What Is an AAA Server and Why Does Every CSP Need One?

Every subscriber session on a carrier network begins and ends in the same place: the AAA server. When it misreads a credential, a paying customer gets locked out. When it drops an accounting record, revenue leaks quietly and nobody notices for a billing cycle. This guide explains what an AAA server is, how authentication, authorization, and accounting work inside a carrier network, which protocols carry them, and what genuinely changes in 5G – written for telecom operators and Internet Service Providers (ISPs) encountering AAA for the first time.

What Is an AAA Server?

An AAA server is the network function that decides who is allowed to connect, what each subscriber may do once connected, and how their usage is recorded. AAA stands for authentication, authorization, and accounting. In a telecom network, it sits at the entry point of every broadband, mobile, and Wi-Fi session and applies subscriber policy in real time.

The term shows up in two very different worlds, which is why search results for it are often confusing.

In enterprise IT, an AAA server usually means a RADIUS instance controlling Wi-Fi and VPN logins for a few thousand employees. The AAA server meaning in telecom is considerably broader: it is a carrier-grade function handling millions of concurrent sessions across fixed broadband, mobile data, fixed wireless access (FWA), and public Wi-Fi – and it feeds usage records straight into the billing stack.

Scale is one difference. The consequential one is commercial. In an enterprise, an accounting record is an audit artifact. In a Communication Service Provider (CSP) network, an accounting record is a billable event. A gap in AAA accounting is a gap in the invoice.

Authentication, Authorization, Accounting Explained

The three functions run in sequence, and each answers a distinct question.

Authentication checks credentials against a subscriber database, a Home Subscriber Server or Unified Data Management function (HSS/UDM), or a Lightweight Directory Access Protocol (LDAP) directory.

The answer to “what is AAA in networking” is the same in every context: three functions, executed in order, for every access attempt. What differs between an enterprise deployment and a CSP deployment is the volume, the latency budget, and whether money depends on the output.

A common misconception is worth clearing up early. AAA is a framework, not a protocol. It defines the three functions. RADIUS, Diameter, and TACACS+ are the protocols that carry those functions across a network.

How AAA Works in Practice

Here is the sequence behind a single broadband session, from the moment a subscriber’s router powers on.

1. Access request
2. The subscriber’s customer premises equipment (CPE) initiates a session against a network element – a Broadband Network Gateway (BNG) or Broadband Remote Access Server (BRAS) for fixed broadband, a Session Management Function (SMF) for 5G mobile data, a wireless controller for Wi-Fi. That element acts as the AAA client and forwards an access request.
3. Authentication
4. The server validates the credentials. Fixed broadband typically uses a username and password over Point-to-Point Protocol over Ethernet (PPPoE) or IP over Ethernet (IPoE). Mobile subscribers authenticate against SIM credentials using EAP-SIM or EAP-AKA. Enterprise access often uses certificates via EAP-TLS. If validation fails, the session stops here.
5. Authorization
6. The server looks up the subscriber’s active plan and returns the attributes the edge must apply: downstream and upstream rate limits, data quota, concurrent session count, IP address or pool assignment, and any restrictions on the account.
7. Session established
8. The network element enforces those attributes and the subscriber is online.
9. Accounting
10. Interim usage records arrive at configured intervals throughout the session. A final record closes the session out. Both feed the billing platform.
11. Mid-session change
12. When the subscriber buys a top-up or exhausts a quota, the server pushes a Change of Authorization (CoA) to the edge – new rate limit applied, or the session redirected to a portal – without disconnecting the subscriber.

That last step is where AAA stops being plumbing and starts being product. Real-time quota enforcement, bandwidth-on-demand upsells, prepaid broadband, and dynamic hotlining all depend on the platform’s ability to change a live session. Operators running a platform that cannot do this are limited to postpaid, flat-rate offers.

