RADIUS is a centralized AAA protocol that authenticates, authorizes and logs users (e.g. 802.1X, VPN, device login) via an external server.

Facts

Element	Value
Standard	RFC 2865 / 2866
Transport	UDP
Ports	1812 authentication, 1813 accounting (legacy 1645/1646)
Encryption	Only the password field is encrypted
Model	Client/server (NAS = Network Access Server)

Why does it exist?

Without RADIUS: local users on every device, no central control or logging, weak compliance. Typical scenarios: 802.1X port auth, VPN login, device admin, wireless.

How it works

1. Initiation: user logs in (SSH/802.1X/VPN)
2. Authentication: device sends Access-Request (UDP 1812) with username, encrypted password, NAS IP, attributes; server answers Access-Accept / Reject / Challenge
3. Authorization: server returns attributes – VLAN, privilege level, ACL, session timeout
4. Accounting (CCNP): Accounting-Start / Stop / Interim-Update to UDP 1813 – compliance, logging, billing, auditing

RADIUS vs TACACS+

Feature	RADIUS	TACACS+
Transport	UDP	TCP 49
Encryption	Password only	Entire payload
AAA separation	Combined	Separate
Device admin	OK	Better – ENCOR prefers TACACS+ for device administration

Configuration

Basic (CCNA):

aaa new-model
radius server RADIUS1
 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
 key Cisco123
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
line vty 0 4
 login authentication default
 transport input ssh

Advanced – multiple servers + failover:

radius server RADIUS2
 address ipv4 10.10.10.11
 key Cisco123
aaa group server radius RAD-GROUP
 server name RADIUS1
 server name RADIUS2
aaa authentication login default group RAD-GROUP local

Verification & troubleshooting

show aaa servers
show radius statistics
test aaa group radius username password legacy
debug radius authentication
debug aaa authentication

Symptom	Cause	Solution
Login fails	Shared secret mismatch	Fix the key
Timeout	Firewall blocking	Open UDP 1812/1813
Fallback to local	Server down	Check reachability

Design & best practices

• Always configure local fallback · server redundancy · management VRF · NTP · prefer TACACS+ for device admin

Exam tips ⚠️

• RADIUS = UDP, TACACS+ = TCP 49 · 1812 auth / 1813 accounting · password-only encryption · “centralized auth for wireless clients” → RADIUS

RADIUS + 802.1X deep dive (ENCOR)

802.1X is port-based network access control: the client authenticates via EAP, transported EAPOL (L2) between client and switch, and RADIUS (UDP 1812) between switch and server.

Role	Who	Function
Supplicant	Client (PC)	Starts authentication
Authenticator	Switch/AP	Controls the port
Authentication server	RADIUS (e.g. ISE)	Validates credentials

Flow: link up → switch sends EAP-Request/Identity → client answers EAP-Response/Identity → switch wraps it in Access-Request → server Access-Challenge … → Access-Accept with attributes (VLAN, ACL, privilege, timeout) → port authorized.

EAP type	Security	Description
EAP-MD5	Low	Password only
PEAP	High	TLS tunnel + password
EAP-TLS	Very high	Certificate-based – most secure (mutual auth)
EAP-FAST	Cisco	PAC-based

Port states: unauthorized (EAPOL only), authorized, force-authorized, force-unauthorized. MAB (MAC Authentication Bypass): if the client doesn’t speak 802.1X, the switch sends the MAC as username/password – typical for IoT/printers; 802.1X → MAB fallback is a CCNP trap.

aaa new-model
radius server ISE
 address ipv4 10.10.10.10
 key Cisco123
aaa group server radius RAD-GROUP
 server name ISE
aaa authentication dot1x default group RAD-GROUP
aaa authorization network default group RAD-GROUP
aaa accounting dot1x default start-stop group RAD-GROUP
dot1x system-auth-control
!
interface Gig1/0/10
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
! MAB fallback:
 authentication order dot1x mab
 authentication priority dot1x mab
 mab
! if RADIUS dies:
 authentication event server dead action authorize vlan 999
! periodic reauth:
 authentication timer reauthenticate 3600
! voice + data on one port:
 authentication host-mode multi-domain

show authentication sessions
show dot1x interface
show radius statistics
debug dot1x all

Best practice: EAP-TLS where possible, MAB fallback, guest VLAN, critical VLAN, reauth timers, ISE profiling.