Protocol Atlas

L7 · security · draft

RADIUS

Remote Authentication Dial-In User Service

Central AAA carried as attributes over UDP, with authorization largely folded into the access response.

Presenter modeEmbed this figure

Packet FormatRFC 2865 · DRAFT STANDARD · June 2000Packet TypesRFC 2865 · DRAFT STANDARD · June 2000Packet TypesRFC 2866 · INFORMATIONAL · June 2000

Why it exists

Network access and device login need a central identity decision and an accounting trail rather than shared local passwords on every NAS. OperationRFC 2865 · DRAFT STANDARD · June 2000

RADIUS folds much of authorization into Access-Accept attributes. That is powerful and fragile: dictionaries must agree. AttributesRFC 2865 · DRAFT STANDARD · June 2000

Access-Request to Access-Accept with role attributes

A NAS builds an Access-Request. The server returns Access-Accept carrying authorization attributes the client understands — or ignores.

AdminNAS · AAA clientUDP auth exchangeRADIUS · UDP 1812
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
Adminhost—
NAS · AAA clientrouter—
RADIUS · UDP 1812cloud—
Admin — NAS · AAA clientlinkup
NAS · AAA client — RADIUS · UDP 1812linkup
1 / 3

The NAS sends Access-Request with identity and service attributes. The Request Authenticator binds the shared secret to the packet.

What changed

  • Access-Request: NAS · AAA client → RADIUS · UDP 1812
  • UDP auth exchange

How it works

The client sends Access-Request. The server returns Accept, Reject, or Challenge. Accounting is a separate packet family on a separate UDP port. Packet TypesRFC 2865 · DRAFT STANDARD · June 2000

UDP was chosen for simplicity and retransmission control at the application. There is no TCP session to hold open across a large AAA farm. Why UDP?RFC 2865 · DRAFT STANDARD · June 2000

Classic RADIUS protects selected fields such as User-Password; most attributes remain visible unless a protected transport profile is used. Security ConsiderationsRFC 2865 · DRAFT STANDARD · June 2000

Accounting-Request/Response (RFC 2866) records Start, Stop, and Interim-Update independently of the authentication exchange. OperationRFC 2866 · INFORMATIONAL · June 2000

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Code 1 Access-Request. Attributes follow the 20-octet header and are not encoded in this example.

UDP
Authentication commonly uses UDP/1812; accounting uses UDP/1813. Older deployments may still use 1645/1646. RFC 2865
RADIUS header
Code, Identifier, Length, and Request/Response Authenticator before attributes. RFC 2865

Configure it

RADIUS server group and AAA method list for login authentication.

Cisco IOS-XE 17.12 · Catalyst 9300, ISR 4451draft

  1. aaa new-model
radius server LAB
 address ipv4 192.0.2.10 auth-port 1812 acct-port 1813
 key <configured out of band>

    Named server with UDP 1812/1813. The shared secret authenticates the NAS–server relationship; only User-Password (and a few others) are obfuscated — the rest of the packet is not fully encrypted.

    Common mistake: Using the same secret across every NAS and never rotating it — a compromise of one device exposes all.

    RFC 2865 §3

  2. aaa group server radius LAB-GROUP
 server name LAB

    Groups let method lists reference a set of servers instead of a single host.

  3. aaa authentication login default group LAB-GROUP local

    Try RADIUS first; fall back to local if the server is unreachable. Authorization attributes arrive inside Access-Accept when the server grants access.

    RFC 2865 §4.2

Verify

show aaa servers
Server address, ports, and success/fail counters.
show radius server-group all
Group membership and dead/alive state where tracked.

Caveats

  • Marked draft: syntax has not been checked against Cisco documentation or a device.
  • Placeholder keys only — never commit real shared secrets.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Authentication succeeds but the session has the wrong role.

    Narrow it down

    1. Capture or debug the Access-Accept attributes.
    2. Verify vendor attribute dictionaries on both ends.

    Cause

    The authorization attribute was missing, misspelled, or unsupported by the client.

    Fix

    Align the policy result and client dictionary; test the exact platform and service type.

    Vendor-SpecificRFC 2865 · DRAFT STANDARD · June 2000

  2. Every login pauses before local fallback.

    Narrow it down

    1. Measure RADIUS timeout and retries.
    2. Check reachability from the configured source interface.

    Cause

    The server is unreachable and serial timeout/retry behavior delays the fallback method.