The whole sequence completes in milliseconds, repeated for every subscriber on the network. It is invisible when it works. When it is undersized or a single node fails without failover, the symptom is not a slow network – it is subscribers who cannot get online at all.

Types: RADIUS, Diameter, TACACS+

Three protocols carry AAA in operator environments, and they are not interchangeable.

The distinction operators most often miss: RADIUS and Diameter authenticate subscribers. TACACS+ authenticates staff. TACACS+ separates authentication, authorization, and accounting into independent exchanges and supports per-command authorization, which is why it governs who on the network operations center (NOC) team can run which commands on which router. It is an operational-security control, not a subscriber-facing one. Both matter, and consolidating them onto one platform reduces the number of systems that need patching, auditing, and 3 a.m. attention.

Diameter was designed as RADIUS’s successor – reliable transport, capability negotiation, server-initiated messages, and failover semantics that RADIUS lacks. It did not replace RADIUS. It took the mobile core, and RADIUS kept fixed and Wi-Fi access. Most operators run both. For a deeper protocol-by-protocol comparison, see RADIUS vs Diameter vs TACACS+: Key Differences in CSP Environments.

The RADIUS security shift operators should plan for

RADIUS is 30 years old, and its original security model has not aged well. In July 2024, researchers disclosed CVE-2024-3596 – known as Blast-RADIUS – showing that an on-path attacker can exploit an MD5 chosen-prefix collision against the RADIUS Response Authenticator to convert an Access-Reject into an Access-Accept, without knowing the shared secret.

The response is a transport change. The IETF’s RADEXT working group is standardizing RadSec, which carries RADIUS over Transport Layer Security (TLS) and its datagram equivalent (DTLS), and is separately advancing a document that would formally deprecate RADIUS over plain UDP and TCP. Both are moving through the IETF process; check the IETF datatracker for current status rather than relying on a snapshot.

The practical implication for any operator evaluating an AAA platform in 2026: MD5-secured RADIUS over UDP has a defined end state, even if the migration will take years. RadSec support and a credible migration path off plain UDP belong in your selection criteria, not on a future roadmap.

AAA in 5G: What Changes?

In 5G, primary subscriber authentication moves inside the core as service-based network functions. The Authentication Server Function (AUSF) runs authentication, subscriber credentials live in the Unified Data Management and Authentication Credential Repository and Processing Function (UDM/ARPF), the Subscription Permanent Identifier (SUPI) is concealed as a Subscription Concealed Identifier (SUCI) to prevent International Mobile Subscriber Identity (IMSI) catching, and 3GPP TS 33.501 defines 5G-AKA and EAP-AKA’ as the two primary methods. These exchanges use HTTP/2 service-based interfaces – not Diameter.

That leads a lot of operators to assume the AAA server retires with 4G. It does not. 3GPP kept dedicated AAA roles in the 5G architecture, and they are specified in detail:

• Secondary authentication. TS 33.501 clause 11 defines EAP-based secondary authentication by an external data network AAA (DN-AAA) server. The SMF acts as EAP authenticator and consults the AAA server to authorize a specific Protocol Data Unit (PDU) session against a specific data network. TS 29.561 specifies this N6 interworking in both RADIUS and Diameter. The DN-AAA server can also revoke authorization or trigger re-authentication on a live session.
• Slice-specific authentication. 3GPP also specifies network slice-specific authentication and authorization (NSSAA), in which the Network Slice-Specific Authentication and Authorization Function (NSSAAF) brokers authentication against an AAA server (AAA-S) – relevant to any operator monetizing slices for enterprise customers.
• Private and non-public networks. For standalone non-public networks (SNPNs), 3GPP defines a Credentials Holder that can use an AAA server for primary authentication, along with AAA-based device onboarding via a Default Credentials Server. In private 5G, the AAA server can be the primary identity authority.
• Non-3GPP and Wi-Fi access. Trusted and untrusted non-3GPP access paths still terminate against AAA functions, which is how Wi-Fi offload and Wi-Fi calling get authenticated against mobile credentials.

