Register a RADIUS client (VPN, firewall, Wi-Fi)

VPNs, firewalls and Wi-Fi controllers can sign people in over classic RADIUS (UDP) or RadSec (RADIUS over TLS): a password plus a code from the authenticator app, or a phone approval. Each device is a "RADIUS client".

Where do I register it?

«Manage» › «RADIUS clients». The item appears only when your organization's service has RADIUS turned on; if you cannot see it, ask your provider.

How do I register a client?

1. Choose «Add client». «New RADIUS client» opens.
2. Fill in:

3. Choose «Save client».

A generated secret is shown once: «This secret is shown once. Enter it in the client now; AuthGuard keeps it sealed and never shows it again.» Copy it with «Copy» into the device and choose «Done».

UDP or RadSec?

• RadSec is recommended across the internet: the device is identified by its certificate and TLS protects everything.
• UDP identifies the device by its source address. Use it only from a fixed public address, never behind a shared NAT. A range belongs to a single client across the whole service; a range already in use is refused.

Edit, disable and remove

«Edit» changes fields and, for UDP, «Keep the current secret» or generate another. «Remove» asks for confirmation: the client stops signing people in at once. Changes reach every server within 30 seconds.

Next steps

Configure the device: see Configure the RADIUS device.