RADIUS: Why Enterprise WiFi Asks for a Username
Enterprise WiFi often requires users to provide a username and password, a practice that can be confusing if you're not familiar with the underlying technology. This document explains what RADIUS is, how it works, and why it's used in enterprise networks.
What is RADIUS?
RADIUS (Remote Authentication Dial-In User Service) is an authentication protocol used by network gear to determine whether a user or device should be granted access. It operates over UDP ports 1812 for authentication and 1813 for accounting, making it one of the oldest protocols in use today.
The AAA Framework
RADIUS implements the AAA (Authentication, Authorization, Accounting) framework:
- Authentication: Verifying who the user is.
- Authorization: Determining what resources the user can access.
- Accounting: Logging usage details for auditing and billing purposes.
This framework is commonly used in enterprise networks to manage access control effectively.
The Flow of RADIUS Authentication
The typical flow when connecting to an enterprise WiFi network involves several steps:
- Association: A laptop associates with a WiFi Access Point (AP).
- Credential Forwarding: The AP, which acts as the Network Access Server (NAS), forwards the user's credentials to a RADIUS server.
- Authentication Check: The RADIUS server checks the credentials against an authentication backend, such as LDAP or Active Directory.
- Response: Based on the check, the RADIUS server responds with either "accept" or "reject," and may include additional attributes like VLAN assignment.
The AP never learns the user's password; it only relays the information to the RADIUS server for verification.
Home WiFi vs. Enterprise WiFi
Home WiFi
Home WiFi typically uses WPA2/3-Personal, where a single shared password is used for all devices. This means that anyone with the password can access the network, and changing the password requires reconfiguring every device on the network.
Enterprise WiFi (802.1X)
Enterprise WiFi uses 802.1X, which requires each user to authenticate individually using their own credentials via RADIUS. This provides several benefits:
- User-specific Access: Each user can be revoked or granted access independently.
- Per-user VLANs: Different users can be assigned different network segments based on their roles.
- No Shared Secret: There is no single password that everyone shares, making the network more secure.
This is why enterprise WiFi often asks for a username and password during connection.
802.1X Bonus: Wired Switch Ports
The same mechanism used in wireless networks can also be applied to wired switch ports through port-based network access control (PNAC). This ensures that unknown devices connected via Ethernet are not granted full network access, providing an additional layer of security.
Homelab Reality
Implementing RADIUS in a home lab is possible with tools like FreeRADIUS or authentik. While FreeRADIUS offers powerful features but can be complex to configure, it's worth considering if you need per-user WiFi, VLAN steering, or the resume line on your CV. For IoT devices that cannot handle 802.1X authentication, MAC address-based authentication is a pragmatic compromise.
Setup in broad strokes: with FreeRADIUS you define each access point in clients.conf (its IP plus a shared secret), point the server at your user store (a local users file, SQL, or LDAP), and enable an EAP method — PEAP-MSCHAPv2 is the common denominator most devices speak. With authentik, you create a RADIUS provider tied to its built-in user database, trading FreeRADIUS's flexibility for a much gentler learning curve. Either way, the access point side is identical: switch the SSID to WPA2/3-Enterprise and enter the RADIUS server's address and secret.