Two ways for your gear to reach your instance
Gear that speaks RadSec connects straight to your instance, encrypted with TLS. Gear that only speaks RADIUS over UDP connects to a RADIUSaaS proxy near your site, which carries the request the rest of the way over RadSec. Your instance itself accepts RadSec only.
- RadSec on TCP 2083
- RADIUS on UDP 1812/1813
- 19 proxy regions
- two proxies included
RadSec straight to your instance
- Dedicated DNS name and public IP per instance
- Maximum TLS version for RadSec and for the EAP tunnel, each set on its own: TLS 1.2 or 1.3
- RadSec CAs managed apart from your client CAs, or trusted for both
Proxies for gear that only speaks RADIUS
- One proxy per region, so every proxy you add covers another region
- Each proxy has a dedicated fixed public IP; removing a proxy releases it
- The certificate between proxies and your instance is issued and renewed by RADIUSaaS
Proxies in 19 regions on six continents
Put a proxy close to the sites it serves, in any of the 19 regions below. This doesn't affect where your instance is hosted: that's the hosting location you chose for it (Australia, the European Union, the United Kingdom or the United States).
| Continent | Regions |
|---|---|
| Africa | Johannesburg |
| Asia | Bangalore, Osaka, Seoul, Singapore, Tel Aviv, Tokyo |
| Australia | Melbourne, Sydney |
| Europe | Frankfurt, London, Madrid, Stockholm |
| North America | Dallas, New York, Seattle, Toronto |
| South America | Santiago, São Paulo |
How many proxies you need
Our recommendation by licensed users. Sites spread across continents may need more.
| Users | Proxies |
|---|---|
| up to 2,500 | 2 |
| up to 10,000 | 3 |
| up to 25,000 | 4 |
| up to 50,000 | 6 |
| up to 100,000 | 10 |
One proxy handles 1,500 concurrent connections, 10,000 authentications per minute. Above 1,000 users, spread your controllers across the proxies by giving them different server orders.
What happens when a proxy or an endpoint goes down
Proxies cover for each other
Configure two proxies as primary and secondary RADIUS server on your gear, ideally in different regions. If one stops answering, your gear moves to the other.
Proxies find a healthy instance
With more than one RadSec endpoint, your proxies know all of them and their health, and switch to the nearest one that answers.
RadSec gear switches itself
Access points that use RadSec directly get both addresses of your instance and fail over on their own; RADIUSaaS doesn't redirect them. Use IP addresses rather than DNS names here.
A second RadSec endpoint
For higher redundancy, your instance can get an additional RadSec endpoint with its own IP, at extra cost.
Setup guides for your access points and switches
Step-by-step guides in the documentation. Any gear that speaks RADIUS or RadSec with EAP works; these are the ones we have written up.
Straight to your instance
Access points and controllers that speak RadSec, set up against your instance's address on TCP 2083.
- Aruba
- Fortinet
- Juniper Mist
- Meraki
- MikroTik
- Ruckus
- UniFi
Through a RADIUSaaS proxy
Gear that sends RADIUS over UDP, set up against the fixed IPs of your proxies and your shared secret.
- ExtremeCloud IQ CoPilot
- Meraki
- Sophos UTM
- UniFi
Wi-Fi and wired profiles for your devices
- WPA2- and WPA3-Enterprise, including 192-bit mode
- Ready-made profiles that trust the certificates you selected
- The wired profile needs no SSID and applies to every wired interface
Point one access point at your instance
Start a trial, point one access point at your instance or at a proxy, and watch the first authentication arrive in the log.