# RADIUS

> Protect VPNs, wifi and network equipment with RADIUS: create the Passwordless RADIUS application, install the Ironchip RADIUS server and test access.

URL: https://docs.ironchip.com/en/identidad/protocolos/radius/

RADIUS (Remote Authentication Dial-In User Service) is the authentication protocol used by VPNs, corporate wifi, firewalls and network equipment. Ironchip answers the RADIUS requests from the equipment and asks the user for approval on their device.

## Requirements

- An administrator account in the Ironchip admin console.
- A device that supports RADIUS and access to its authentication server settings.
- The users enrolled in Ironchip, or [identity synchronization](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/) configured.

## Create the application in Ironchip

The first step is to create a **Passwordless RADIUS** application in the Ironchip admin console, which gives you an API key.

1. Go to **Applications** and click **New application**.
2. In the **Standard authentication protocols** section, choose **Passwordless RADIUS**.
3. Give it an identifying name (at least 3 characters) and click **Add**.
4. Copy the API key or click **Download credentials** to download it in the `credentials.json` file. The console does not show it again.

## Install the RADIUS server

Ironchip answers RADIUS requests with the [Ironchip RADIUS server](https://docs.ironchip.com/en/identidad/integraciones/red/radius-server/), a service for Windows and Linux that listens on UDP port `1812` by default. Its guide explains how to:

- download the executable from the latest release;
- create the `ironchip_lbauth_radius_server.json` configuration file with the API key (`ironchip_api_secret`) and the shared secret (`radius_key`);
- install and start it as a service with `service install` and `service start`;
- add attributes to the RADIUS response, for example the user's groups.

Then configure the device you want to protect (VPN, wifi, firewall) to use that server: its address, port `1812` and the same shared secret. You have examples for specific products in the [integrations](https://docs.ironchip.com/en/identidad/integraciones/) guides, such as [WatchGuard](https://docs.ironchip.com/en/identidad/integraciones/red/watchguard/).

## Authentication example

The following video shows access to a WatchGuard VPN with the Ironchip RADIUS server running.

In the video a password is typed because WatchGuard does not allow the field to be left empty. The text in that field can be random, as in the two examples in the video.

Video: [Access to a WatchGuard VPN with the Ironchip RADIUS server](https://play.hubspotvideo.com/v/7745202/id/157030588740)