RADIUS / RadSec
RADIUS supplies network-access authentication and accounting between an authenticator and backend server. RadSec secures the backend connection with TLS; these flows normally originate at the switch/AP, not the AV supplicant.
Scope: RADIUS / RadSec — requirements depend on the selected profile.
security mechanism · Catalog reviewed 2026-09-27
NetworkingOpen Standard
Infrastructure Requirements
- Compatible authenticator/network-access server and backend
- configured client identity, credentials and policies
- certificates and TLS trust for RadSec.
Network & Physical Requirements
| Port / allocation | Transport | Connection / signal flow | Feature and requirement | Evidence |
|---|---|---|---|---|
| 1812 | UDP | Switch / AP / NAS → RADIUS server | Profile requirement · Core RADIUS authentication RADIUS authentication | Source checked 2026-09-27 RFC 2865, Implementation Note; Section 3: Packet Format |
| 1813 | UDP | Switch / AP / NAS → RADIUS server | Optional · Accounting RADIUS accounting RADIUS accounting | Source checked 2026-09-27 RFC 2866, Implementation Note; Section 3: Packet Format |
| 3799 | UDP | Authorization server → NAS / authenticator | Optional · CoA Change of authorization / disconnect RADIUS dynamic authorization | Source checked 2026-09-27 RFC 5176, Sections 2.1 and 2.2: Disconnect and CoA messages |
| 2083 | TCP | RADIUS client/proxy → RADIUS TLS server | Optional · RadSec RADIUS over TLS RadSec | Source checked 2026-09-27 RFC 6614, Section 2.1: TCP port and Packet Types |
Gotchas & IT Notes
- ⚠Backend authentication traffic normally originates from the authenticator, not every AV client.
- ⚠Authentication, accounting and change-of-authorization have separate directions and optional roles.