TLDR
- Access points, WLCs and hotspot gateways are RADIUS clients, authenticating on User Datagram Protocol (UDP) port 1812 and accounting on 1813 (RFC 2865, Section 3; RFC 2866, Section 3).
- Crowd surges and controller restarts set the capacity you need.
Wi-Fi RADIUS authentication is how an access point or wireless LAN controller (WLC) passes a device’s login request to a RADIUS server. The server answers with Access-Accept, Access-Reject or Access-Challenge (RFC 2865, Section 4). Carriers pick the method per network name (SSID): captive portal with Change of Authorization (CoA), 802.1X enterprise, SIM-based EAP-AKA’ offload or Passpoint realm routing.
RADIUS (Remote Authentication Dial In User Service) is defined in Request for Comments (RFC) 2865. Unlike a single office SSID, carrier Wi-Fi authentication handles shared access points, roaming subscribers and stadium-sized login surges; our carrier Wi-Fi best practices guide covers the operating checklist.
How Wi-Fi authentication uses RADIUS
The access point, WLC or gateway is the RADIUS network access server (NAS). On 802.1X SSIDs it relays Extensible Authentication Protocol (EAP) messages inside EAP-Message attributes (RFC 3579, Section 3.1). Access points therefore need no update when the authentication, authorization and accounting (AAA) server adds a method.
For the basics, see how the RADIUS protocol secures telecom networks. A typical carrier 802.1X login goes like this:
- The device associates, and the access point starts IEEE 802.1X by asking for its identity.
- The NAS sends an Access-Request whose Called-Station-Id holds the access point’s media access control (MAC) address plus the SSID (RFC 3580, Section 3.20), so one RADIUS server can apply per-SSID policy.
- The server and the device run the EAP method through Access-Challenge rounds (RFC 2865, Section 4.4).
- The server returns Access-Reject, or Access-Accept with keying material and policy such as Session-Timeout (RFC 2865, Section 5.27).
- The NAS opens accounting with an Accounting-Request (Acct-Status-Type Start), then sends Interim-Update and Stop records (RFC 2866, Section 5.1).
Figure 1. Wi-Fi RADIUS authentication and accounting on a carrier SSID
Wi-Fi RADIUS accounting and CoA
Accounting feeds billing, quota tracking and partner settlement. RFC 2869 sets a 60-second floor for Acct-Interim-Interval and advises at least 600 seconds (Section 5.16).
To change a live session, the AAA server or a policy server sends a CoA-Request or Disconnect-Request to the NAS on UDP port 3799 (RFC 5176, Sections 2.1 and 2.2). Portals use CoA to lift the walled garden (the restricted pre-login network), and quota systems to throttle users.
Authentication methods per SSID: a carrier Wi-Fi matrix
A carrier RADIUS server for Wi-Fi often handles four SSID types on shared radios.
Table 1. Authentication method and AAA requirement by SSID type
| SSID type | Authentication method | AAA requirement |
| Open SSID with captive portal | Portal login, voucher or MAC check, then RADIUS | RADIUS plus CoA and Disconnect (RFC 5176); per-session time and data limits |
| Enterprise (WPA2/WPA3-Enterprise) | 802.1X with EAP-TLS (RFC 5216) or Protected EAP (PEAP) | Transport Layer Security (TLS) termination, server certificates and directory lookup |
| SIM-based offload | 802.1X with EAP-AKA’ (RFC 9048) | AAA server fetches vectors from the HSS over SWx; fast re-authentication available. |
| Passpoint | 802.1X with the home provider’s EAP method | Realm routing to home AAA servers over IPsec or TLS |
Hotspot authentication on open and portal SSIDs
Selling paid hotspot plans, vouchers or sponsored access on your open SSIDs? View WiFi Monetization to see how Alepo runs those captive portal journeys for operators.Once the user signs in or pays, the gateway sends an Access-Request with the portal credentials, or the AAA server lifts the walled garden with a CoA-Request.
