RADIUS

What is RADIUS?

RADIUS (Remote Authentication Dial-In User Service) is a network protocol that lets a central server handle authentication, authorisation and accounting (AAA) for users and devices requesting access to a network or network device. Switches, wireless access points and VPN gateways no longer decide on access themselves; they forward every login to the RADIUS server. RADIUS is the engine behind 802.1X network access control and is also used for administrator logins on network equipment.

In OT environments, RADIUS provides a way to centrally manage access to network equipment and segments, without each device having to be configured individually with local accounts.

🧠 How does RADIUS work?

RADIUS involves three roles: the supplicant (user or device), the authenticator or NAS (the Switch, Router, access point or VPN gateway) and the RADIUS server. The steps:

1. A user or device tries to connect via the authenticator.
2. The authenticator sends an Access-Request to the RADIUS server.
3. The server checks the credentials (password or certificate) against its own database or an external source such as Active Directory or LDAP.
4. The server replies with Access-Accept, Access-Reject or Access-Challenge (a request for more input, such as an MFA code or the next step of an EAP handshake).
5. With an Accept, the server returns attributes such as a VLAN number or administrator role, which the authenticator applies.
6. Optionally, the authenticator reports the start and end of the session for auditing (accounting).

The authenticator and server trust each other through a shared secret. The protocol is defined in RFC 2865 (2000) for authentication and RFC 2866 for accounting.

🔧 Which ports, messages and attributes does RADIUS use?

Classic RADIUS only hides the password attribute, using an MD5 operation over the shared secret. All other attributes, such as the username and the assigned VLAN, cross the network in clear text. RadSec is described in RFC 6614 (2012) and, like the DTLS variant in RFC 7360, still has experimental status. RFC 9765 (2025, also experimental) adds RADIUS/1.1, which removes all MD5 operations inside a TLS 1.3 connection.

🏭 Where is RADIUS used in industrial networks?

• 802.1X on industrial switches - engineering laptops and servers authenticate before the port opens; see also NAC.
• MAC Authentication Bypass (MAB) - PLCs, HMI panels and sensors without 802.1X support are admitted based on their MAC address. This is weaker, because a MAC address can be spoofed.
• Administrator logins - logging in to switches, firewalls and routers with personal accounts instead of one shared admin password, with RBAC roles.
• Dynamic VLANs - a maintenance laptop automatically lands in the right segment, which enforces network segmentation.
• Remote access and wireless - VPN gateways and industrial Wi-Fi (WPA2/WPA3-Enterprise) use RADIUS to verify users.
• Logging - accounting records are forwarded via Syslog to a SIEM for auditing and detection.

🔍 What is the difference between RADIUS and TACACS+?

Many organisations use both: RADIUS for network access and TACACS+ for administering network equipment.

🔐 How do you secure RADIUS?

Because RADIUS decides who gets onto the network, its own security deserves as much attention as that of the devices it protects. In July 2024 Blast-RADIUS (CVE-2024-3596) was published. An attacker between the authenticator and the server can use an MD5 collision to turn an Access-Reject into an Access-Accept, mainly with PAP, CHAP and other non-EAP methods. EAP traffic is better protected, because the Message-Authenticator attribute is already mandatory there. Measures:

• Require Message-Authenticator - have servers and clients demand this attribute in all Access messages; patch the servers first, then switches and other clients.
• RadSec or IPsec - encrypt traffic between authenticator and server, especially when it crosses shared or untrusted networks.
• Strong EAP methods - use EAP-TLS with certificates instead of passwords, backed by sound certificate management.
• Long shared secrets - at least 16 characters, unique per device or per site.
• Restrict access - limit access to the RADIUS server with Firewall rules and ACLs to known authenticators.
• Monitoring - connect to a SIEM to spot failed logins and unusual patterns.

A vulnerable RADIUS server is a central attack target: whoever controls it controls access to the entire network.

🛠️ How do you set up RADIUS for an OT network?

1. Place the server in the right zone - run a dedicated RADIUS server at level 3 of the Purdue Model or in the OT DMZ, so OT does not depend on the office network.
2. Build in redundancy - at least two servers; switches try the next server after a few seconds without a reply (High Availability).
3. Provide an emergency account - one local break-glass account per device that only works when no RADIUS server is reachable, stored securely.
4. Start in monitor mode - first log which devices would authenticate before actually blocking ports; a wrongly blocked PLC stops production.
5. Inventory devices - decide per device whether 802.1X, MAB or a fixed port with Port Security fits best.
6. Map to standards - IEC 62443-3-3 requires identification and authentication of users and devices in SR 1.1 and SR 1.2; central RADIUS authentication is a common way to meet this.

For Dutch organisations under NIS2 and the Cybersecurity Act (Cyberbeveiligingswet, in force from 15 August 2026), central authentication helps make access management demonstrable.

❓ Frequently asked questions

What does RADIUS stand for?

RADIUS stands for Remote Authentication Dial-In User Service. The name dates from the era of dial-up connections, but the protocol is now used for 802.1X, Wi-Fi, VPN and administrator logins. RADIUS handles authentication, authorisation and accounting from one central server.

Is RADIUS secure?

Classic RADIUS only hides the password and relies on MD5; in 2024 Blast-RADIUS (CVE-2024-3596) showed that this construction can be exploited in practice. RADIUS can be secured well with the mandatory Message-Authenticator attribute, EAP-TLS and encryption via RadSec or IPsec. Without those measures, RADIUS traffic should only run over an isolated management network.

Which ports does RADIUS use?

RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting. Older equipment sometimes still uses ports 1645 and 1646. RadSec, RADIUS over TLS, uses TCP port 2083.

What is the difference between RADIUS and 802.1X?

802.1X is the IEEE standard that defines how a device authenticates on a switch port or wireless network. RADIUS is the protocol the switch or access point uses to forward that login to a central server. In an 802.1X setup, RADIUS is therefore the link between authenticator and authentication server.

What happens if the RADIUS server fails?

If no RADIUS server is reachable, new logins can fail and administrators can no longer log in to switches. That is why OT networks use at least two RADIUS servers and a local emergency account. Many switches can also place ports in a preconfigured VLAN when the server is unavailable.

Can PLCs authenticate via RADIUS?

Most PLCs and field devices do not support 802.1X, so they cannot authenticate via RADIUS themselves. A common solution is MAC Authentication Bypass, where the switch presents the PLC’s MAC address to the RADIUS server. Because a MAC address can be spoofed, you combine this with segmentation and monitoring.

📌 In summary

RADIUS is the standard protocol for central authentication, authorisation and accounting of network access, and therefore the foundation of 802.1X, VPN and administrator logins in IT and OT networks. By placing RADIUS redundantly in the OT zone, requiring Message-Authenticator and encrypting the traffic, access management becomes central, demonstrable and resistant to attacks such as Blast-RADIUS.