Entrypoint RADIUS Proxy operates as a managed RADIUS proxy and forwarding service.
It depends on functional upstream RADIUS servers, network reachability, and properly configured client infrastructure to ensure successful authentication and accounting transactions.
This section describes the technical and operational requirements for using the Entrypoint RADIUS Proxy service.
#
Network Requirements #
Requires IP connectivity between network infrastructure (NAS devices) and the Entrypoint RADIUS Proxy endpoints.
#
Authentication Dependencies #
Requires an operational upstream RADIUS for forwarding authentication requests.
Supports standard RADIUS methods when used as a proxy.
Relies on correct shared secret configuration between Entrypoint RADIUS Proxy and remote RADIUS servers.
#
RadSec Requirements #
RadSec (RADIUS over TLS) requires valid X.509 certificates on both client and server sides.
Certificates must be signed by a trusted CA — either internal (organization-issued) or external (public CA).
Clock synchronization is required on all devices to validate certificate expiration dates (e.g., via NTP).
Operational Requirements #
Upstream RADIUS servers must be reachable and responsive for successful proxy operation.
Summary of Customer Responsibilities #
| Configuration Area | Customer Requirements |
|---|---|
| Upstream RADIUS | Maintain an operational RADIUS or Identity Provider (IdP) service to which Entrypoint RADIUS Proxy can forward authentication and accounting requests. Ensure reachable endpoints, correct shared secrets, and valid response handling. |
| Remote RADIUS Configuration | Provide hostname, ports, and secrets for the upstream RADIUS server. Verify that the server accepts requests from the Entrypoint RADIUS Proxy FQDN. |
| Certificate Requirements | Maintain valid CA-signed or organization-issued certificates when using RadSec. Ensure certificate expiration monitoring and renewal processes are in place. |
| RADIUS Server Certificate | Optionally upload a Bring-Your-Own-Certificate (BYOC) for RadSec communication, or use the Entrypoint-provided managed certificate. |
| RadSec (RADIUS over TLS) | Enable RadSec if encrypted communication is required. Provide a valid certificate, verify trusted CAs, and ensure network device compatibility with RFC 6614. |
| TLS Version Requirement | ✅ Only TLS 1.2 or higher is supported for all RadSec communications. |
| Network Access | Ensure IP connectivity between access infrastructure (controllers, switches, gateways) and Entrypoint RADIUS Proxy. |
| Firewall Rules | Allow bidirectional communication between customer infrastructure and Entrypoint RADIUS Proxy endpoints. |
| Message-Authenticator | All RADIUS clients (e.g., wireless controllers, switches, VPN gateways) must include a valid Message-Authenticator attribute in authentication requests. Requests missing or incorrectly computed attributes will be rejected. |
| DNS and NTP Dependencies | Ensure network devices can resolve Entrypoint hostnames and maintain accurate system time for certificate validation. |