RADSec: RADIUS over TLS
RADIUS was designed for two devices in the same building. It uses a shared secret to hide one attribute, the password field, and sends everything else unencrypted. That was fine on a local network. It is not good enough across the internet.
With EAP-TLS, plain RADIUS does not expose your certificates. The credential exchange happens inside EAP-TLS’s own TLS handshake, so it is protected either way. What plain RADIUS leaves readable is everything around it.
RADSec is the same RADIUS conversation carried inside a TLS connection on port 2083. Your equipment opens the connection outbound and keeps it open. Everything in it is encrypted, both ends prove who they are with certificates instead of a shared password, and no inbound port is needed.
What it fixes
- No more relying on a shared secret
- In plain RADIUS, the shared secret protects one attribute and is the only proof that a request came from your equipment. It is the same on every switch and access point at the site, and it is rarely changed. In RADSec the connection is authenticated with a certificate, issued and revoked per site.
- The metadata is encrypted
- Plain RADIUS sends who is connecting, from which device, through which access point or switch, onto which network, and which VLAN they get, all unencrypted. Your certificates are safe either way, but over the internet that metadata shows who works where.
- No port to forward
- Your equipment connects out to Passbeam and keeps the connection open. Nothing at the site listens for incoming traffic, so there is no firewall rule to add.
- A dropped connection is visible
- A TLS connection is either up or down. Plain RADIUS runs over UDP, where a lost request and a refused one look the same to your equipment. That makes outages much harder to diagnose.
Equipment support
Not all equipment supports RADSec. Cisco Catalyst 9000, ArubaOS-CX, Junos and Arista EOS all support it on wired ports, and most current access points offer it. UniFi switches, Meraki’s MS switches and a lot of older equipment support standard RADIUS only. Check your own equipment before you plan around RADSec.
Passbeam accepts both, on the same endpoints, and a site can use either or both. Standard RADIUS is fully supported, and the knowledge base explains whether it is safe enough.
For failover, add a second server to your equipment. Equipment keeps its RADSec connection open and does not look up DNS again, so a DNS record with a short time-to-live will not move it to another server.
How a shared endpoint knows who is calling
Passbeam’s endpoints are shared by all customers, so each connection has to be matched to the right organisation before any RADIUS data is read. Otherwise one customer’s log could show another’s authentications.
Passbeam uses the client certificate presented during the TLS handshake. Each site has its own, issued by Passbeam and installed on that site’s equipment. It identifies both the organisation and the site, so the log shows which office each authentication came from.
The source IP address is not used to identify a site. Dynamic addresses change, sites with two internet lines switch between them, and two customers on the same provider can share an address. For standard RADIUS, which has no client certificate, the registered addresses identify the site and the shared secret authenticates each request.
What you configure
Passbeam generates two things for each site: the client certificate your equipment presents, and the trust bundle that lets it accept Passbeam’s certificate. Where they go depends on the make. Cisco uses a trustpoint, Arista an SSL profile, and Junos a server marked RadSec. UniFi shows a checkbox labelled TLS and never uses the word RADSec. Your site’s Connect tab shows the values and the setting names for Cisco, HP / Aruba, Arista, Juniper, Meraki and UniFi.
Which to use? Whichever your equipment supports, and both if you have a mix. More in the knowledge base.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.