Definition
RADIUS (Remote Authentication Dial-In User Service) is an AAA (Authentication, Authorization, Accounting) protocol defined by IETF RFC 2865/2866. It uses a client-server architecture for centralized user authentication, authorization, and accounting for network access. RADIUS operates on UDP ports 1812 (authentication/authorization) and 1813 (accounting), and supports extended attributes to transmit user information, QoS policies, VPN parameters, and more. In L2TP, VPDN, access authentication scenarios, the NAS (Network Access Server) acts as a RADIUS client, interacting with the RADIUS server to complete user verification and policy delivery.
Detailed explanation of AAA functions
- Authentication: Verifies user identity and supports multiple methods such as PAP, CHAP, EAP; the RADIUS server can integrate with user sources like LDAP, AD, databases, etc.
- Authorization: Delivers access policies based on user attributes, such as IP address pools, ACLs, bandwidth limits, session timeouts, etc.
- Accounting: Records session start/end, traffic, and duration; supports real-time billing and offline invoices to meet the auditing needs of operators and enterprises.
Protocol process and security
Typical process: The user initiates an access request → NAS sends an Access-Request to RADIUS (including username, password, or CHAP challenge) → RADIUS server verifies and returns Access-Accept or Access-Reject → During the session, Accounting-Request can be sent to record usage. RADIUS supports shared secret for message integrity protection, and sensitive attributes can be encrypted; RADIUS over TLS (RadSec) can provide transport layer encryption.
Typical Use Cases
RADIUS is widely used in carrier broadband dialing (PPPoE), enterprise WiFi (802.1X), VPN gateways, IoT private network access (private network access), VPDN, etc. When IoT devices access enterprise private networks via cellular networks, PGW/GGSN can perform device authentication and APN authorization through RADIUS, enabling centralized access control.
When SimtoLink provides IoT private network access solutions for enterprise customers, the carrier side often uses RADIUS to complete authentication and authorization of IoT SIM cards/devices. Customers can connect to their own RADIUS or the carrier's RADIUS to implement differentiated policies based on IMSI, APN, and device type. When configuring private APN, fixed IP, and QoS, SimtoLink assists customers in understanding the mapping between RADIUS attributes and carrier policies, ensuring that IoT devices access the network as expected and receive the corresponding network resources.