TLDR
- RADIUS needs UDP 1812 (authentication) and UDP 1813 (accounting) from each NAS to the AAA server, UDP 3799 from the AAA server back to each NAS, and TCP 2083 for RadSec.
- The AAA server identifies each client by source IP address (RFC 2865 §3), so network address translation (NAT) on the path breaks client lookup.
- RadSec (RADIUS over Transport Layer Security, or TLS, on TCP 2083) identifies clients by certificate, which suits NAT and cloud paths.
RADIUS needs UDP 1812 and 1813 open from every network access server (NAS) to the AAA (authentication, authorization, and accounting) server. It also needs UDP 3799 open in the opposite direction, plus TCP 2083 where RadSec is used. The full set of RADIUS firewall rules:
RADIUS ports to open: the four flows a firewall must allow
Each of the four RADIUS flows needs a rule on every firewall it crosses. Authentication uses UDP 1812 (RFC 2865 §3), accounting uses UDP 1813 (RFC 2866 §3), and CoA and Disconnect use UDP 3799 (RFC 5176 §2.3). Replies return on swapped ports.
| Flow | Source | Destination | Protocol and port | Messages | Defined in |
| Authentication | NAS | AAA server | UDP 1812 | Access-Request; Access-Accept, Access-Reject, or Access-Challenge | RFC 2865 §3 |
| Accounting | NAS | AAA server | UDP 1813 | Accounting-Request; Accounting-Response | RFC 2866 §3 |
| CoA and Disconnect | AAA server | NAS | UDP 3799 | CoA-Request or Disconnect-Request; ACK or NAK | RFC 5176 §2.3 |
| Proxy | AAA proxy | Remote AAA server | UDP 1812 and 1813, or TCP 2083 | Same messages, per hop | RFC 2865 §2.3; RFC 6614 §2.1 |
Authentication and accounting: NAS to AAA
Both flows start at the NAS, so the AAA-side firewall needs inbound rules from every NAS source address. The Internet Assigned Numbers Authority (IANA) lists the ports as radius and radius-acct.
Stateful inspection, where the firewall tracks each request and admits the matching reply, handles replies without extra rules. A stateless access list needs mirror rules from source ports 1812 and 1813 back to the NAS.
Older firmware may use the early ports UDP 1645 and 1646 (RFC 2865, RFC 2866), so open them only if your inventory needs them. For packet-level background, see how the RADIUS protocol works.
CoA and Disconnect on UDP 3799: the flow that runs the other way
Change of Authorization modifies a live session, such as a speed tier, and Disconnect-Request ends one. CoA traffic flows from the AAA server to the NAS on UDP 3799, the opposite direction to authentication.
A stateful firewall has no state for this flow, because the NAS never sent anything to port 3799. The RADIUS CoA path needs its own inbound rule toward each NAS.
In deployments we see 3799 left out of firewall change requests more often than any other RADIUS rule. Authentication works on day one, so nobody notices until the first plan upgrade fails.
RFC 5176 §1.3 calls the CoA sender the dynamic authorization client. The NAS picks the shared secret by the CoA source address (§2.3), so CoA must leave from an address the NAS knows.
Check each NAS’s listening port; some older equipment uses a non-standard default. The rule set by segment:
RADIUS behind NAT
NAT rewrites the source address of packets that cross it. RADIUS relies on that address to identify the client and pick its secret.
Why the source IP is the RADIUS client identity
RFC 2865 §3 requires the server to choose the shared secret by the packet’s source IP address. Requests from unknown addresses are silently discarded (§2), and NAS-IP-Address and NAS-Identifier must not select the secret (§5.4, §5.32).
Behind NAT, the RADIUS client IP address the server sees is the translated one. It matches nothing in the client table, so the request is dropped and the NAS times out:
Oct 14 09:42:17 aaa-node-1 radius: ignoring Access-Request from unknown client 198.51.100.24 port 40512
Port address translation is worse: several NASes collapse into one client entry with one secret, and CoA cannot reach them without static mappings.
Option 1: no NAT on the NAS-to-AAA path
Route NAS addresses to the AAA server unchanged and exempt RADIUS from NAT on shared firewalls. Across networks you don’t control, use an IPsec tunnel that preserves inner addresses, as RFC 5176 §6.2 recommends for dynamic authorization.
Option 2: NAS-Identifier mapping
Where NAT cannot be removed, such as tower NASes behind a wireless ISP’s carrier-grade NAT, register the translated address as one client. Those NASes share one secret, and the AAA server tells them apart by NAS-Identifier (RFC 2865 §5.32), which must be unique per NAS.
Treat it as a stopgap. NAS-Identifier is self-asserted, and RFC 6614 §2.4 calls a secret shared across clients inherently insecure. CoA still needs a static mapping per NAS.
Option 3: RadSec
RadSec carries RADIUS inside TLS on TCP 2083, one port for every packet type (RFC 6614 §2.1). The server identifies clients by certificate or TLS pre-shared key (TLS-PSK) instead of source address (§2.4), so NAT no longer breaks client identity.
The NAS opens the connection outbound, which NAT handles like any client session. RFC 6614 §2.5’s example packet lists show a RADIUS/TLS server sending Disconnect-Request on accepted connections, but the RFC never defined how that works. draft-ietf-radext-reverse-coa (IESG-approved, awaiting publication) defines ‘reverse CoA’ for both CoA-Request and Disconnect-Request over RADIUS/(D)TLS.”
