Identity and access

RADIUS

Also called FreeRADIUS, Access-Request, Access-Accept, Access-Reject, NAS, shared secret, radtest

The protocol switches, access points and VPN gateways use to ask one central server whether to let a user in.

A NAS (network access server: a switch, access point or VPN gateway) sends an Access-Request over UDP 1812 with the user's name and credentials; the server answers Access-Accept, Access-Reject or Access-Challenge (another round, as EAP needs). Accepts carry attributes the NAS applies, like the VLAN to put the user in. Each NAS is a known client with a shared secret that hides the password attribute and signs every packet; a request with the wrong secret, or from an unknown address, gets no answer at all. radtest asks a server directly.

See it on real machines

Learn it on real machines.