    Fix

    Repair reachability, use redundant servers, and set deliberate bounded timeouts without making transient loss an instant bypass.

    Cisco IOS XE 17 — Configuring RADIUS §Configuring Settings for All RADIUS Servers

  3. Accounting shows sessions that never stop.

    Narrow it down

    1. Check Accounting-Start, Interim-Update, and Stop counters.
    2. Inspect NAS reboot and packet-loss history.

    Cause

    RADIUS accounting uses separate UDP exchanges; a lost Stop does not roll back the earlier Start.

    Fix

    Enable interim updates and reconcile stale sessions on the collector.

    Acct-Status-TypeRFC 2866 · INFORMATIONAL · June 2000

  4. MFA users always fail even though the password is correct.

    Narrow it down

    1. Look for Access-Challenge in the exchange.
    2. Confirm the NAS continues with State and the user response.

    Cause

    The client treated Access-Challenge as Reject or dropped the State attribute.

    Fix

    Continue the challenge/response exchange until Accept or Reject.

    Access-ChallengeRFC 2865 · DRAFT STANDARD · June 2000

  5. Every request is silently ignored or returns authenticator errors.

    Narrow it down

    1. Compare the shared secret on NAS and server character-for-character.
    2. Confirm the source address the server expects for that NAS.

    Cause

    A mismatched shared secret or unexpected NAS address fails Request Authenticator validation.

    Fix

    Align secret and NAS IP/identifier; do not rotate one side without the other.

    Packet FormatRFC 2865 · DRAFT STANDARD · June 2000

Design notes

Acceptance without understood attributes is a successful login with the wrong privilege. Debug the Accept, not only the code.

Timeouts and retries decide how long a dead server delays local fallback. Bound them deliberately. Cisco IOS XE 17 — Configuring RADIUS §Configuring Settings for All RADIUS Servers

Misconceptions

“RADIUS encrypts the whole packet.”
Classic RADIUS protects selected fields such as the User-Password attribute; most attributes are visible unless a protected transport profile is used. Security ConsiderationsRFC 2865 · DRAFT STANDARD · June 2000
“An Access-Accept means authorization is correct.”
Acceptance and the returned role attributes are separate facts. A missing attribute can produce a valid but under- or over-privileged session. Access-AcceptRFC 2865 · DRAFT STANDARD · June 2000
“Accounting is just another attribute on Access-Accept.”
Accounting is a separate packet family (RFC 2866) with its own UDP exchanges for Start, Stop, and Interim-Update. Packet TypesRFC 2866 · INFORMATIONAL · June 2000

More walkthroughs

Access-Challenge continues the conversationdesign-choice

Not every decision is Accept or Reject. Access-Challenge asks for another factor or round; the NAS must continue the exchange, not treat Challenge as failure.

User · MFANASRADIUS
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
User · MFAhost—
NASswitch—
RADIUScloud—
User · MFA — NASlinkup
NAS — RADIUSlinkup
1 / 3

The first Access-Request carries the username. The server is not done — it needs a second factor.

What changed

  • Access-Request: NAS → RADIUS

Accounting-Stop never arrivesfailure

Accounting is a separate UDP service. A lost Stop leaves a Start without a clean end; interim updates bound how stale the collector becomes.

NASUDP lossAccounting · 1813Session: open
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
NASrouter—
UDP losszone—
Accounting · 1813cloudSession: open
NAS — UDP losslinkup
UDP loss — Accounting · 1813linkup
1 / 3

Accounting-Request with Acct-Status-Type Start records the session. Authentication already succeeded on a different exchange.

What changed

  • Accounting-Start: NAS → Accounting · 1813
  • Accounting · 1813: Session → open

Terms

RADIUS attribute
A typed value in a RADIUS packet describing identity, service, policy result, or accounting data. Correct authentication does not imply the client understood every returned attribute.

Check yourself

  • Which response may carry the user’s role?
  • What does Access-Challenge mean?
  • What transport does classic RADIUS use?
  • What does classic RADIUS encrypt by default?
  • Why can local fallback feel slow?
  • Which document defines Accounting-Request and Accounting-Response?
  • Why enable interim accounting updates?
  • What happens if the NAS does not understand a returned Vendor-Specific Attribute?