The fixed and Wi-Fi estate that RADIUS serves is also growing rather than shrinking. According to the June 2026 Ericsson Mobility Report, global FWA connections are forecast to rise from 185 million at the end of 2025 to 350 million by the end of 2031, with roughly 71% of FWA service providers now delivering the service over 5G.

Add it up and the real 5G picture is not protocol replacement – it is protocol coexistence. A CSP in 2026 typically runs Diameter signaling for 4G, service-based interfaces for 5G core, RADIUS for broadband and Wi-Fi and FWA, and TACACS+ for device administration, all at once. The architectural decision is not which protocol wins. It is whether all of them run on one platform with one subscriber view, or on four platforms with four operations teams and four audit trails.

Alepo AAA for Modern Operators

The Alepo AAA Server was built for the coexistence problem described above: RADIUS, Diameter, and TACACS+ terminated natively on a single platform, with one subscriber database and one management interface across broadband, mobile, and Wi-Fi access. The full EAP family is covered – EAP-SIM, EAP-AKA, EAP-AKA’, EAP-TLS, EAP-TTLS, and PEAP – along with RadSec for TLS-encrypted RADIUS, which matters given the transport shift described above.

The platform is built for carrier-grade availability: 99.999% uptime, N+1 and N+N redundancy, real-time database replication, and stateless session storage with database persistence. Deployment is vendor-neutral – on-premises, private cloud, public cloud, containerized on Kubernetes, or bare-metal – which matters for operators whose primary concern about a replatforming is trading one lock-in for another. Throughput and authentication-latency figures are published per release; in any evaluation, ask for the test report and the traffic profile it was measured against.

Migration risk – not the feature list – is usually the deciding factor, which is what you would expect when the system being replaced authenticates every session on the network. Alepo has replaced incumbent AAA stacks on live subscriber bases at Tier-1 operators in Europe and the Middle East and at large national broadband providers in Asia. In an evaluation, ask for the migration methodology and the rollback plan; those two documents tell you more than a throughput number. Our AAA migration checklist sets out the sequence in detail.

Frequently Asked Questions

Is an AAA server the same thing as a RADIUS server?

No. AAA is the framework – three functions. RADIUS is one protocol that carries them. A RADIUS server is one kind of AAA server, but the same platform may also speak Diameter and TACACS+. In a carrier network, it usually needs to.

Do CSPs still need an AAA server with 5G standalone?

Yes. Primary subscriber authentication moves to the AUSF and UDM inside the 5G core, but 3GPP defines AAA server roles for secondary authentication of PDU sessions (TS 33.501 clause 11, with N6 interworking in TS 29.561), network slice-specific authentication via the NSSAAF, private network credential holding, and device onboarding in standalone non-public networks. Fixed broadband, FWA, and Wi-Fi access continue to depend on RADIUS regardless of the mobile core generation.

What happens if AAA goes down?

Existing sessions typically stay up, because the network edge has already been given its enforcement attributes. New sessions fail. Subscribers who reboot a router, roam between access points, or reconnect after a brief drop cannot get back online, and accounting records stop reaching billing. This is why stateless architecture, geo-redundancy, and tested failover matter more in AAA than raw throughput headroom.

Can one platform handle broadband, mobile, and Wi-Fi together?

It can, if it supports all three protocol families natively rather than through bolt-on translation. The operational argument for consolidation is a single subscriber view, one set of policies, and one platform to patch when the next protocol-level vulnerability is disclosed.

Conclusion

An AAA server is the least visible and most load-bearing component in a service provider network. It authenticates every subscriber, enforces every plan, and produces the usage data that becomes revenue. Choosing one is less about a feature checklist and more about three questions: can it carry every protocol the network actually runs, can it change a live session in real time, and can it be migrated to without an outage.

When you are ready to walk through your specific access architecture, request a demo with the Alepo team.