When setting up a Wi-Fi network at home, you typically set up an SSID and password, accept the defaults for any other options, and be done with it. (In some cases, these are done for you by your service provider — you don’t even have to think.) You share the password with family and visitors, and everyone is happy.
Corporate Wi-Fi security is a bit different. If you set up a Wi-Fi network for your business with a single password for all staff and visitors, that password eventually leaks out, and people (former employees, suppliers, and snoops of all kinds) can log on to your Wi-Fi network any time. The situation is especially bad if the Wi-Fi network gives users access to sensitive information, such as financials, intellectual property, and customer records. You could change the Wi-Fi password occasionally, but then you have to give it to all the staff so they can log in again, and the problem starts all over.
Why your business needs a wireless RADIUS server
A wireless RADIUS server provides centralized authentication, authorization, and accounting for network access. This means you can control who connects to your Wi-Fi network and what network resources they can access, all while tracking usage. By implementing RADIUS authentication, you eliminate the security vulnerabilities that come with password sharing and gain fine-grained control over user access to your wireless network.
Key benefits of RADIUS authentication for Wi-Fi networks
Before delving into what RADIUS is and how it works, let’s take a look at what it buys you:
- Individualized authentication. Each user (or device) is assigned unique credentials for accessing the Wi-Fi network. No more password sharing, as each user manages their own credentials.
- Sync with LDAP/Active Directory. The system can be set up so that the users’ network directory passwords are used to authenticate on the Wi-Fi network, enabling single sign-on for users.
- Wide range of implementation options. RADIUS can be implemented as a dedicated on-premises server, using purchased RADIUS server software or a free/open-source option such as FreeRADIUS. Many network devices and server operating systems have RADIUS built in, so no extra software or hardware purchase is needed. There are also cloud-based RADIUS services available, which can free you from the system setup and maintenance tasks altogether. This is very attractive to smaller organizations with limited (or nonexistent) IT staff and budget.
How wireless RADIUS server authentication works
RADIUS, in case you’re wondering, stands for “remote authentication dial-in user service.” It’s an authentication system that has been used to secure networks for many years (hence the “dial-in” in the name). A wireless RADIUS server uses a protocol called 802.1X, which governs the sequence of authentication-related messages that go between the user’s device, the wireless access point (AP), and the RADIUS server.
When a user wants to connect to a Wi-Fi network with RADIUS authentication, the device establishes communication with the AP and requests access to the network. The AP passes the request to the RADIUS server, which returns a credential request back to the user via the AP. The user provides the proper user name and password, which the RADIUS server checks against the authentication directory. If the credentials are correct, the RADIUS server informs the AP to allow the user access to the network.
Step-by-step: Setting up a RADIUS server for wireless authentication
Setting up a wireless RADIUS server involves several key steps:
- Choose your RADIUS server software (FreeRADIUS is a popular open-source option).
- Install the RADIUS server on your chosen operating system.
- Configure the server to communicate with your authentication database.
- Set up a shared secret between your wireless access points and the RADIUS server.
- Configure your wireless access points to use RADIUS authentication.
- Test the authentication process with sample user credentials.
- Deploy to your user base with proper documentation.
This process varies depending on your network environment and requirements.
Choosing between on-premises and cloud-based RADIUS server solutions
As mentioned above, implementing a wireless RADIUS server can be simple or complex, and the implementation path you choose depends largely on the size of your organization (that is, the number of users and devices you need to support), your budget, and the expertise of your IT staff. An on-premises solution involves a good bit of setup, but it might be more cost-effective than a hosted solution if you have a large number of users. If you decide on an on-premises solution, but lack the resources to pull it off, InkBridge Networks can help you install, set up, and manage a FreeRADIUS system for your wireless (or any other) network.
These days, hackers are looking for any way into organizations large and small, and they know that many Wi-Fi networks are vulnerable. Failing to protect your business from Wi-Fi vulnerabilities is inexcusable. If you haven’t implemented RADIUS authentication for your Wi-Fi network, the time to act is now. It’s easier than you think.
Need more help?
InkBridge Networks has been helping clients around the world design and deploy their RADIUS infrastructure for 20 years. We specialize in complex systems and have seen pretty much every variation and problem when configuring RADIUS server for wireless authentication. If you want help from the people who wrote FreeRADIUS, request a quote for network security solutions here.
Related Articles
Authorized users only: Why use RADIUS and 802.1x to control network access?
Controlling which users and what devices are on your network has become significantly more complex in the current corporate environment. Network administrators must adapt to wireless access, remote working, bring-your-own-device scenarios and cloud computing. Each employee could have multiple devices using different operating systems.
Don't "Set it and Forget it"
So you decided that whatever you were using for network security wasn’t getting the job done… Either it didn’t scale with the growth in your user base, devices, or network design, or it was hindering your organization’s productivity. Or maybe you suffered a security breach. Whatever the case, you decided to make the jump to RADIUS authentication, and you’ve implemented a RADIUS server.