Returning devices can skip the portal through MAC caching on Calling-Station-Id (RFC 2865, Section 5.31; RFC 3580, Section 3.21), though randomized MAC addresses break it.
WPA2 and WPA3-Enterprise RADIUS on secured SSIDs
WPA2-Enterprise and WPA3-Enterprise (Wi-Fi Protected Access) both use 802.1X, so the RADIUS exchange doesn’t change. WPA3 requires Protected Management Frames (PMF), which protect only the radio link.
Its optional 192-bit mode limits EAP to cipher suites such as TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (WPA3 Specification v3.1, Section 3.5). Section 5 adds server certificate validation rules for devices, so the AAA server’s certificates and TLS stack must match.
SIM-based Wi-Fi offload authentication
SIM-based methods let a phone join an operator SSID with its subscriber identity module (SIM) instead of a password. EAP-SIM (RFC 4186) uses Global System for Mobile Communications (GSM) triplets, usually from the Home Location Register (HLR), and EAP-AKA. EAP-AKA (RFC 4187) uses Universal Mobile Telecommunications System (UMTS) Authentication and Key Agreement (AKA). EAP-AKA’ (RFC 9048, October 2021) binds keys to the access network name, and the 3rd Generation Partnership Project (3GPP) specifies it for 5G non-seamless WLAN offload (TS 33.501, Annex S).
A device’s permanent identity is a Network Access Identifier (NAI) such as 6<IMSI>@nai.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org for EAP-AKA’ in 4G (3GPP TS 23.003, clause 19.3.2). IMSI is the International Mobile Subscriber Identity, and the realm names the home operator. In 5G, the device sends a Subscription Concealed Identifier (SUCI) instead (TS 23.003, clause 28.7.3). Every full login depends on the AAA server’s link to the mobile core; our Wi-Fi offload article covers the business case.
Where the HSS and UDM fit
In 4G, Wi-Fi reaches the 3GPP AAA server over STa (trusted) or SWa (untrusted), and it fetches vectors from the HSS over SWx (3GPP TS 29.273, clauses 5, 4 and 8).
Release 17 added the Non-Seamless WLAN Offload Function (NSWOF) for 5G. It faces Wi-Fi over SWa and calls the Authentication Server Function (AUSF), which gets EAP-AKA’ vectors from the UDM (TS 23.501, clause 4.2.15). Fast re-authentication (RFC 4187, Section 5) reuses earlier keys and skips that lookup.
Wi-Fi roaming realms: how partner subscribers authenticate
Wi-Fi roaming works through RADIUS proxying: the visited AAA server reads the realm after the @ in User-Name (RFC 2865, Section 5.1) and forwards the request to that realm’s server (Section 2.3; RFC 7542, Section 3).
The home server decides; the visited network enforces it. Proxies must leave the Class attribute untouched, because the NAS echoes it in accounting for partner reconciliation (RFC 2865, Sections 2.3 and 5.25). Realm tables also need failover order and an unknown-realm rule.
With Passpoint (Hotspot 2.0), the phone uses the Access Network Query Protocol (ANQP) to check which realms an access point serves before associating. It then authenticates with 802.1X.
Securing RADIUS between operators
RADIUS over UDP hides only a few attributes, such as User-Password (RFC 2865, Section 5.2). Links between operators should run over IPsec or RADIUS over TLS (RadSec) on Transmission Control Protocol (TCP) port 2083 (RFC 6614, Section 2.1). RFC 7585 lets a proxy find a partner’s RadSec server through Domain Name System (DNS) lookups by realm (Section 3).
An Internet Engineering Task Force (IETF) draft (draft-ietf-radext-deprecating-radius-10, July 3, 2026) proposes retiring RADIUS over UDP and TCP. It isn’t an RFC yet.
Wi-Fi RADIUS at scale: planning for TPS peaks
When a train pulls in, thousands of hotspot devices authenticate within minutes. RFC 2865 warns that RADIUS can lose performance and data at large scale, partly because it has no congestion control.