That draft is approved but not yet an RFC, so confirm NAS support before dropping the 3799 rule. Status-Server watchdog packets (RFC 5997) or TCP keepalives keep the connection open through firewall idle timers.
| Option | AAA identifies the NAS by | Shared secret | CoA path | Use when |
| No NAT on the path | Source IP address | One per NAS | Direct, UDP 3799 | You control routing or can use IPsec |
| NAS-Identifier mapping | Translated address, then NAS-Identifier | Shared behind the address | Static mapping per NAS | NAT cannot be removed yet |
| RadSec | Certificate or TLS-PSK identity | Fixed; TLS authenticates each NAS | The NAS’s own connection | Crossing sites, partners, or the internet |
Multi-homed NAS and the RADIUS source interface
A multi-homed NAS, with several uplinks or a management port, has a milder NAT problem: its source address can change.
Symptom: requests from an unknown client
By default the NAS sources RADIUS from whichever interface routing picks. A link failure can shift requests to an address the AAA server has never seen. The server discards them or fails the secret check, and the firewall blocks them.
The fault appears only after topology changes, so it looks intermittent. All the NAS reports is a RADIUS connection timeout.
Fix: pin one source address
Set the IP RADIUS source interface to a stable loopback reachable over any uplink. Use that address in the AAA client table, every firewall rule, and NAS-IP-Address (RFC 2865 §5.4), then fail an uplink to test.
On the AAA side, CoA from a clustered platform must leave from an address every NAS lists as a dynamic authorization client (RFC 5176 §6.1).
RADIUS across proxies, second data centers, and cloud AAA
Each RADIUS proxy ends one client-server relationship and starts another (RFC 2865 §2.3), so every hop needs its own client entry, secret, and rules. CoA runs the chain in reverse (RFC 8559); open 3799 at each hop toward the NAS.
A second site needs the full rule set in both directions. Keep replies on the request’s path; stateful firewalls drop replies they hold no state for.
A regional ISP adds a second AAA data center, and its BNGs (broadband network gateways) fail over cleanly. Weeks later, speed upgrades for sessions anchored there stop applying.
The point-of-presence firewalls permit 3799 only from the original site, and the BNGs list only that site as a dynamic authorization client. The fix is one rule and one client entry per BNG, with a separate secret for the new site (RFC 5176 §6.1). See our guide to multi-site AAA deployment.
Cloud AAA crosses networks you don’t control. The IETF’s draft-ietf-radext-deprecating-radius-10 (3 July 2026, work in progress) would deprecate insecure RADIUS/UDP and RADIUS/TCP use and mandate TLS support. Use RadSec or IPsec, then remove the UDP fallback, which RFC 6614 §6 warns invites downgrade attacks.
Alepo AAA Server supports on-premises, cloud, and hybrid deployment with geo-redundancy and 99.999% availability, according to the AAA Server datasheet. Compare the AAA server deployment options before drawing firewall segments.
FAQs
Q1. Which ports does RADIUS need open on a firewall?
UDP 1812 and 1813 from each NAS to the AAA server, UDP 3799 back to each NAS, and TCP 2083 for RadSec. Replies return statefully.
Q2. Does RADIUS work through NAT?
Not reliably over UDP, because the server picks the secret by source IP address (RFC 2865 §3). Remove NAT, tunnel through IPsec, or use RadSec.
Q3. Why is CoA blocked when authentication works?
CoA runs from the AAA server to the NAS on UDP 3799 (RFC 5176 §2.3), so authentication’s firewall state doesn’t cover it. Add an inbound rule toward each NAS.
Q4. What is a RADIUS source interface?
The NAS setting that fixes which local address RADIUS packets leave from. Pinning it to a loopback keeps the client table, firewall rules, and NAS-IP-Address consistent.
Q5. Should RADIUS cross the internet unencrypted?
No. RADIUS/UDP hides User-Password (RFC 2865 §5.2) but leaves usernames and most other attributes readable. Use RadSec or IPsec (RFC 5176 §6.2).
Q6. Which port does RadSec use?
TCP 2083, for every packet type (RFC 6614 §2.1). Its standards-track successor, draft-ietf-radext-radiusdtls-bis-18 (30 September 2026), is in Internet Engineering Steering Group review and also covers UDP 2083 for Datagram TLS (§3.1).
Q7. How long should a firewall keep RADIUS UDP state?
Longer than the slowest reply, including proxy hops. Retransmissions reuse the source port (RFC 2865 §2.5), and accounting retransmits until acknowledged by default (RFC 5080 §2.2.1). Short timers and asymmetric routing show up as a RADIUS connection timeout.
Before you submit the RADIUS firewall change
Most failures in this guide come down to direction and identity. Before the change goes in, confirm that every NAS reaches every AAA site on UDP 1812 and 1813. Every AAA site should also reach every NAS on UDP 3799.
Then check identity. Each NAS should send RADIUS from one pinned address that matches the AAA client table and the firewall rules. Where a path crosses NAT, a partner network, or the internet, plan the move to RadSec now, because NAS-Identifier mapping only buys time.
Planning a second site or cloud AAA? See how Alepo AAA Server handles geo-redundant, multi-site and cloud deployments.
Book a demo and talk to an expert about multi-site or cloud AAA.
