-Enterprise message path
In enterprise wireless access, EAPoL carries EAP messages between the supplicant and authenticator, while the authenticator uses RADIUS to relay those messages to the authentication server. In a split-MAC design, the WLC functions as the authenticator and the AP tunnels client EAP messages to it through CAPWAP. section 20.2.2
Table 11.1 RADIUS and TACACS+ (view table figure)
| RADIUS |
TACACS+ |
|---|---|
| Open standard |
Created by Cisco but now open standard |
| Combines authentication and authorization into a single operation |
Keeps all three AAA components separate |
| UDP ports 1812 and 1813 |
TCP port 49 |
| Encrypts passwords only |
Encrypts all communications |
| Typically used for network access |
Typically used for device administration |
Compare RADIUS and TACACS+ by AAA operation, transport ports, encryption scope, and typical deployment. section 11.4.2