In deployments we see planned maintenance cause its own surge: when a controller returns, its clients re-authenticate at once.
A transaction is one RADIUS request and its response, so a single EAP login can count as several. Five things drive transactions per second (TPS) on a Wi-Fi AAA server:
Table 2. What drives Wi-Fi RADIUS load
| Load driver | RADIUS traffic | Planning lever |
| Crowd surges | Several round trips per EAP login, plus core lookups for SIM logins | Size for peak TPS and use fast re-authentication |
| Access point or WLC restart | Accounting-On/Off (Acct-Status-Type 7 or 8; RFC 2866, Section 5.1), then a login burst | Stagger maintenance; rate-limit per NAS |
| Session timeouts | A new login every Session-Timeout (RFC 2865, Section 5.27) | Stagger timeouts across sessions |
| Interim accounting | One Interim-Update per session per interval (RFC 2869, Section 5.16) | Use the longest interval billing allows |
| Retransmissions | Duplicates when the server is slow | Match NAS timeouts to latency; drop duplicates by Identifier (RFC 2865, Section 3) |
Worked example: a metro ISP’s hotspot network
Take an internet service provider (ISP) with 200,000 concurrent hotspot sessions and a 600-second interim interval (illustrative figures). Accounting alone produces about 333 requests per second (200,000 ÷ 600).
Then a transit-hub controller restarts, and 20,000 devices rejoin within two minutes: about 167 logins per second. A transaction is one RADIUS request and its response. At three round trips each, that adds roughly 500 authentication transactions and 167 Accounting-Request Starts per second, so the peak nears 1,000 TPS. Without fast re-authentication, up to 167 vector requests per second also land on the HSS or UDM.
Frequently asked questions
Q1. How does Wi-Fi use RADIUS?
The access point or WLC is a RADIUS client, sending Access-Requests on UDP port 1812 and accounting on 1813 (RFC 2865, Section 3; RFC 2866, Section 3).
Q2. Which authentication method should each SSID use?
Open hotspot SSIDs use a portal with RADIUS and CoA; enterprise SSIDs use 802.1X with EAP-TLS or PEAP. SIM offload SSIDs use EAP-AKA’, and Passpoint SSIDs use the home provider’s EAP method.
Q3. How does SIM-based Wi-Fi offload authenticate users?
The device proves it holds a valid SIM through EAP-AKA’ (RFC 9048), and the vectors come from the HSS in 4G or the UDM in 5G (3GPP TS 33.501, Annex S).
Q4. How do roaming partners authenticate on Wi-Fi?
The visited AAA server reads the realm in the user’s NAI and proxies the request to the home AAA server (RFC 2865, Section 2.3), ideally over IPsec or RADIUS over TLS (RFC 6614).
Q5. How much RADIUS load does a hotspot network create?
Multiply logins by round trips each, then add sessions divided by the interim interval. 200,000 sessions on a 600-second interval generate about 333 accounting requests per second.
Q6. Does WPA3 change RADIUS?
No. WPA3-Enterprise keeps WPA2-Enterprise’s 802.1X and RADIUS exchange, though its optional 192-bit mode narrows EAP’s TLS cipher suites (WPA3 Specification v3.1, Section 3.5).
Q7. What is the difference between Wi-Fi RADIUS authentication and accounting?
Authentication decides whether a device may join (UDP port 1812). Accounting reports usage in Start, Interim-Update and Stop records (UDP port 1813; RFC 2866, Section 5.1) for billing.
Conclusion
Choose the method per SSID, then give the AAA server what each needs: CoA for portals, certificates for enterprise, a live HSS or UDM link for SIM offload and realm routing for Passpoint. Size it for peak TPS with a site down.
Alepo AAA Server consolidates these flows on one carrier-grade AAA server platform, rated for 36,000+ TPS in the AAA Server datasheet.
| Book a demo and get in touch with Alepo’s AAA team. |
