RADIUS
The RADIUS client lives in the radius view and applies live on commit — the client rebuilds in place, servers are re-resolved and scalars updated. The one exception is coa-port, whose listener re-binds only at boot.
Server list and failover
The server list is index-addressable, so insert, delete and move reorder failover priority. Default ports are 1812 for authentication and 1813 for accounting. timeout is the per-try timeout in seconds, default 2, and retries is the number of retransmits before failover, default 3.
system-view radius server add <host> secret <s> [auth-port <n>] [acct-port <n>] radius server insert <N> <host> secret <s> [auth-port <n>] [acct-port <n>] radius server delete <N> radius server move <N> <M> radius server add 198.51.100.10 secret <shared-secret> commit show radius statistics
Client settings
NAS identity, timers and the dictionary path. interim-interval sets the interim accounting interval in seconds, with 0 turning it off. coa-port is the Change-of-Authorization and Disconnect listener, default 3799 — note that unlike everything else here it re-binds only at boot, so a change to it needs a restart.
radius nas-ip <ip> # NAS-IP-Address, or none radius nas-id <id> # NAS-Identifier, or none radius timeout <secs> # per-try timeout, default 2 radius retries <n> # before failover, default 3 radius coa-port <port> # default 3799, re-binds at BOOT radius interim-interval <secs> # 0 = off radius dict-path <path> # dictionary tree radius undo <nas-ip|nas-id|timeout|retries|coa-port| interim-interval|dict-path|message-authenticator>
Message-Authenticator
Attribute 80, from RFC 2869, is an HMAC-MD5 signature over the whole packet keyed with the shared secret. It provides integrity and authenticity — it is not encryption, and the digest itself travels in cleartext. Three modes: off never sends or checks it; on, the default, signs every Access-Request and verifies any reply that carries a signature; require additionally drops any Access-* reply that lacks or fails one.
radius message-authenticator off|on|require # default on commit show radius # reports the active mode show radius statistics # watch bad-msg-authent.
Why to keep it on
RADIUS over UDP uses a Response Authenticator that is raw MD5, which is chosen-prefix collidable. An attacker positioned between the gateway and the RADIUS server can therefore forge an Access-Accept out of an Access-Reject and authenticate a subscriber who should have been denied — CVE-2024-3596, known as BlastRADIUS. HMAC-MD5 is unaffected, so attribute 80 is the mitigation. There is a second, more mundane reason: modern servers, FreeRADIUS 3.2.5 and later, increasingly require attribute 80 on requests, and with this off such a server silently drops every request the gateway sends. That presents as a total authentication outage rather than a protocol error, which makes it an unpleasant thing to diagnose. show radius statistics adds a bad-msg-authent counter — replies dropped because the signature was missing or wrong, which is either a forgery or, far more often, a shared-secret mismatch. Watch it after enabling, and only move to require once it stays at zero.
CoA and Disconnect
Change-of-Authorization, per RFC 5176, pushes plan changes and disconnects to a live session without teardown, and the QoS engine rebinds the shaper in place. This is what makes an upgrade, a speed boost or a suspension apply to a connected subscriber rather than requiring a reconnect. The listener port is coa-port above.
What is protected on the wire
Only User-Password, Tunnel-Password and the MS-MPPE keys are obfuscated in RADIUS. Everything else — User-Name, NAS-IP, Framed-IP, Class, and every Netvyn VSA — is plaintext. Attribute 80 does not change that; it only makes tampering detectable. If the path between the gateway and your RADIUS server crosses anything you do not control, that is an argument for a tunnel, not for a different attribute.