RADIUS or RADSec — which should I use?

Use RADSec if your equipment can. Use standard RADIUS if it cannot — which, today, means every wired switch.

RADSec is RADIUS inside a TLS connection. The whole exchange is encrypted, both ends authenticate with certificates, and the site's equipment opens the connection outbound to us — so there is no inbound port at the client's site, nothing to forward, and nothing exposed. It also holds the connection open, which makes authentication fast: a warm connection answers a join in a couple of seconds.

Standard RADIUS is the original 1997 protocol. It runs over UDP, and the only thing protecting it is a shared secret and an MD5-based obfuscation of the password field — the rest of the packet, including usernames and device identifiers, travels in the clear. For EAP-TLS the actual credentials are inside the TLS handshake and are not exposed by this, which is what makes it acceptable; but the metadata is, and the shared secret is a single word that anybody who reads the switch config now knows.

So the trade is simple. RADSec: encrypted, certificate-authenticated, no inbound port, and faster on a warm connection. Standard RADIUS: works on hardware that has never heard of RADSec, needs the shared secret kept as carefully as a password, and is the only way to get 802.1X onto a switch port today.

Note that wireless is not tied to RADSec. Plenty of access points speak plain RADIUS and nothing else, and a UniFi SSID can use either — so a site with older access points can run its wireless over standard RADIUS perfectly well. These are two transports rather than two kinds of equipment, which is why they are not labelled wireless and wired.

It is a per-site setting, on the site's Transports tab, and a site can use both at once — RADSec for the access points, standard RADIUS for the switches. That is the normal arrangement for a business with both, and it is what we run ourselves.