Skip to content

Introduction to EasyRadius

Welcome to EasyRadius, a robust SaaS RADIUS authentication service designed for EAP-TLS client certificate authentication.

What is EasyRadius?

EasyRadius is an Azure-based SaaS RADIUS service that provides:

  • EAP-TLS authentication using client certificates
  • Supports easy integration with the EasyScep Certificate Authority
  • Support for any CA with a public OCSP responder, including Microsoft Cloud PKI
  • A second endpoint in a second Azure region on plans with high availability
  • RADIUS over UDP, and RadSec (RADIUS over TLS) for encryption in transit
  • Certificate-based VLAN assignment
  • Simple configuration for both wired and wireless setups

Target Audience

EasyRadius is ideal for organizations that:

  • Want to secure enterprise Wi-Fi or LAN access using EAP-TLS (certificate-based authentication)
  • Are already using or planning to use Microsoft Intune for device management
  • Need a cloud-hosted RADIUS server without the overhead of managing on-premises infrastructure
  • Want to replace pre-shared key (PSK) Wi-Fi with stronger, per-device certificate authentication

System Requirements

Network Requirements

  • Network equipment (access points, controllers, switches) supporting 802.1X with an external RADIUS server, or RadSec
  • Outbound access from your network equipment to both EasyRadius endpoints. The IP addresses and the port are shown on the dashboard after setup; the port is specific to your instance and is not 1812 — see Protocols and ports
  • A public IP address (or address range) that your equipment connects from, registered as a RADIUS client
  • An OCSP responder for your CA that EasyRadius can reach over the internet

Supported Authentication Methods

  • EAP-TLS (certificate-based authentication). Username/password methods such as PEAP/MSCHAPv2 are deliberately not supported — see Why EAP-TLS?

Key Features

High Availability

  • On plans with high availability, the instance runs in two Azure regions of your choice, each with its own endpoint (hostname and IP address). The setup wizard asks for both regions on every plan
  • Configure both endpoints in your network equipment: if the primary does not answer, the equipment fails over to the secondary. Failover is performed by your equipment, so an endpoint that is not configured cannot take over

Security

  • Strong certificate-based authentication
  • Real-time certificate revocation checking via OCSP
  • RadSec (RADIUS over TLS) to encrypt RADIUS traffic between your equipment and EasyRadius
  • Message-Authenticator required by default, protecting against Blast-RADIUS (CVE-2024-3596)
  • Optionally drop traffic from unknown addresses at the network level

Management

  • Web-based administration portal with role-based access control
  • VLAN assignment by certificate attributes, SSID, access point or MAC address
  • Authentication logs for the last 7 days, and built-in diagnostics

Certificate revocation checking

EasyRadius checks client certificate revocation in real time using OCSP (Online Certificate Status Protocol). The responder URL is read from the client certificate's Authority Information Access (AIA) extension, so your CA must publish an OCSP responder that is reachable from your EasyRadius instance.

Two behaviours are worth knowing before you onboard a CA:

  • Revocation checking is enabled, and a failed check rejects the authentication. If the responder is unreachable or returns an error, EasyRadius rejects the authentication rather than letting it through. An OCSP responder outage therefore stops authentication, so plan for its availability as you would for the RADIUS service itself.
  • OCSP nonces are sent by default. Some responders — including Microsoft AD CS and Microsoft Cloud PKI in their default configuration — do not support nonces and will fail the check. If your CA is one of them, turn nonces off.

Both are switched under Settings → System in the administration portal (see Certificate validation and packet security). On some older instances the switches are shown read-only with both enabled; contact support@just-software.com to have the instance upgraded.

CRL checking is planned and is not available today. EasyRadius does not download or consult Certificate Revocation Lists — all revocation checking goes through OCSP. If your CA publishes only a CRL and has no OCSP responder, contact support before onboarding it.

Pricing

EasyRadius is available as a monthly or yearly subscription through the Azure Marketplace. Visit the EasyRadius Azure Marketplace listing for current pricing and plan options.

Getting Started

  1. On-boarding Guide — subscribe and run the setup wizard
  2. Add your network equipment as RADIUS clients and choose RADIUS, RadSec or both
  3. Configure your equipment with both endpoints — for example with the UniFi guide
  4. Deploy a Wi-Fi profile with the Intune Wi-Fi EAP-TLS guide and check the result on the Logs page

Administration Portal

Access the EasyRadius administration portal at https://portal.just-software.com. The administration portal guide describes every page: RADIUS clients, certificates, VLAN assignment, system settings, logs, diagnostics and access control.

Works great with EasyScep

EasyRadius works seamlessly alongside EasyScep, our SaaS Certificate Authority. Use EasyScep to issue and manage client certificates via Microsoft Intune, and EasyRadius to authenticate those certificates for Wi-Fi and LAN access via EAP-TLS — a complete, cloud-native certificate-based network authentication solution.

Support

For technical support or questions, contact us at support@just-software.com