AAA and RADIUS Fundamentals

In modern network engineering, you cannot rely on simple, shared passwords for network access. This is where AAA and RADIUS come in.

What is AAA?

AAA is an architectural framework used to control and track who is on your network. It stands for:

1. Authentication (Who are you?): Verifying the identity of a user or device. (e.g., verifying a username and password, or checking a digital certificate).
2. Authorization (What are you allowed to do?): Once authenticated, this dictates what resources the user can access. (e.g., placing the user into a specific VLAN, or assigning a bandwidth limit).
3. Accounting (What did you do?): Tracking network resource consumption for auditing or billing. (e.g., logging how many gigabytes a user downloaded, or exactly what time they logged in and out).

What is RADIUS?

Remote Authentication Dial-In User Service (RADIUS) is the most common networking protocol used to implement AAA.

Instead of configuring a user account on every single router, switch, and Wi-Fi access point in your company, you configure them all to point to a central RADIUS Server (like FreeRADIUS, Windows NPS, or Cisco ISE).

How it works (The RADIUS Flow)

1. A user connects to a Wi-Fi Access Point (the Authenticator) and types in their password.
2. The Access Point does not know if the password is correct. It wraps the credentials in an Access-Request packet and forwards it to the RADIUS Server.
3. The RADIUS Server checks its database (often Active Directory).
4. The RADIUS Server replies with an Access-Accept (with instructions like “Put this user on VLAN 20”) or an Access-Reject.

Where is RADIUS used?

• Enterprise Wi-Fi (802.1X): WPA2/WPA3-Enterprise uses RADIUS.
• Wired 802.1X: Switches use RADIUS to verify a PC before turning the port on.
• VPNs and PPPoE: VPN gateways and ISP core routers use RADIUS to authenticate remote workers and home broadband users.
• Hotspots: Captive portals in hotels and airports use RADIUS to authenticate guests and bill them for time/data used.