Configure the RADIUS device (ports, timeouts and accounting)

After registering the client, configure the device (the NAS: VPN, firewall or Wi-Fi controller). Menus depend on the vendor; use these values.

Address and ports

The address is your organization's service address, given by your provider. On the shared platform, the provider allows your devices' address ranges.

Values on the device

• Shared secret (UDP): the secret shown once in the console.
• Message-Authenticator: turn it on (RFC 3579).
• User-Name: the person's email in the organization.
• Timeout: at least the phone-approval wait plus 5 seconds, with a single retry. A retransmission of a pending request is not decided twice.
• Password protocol: PAP. CHAP, MS-CHAP and EAP are not accepted.

RadSec

1. The device presents a client certificate; register its SHA-256 in «Certificate SHA-256».
2. The device must trust the RadSec server's certificate (ask your provider for the chain).
3. Use TLS 1.3. Old firmware that only speaks TLS 1.2 needs the provider to allow it.

Accounting

The device may send start, interim and stop records. They are kept for 180 days, stored once per content (retransmissions do not duplicate) and linked to the person through the Class attribute.

Testing

1. Test with one account that has an authenticator app and another with a phone.
2. Check the decision under «Operate» › «Audit» (radius.classic.access).
3. If the RadSec connection fails, see RadSec certificate problems.