Centralised AAA over UDP: authentication 1812, accounting 1813 (legacy 1645/1646). Only the password field is encrypted — headers and attributes travel in the clear, which is the core difference to TACACS+.

• Flow: Access-Request → Access-Accept/Reject/Challenge; authorization returns attributes (VLAN, ACL, session timeout); accounting sends start/stop/interim updates.
• The protocol of 802.1X and wireless (ISE downstream) — where RADIUS owns the scene.

radius server RADIUS1
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key Cisco123
aaa authentication login default group radius local
aaa accounting exec default start-stop group radius

Design: always keep a local fallback, two servers in a group, UDP reachable, clocks synced. Traps: shared-secret mismatch (silent rejects), firewall eating UDP 1812. Test live: test aaa group radius user pass legacy.