I'm looking at Portnox for network access control and noticed that the setup sends RADIUS traffic over the internet by default. We're planning to use RadSec instead. What security, reliability, and cost issues should we consider with a cloud-hosted RADIUS service?
Has anyone evaluated cloud-hosted RADIUS for NAC?
Asked by
Jorbel.8w
Answers
Check exactly how the traffic gets from every switch and wireless controller to the service. Classic RADIUS does not encrypt the whole packet, so attributes such as device names, addresses, and port information can be exposed. RadSec carries RADIUS over TLS and is a better fit for an internet path.
Also check whether all your network gear supports RadSec. If it doesn't, ask how a local relay protects the upstream connection and how the link between the device and relay is secured.
Reply to this answer
My bigger question would be what happens when the WAN or the provider is down. How long do authentications take during a normal day, and what happens to new devices during an outage?
Portnox has local virtual appliances that can cache previously seen devices and relay requests. Check the current product behavior carefully, though. A cache is not necessarily a local authentication server, and the appliances described in the discussion could not authenticate new devices without the cloud service.
Reply to this answer
Get a quote early and compare it with running FreeRADIUS or Microsoft NPS yourself. Cloud NAC pricing may be hard to justify for a few hundred devices, though an in-house service also means owning the configuration, maintenance, and availability. Some people prefer keeping that authentication infrastructure internal regardless.
Reply to this answer
Portnox isn't the only cloud option. RADIUSaaS with SCEPman was mentioned as a way to use device certificates with RadSec, including for environments using Entra and Intune. That's a different certificate management setup to evaluate, not just a replacement server. Check device support, pricing, and how well the vendor responds before committing.
Reply to this answer
Hosting your own NPS servers in cloud VMs over a VPN is another route. It keeps you responsible for the RADIUS servers rather than using a managed service, so compare the operational work and the dependence on that VPN before choosing it.
Reply to this answer
Add your answer
Answers are reviewed before publication.
8k!napkinhook_319:
Worth testing an actual outage during the evaluation, including a device that hasn't connected before. Cached access alone doesn't tell you how new authentications will behave.