---
title: "RADIUS server and its functions"
subject: "Internet and Intranet"
chapter: 5
key: "semester_8/internet_and_intranet:radius-server-functions"
source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/radius-server-functions
site: BCT Engineering
---

# RADIUS server and its functions

Internet and Intranet · Chapter 5: Designing Internet Systems and Servers

- Asked in: 2074 Bhadra, 5 marks
- Video: [How RADIUS Server Works - Understanding AAA Concepts !](https://www.youtube.com/watch?v=TuOvWRoG1KA) — Let's Do RnD
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/radius-server-functions
- Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-5

## Question

Explain RADIUS server with its functions.

## Short answer

A RADIUS server provides centralized AAA: authentication via PAP/CHAP/EAP, authorization with attributes like IP/VLAN/limits, and accounting for billing. It also centralizes user management and can proxy requests to other RADIUS servers, e.g. for roaming.

## Answer

**RADIUS (Remote Authentication Dial-In User Service)** is a networking protocol and server (RFC 2865/2866, UDP 1812/1813) that gives centralised **Authentication, Authorization and Accounting (AAA)** for users connecting to a network. Instead of storing user accounts on every dial-up server, VPN gateway, router or Wi-Fi access point, they are kept at one RADIUS server (or in LDAP/Active Directory behind it).

```text
 User --> [NAS: AP/VPN/dial-up] --RADIUS--> [RADIUS server]
                 (RADIUS client)                  |
                                              user database
```

**Working:** the user connects and gives credentials. The Network Access Server (NAS), acting as RADIUS client, sends an **Access-Request**. The server checks the database and replies **Access-Accept**, **Access-Reject** or **Access-Challenge**. The NAS then lets the user in with the stated settings. The shared secret between NAS and server protects the messages.

**Functions**

1. **Authentication:** verifies identity using PAP, CHAP, MS-CHAP or EAP (802.1X for Wi-Fi and wired ports).
2. **Authorization:** decides what the user may do and sends attributes: IP address to assign, VLAN, session timeout, access lists, bandwidth limits, allowed services.
3. **Accounting:** records session start and stop, duration, bytes in/out and the user's identity (Accounting-Request), used for billing, auditing and usage reports.
4. **Centralised management:** one place to add, change or disable users for many access devices.
5. **Proxying:** can forward requests to other RADIUS servers (realms), supporting roaming between organisations (e.g. eduroam).

Typical uses: ISPs, hotspots, corporate Wi-Fi, VPNs. Open source server: FreeRADIUS.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Why use a RADIUS server instead of storing accounts on each access device?
   A. It makes the connection faster than any local login
   B. User accounts are kept at one place for many dial-up, VPN and Wi-Fi devices
   C. It removes the need for passwords
   D. It replaces the firewall
   Answer: B. Centralised storage lets one place add, change or disable users for many access devices. (Key point: Central idea)

2. Which is an example of an authorization attribute sent by RADIUS?
   A. Session bytes in and out
   B. Shared secret
   C. Assigned VLAN or IP address, session timeout, or bandwidth limit
   D. Packet checksum
   Answer: C. Authorization decides what the user may do and sends attributes such as IP, VLAN, timeout and limits. (Key point: Authorization)

3. What is the purpose of RADIUS accounting?
   A. Recording session start/stop, duration and bytes for billing, auditing and reports
   B. Verifying the user's password
   C. Assigning the VLAN
   D. Encrypting the Wi-Fi link
   Answer: A. Accounting records usage details through Accounting-Request messages. (Key point: Accounting)

4. Which are the possible replies to an Access-Request?
   A. Hit, Miss, Refresh
   B. Access-Accept, Access-Reject or Access-Challenge
   C. Ack, Nack, Retry
   D. Allow, Deny, Log
   Answer: B. The server answers Access-Accept, Access-Reject or Access-Challenge. (Key point: Server replies)