Description

This article provides a step-by-step guide for configuring RadSec (RADIUS over TLS, RFC 6614) on Juniper SRX firewall acting as a RadSec client.

RadSec, defined in RFC 6614, is a secure transport method for RADIUS that encapsulates standard RADIUS packets within a TLS session over TCP, It preserves existing RADIUS packet structure and AAA (authentication, authorization, and accounting) semantics while adding transport-layer encryption and mutual certificate-based authentication.

Symptoms

  • This is feature is supported on limited SRX models, check support here: RADIUS over TLS (RADSEC)

  • Traditional RADIUS transmits authentication data over UDP using a shared secret encrypted with MD5, a weak algorithm vulnerable to interception and replay attacks.
  • This is acceptable on trusted internal networks but becomes a security risk when RADIUS traffic needs to traverse untrusted or public networks.
  • RadSec addresses this by wrapping RADIUS traffic inside a TLS tunnel over TCP, providing full encryption of all authentication and accounting data in transit.
  • To establish this TLS tunnel, both sides must prove their identity using digital certificates rather than a shared secret.  

Solution

RadSec servers are represented by destination objects configured under the [edit access radsec] hierarchy. Traffic redirection is achieved by associating a standard RADIUS server entry with a RadSec destination ID, which causes the SRX to transparently redirect RADIUS traffic that would normally be sent over UDP to the RadSec server over an encrypted TLS tunnel instead.

 

Configuration: 

 

Upload RadSec server CA certificate, SRX client certificate and key: 

 

set security pki ca-profile RADSEC-CA ca-identity JTAC-RADSEC-CA

request security pki ca-certificate load ca-profile RADSEC-CA filename /var/tmp/RADSEC-CA.crt

request security pki local-certificate load certificate-id RADSEC-CERT filename /var/tmp/SRX-client.crt key /var/tmp/SRX-client.key

 

Note: In this example, certificates were generated on same FreeRadius Server with OpenSSL.

 

Configure RadSec and Radius access profile: 

 

set access radsec destination 10 address 192.168.0.2              <---Radius Server

set access radsec destination 10 port 2083                        <---RADIUS/TLS Port

set access radsec destination 10 tls-certificate RADSEC-CERT      <---SRX Client Certificate

set access radsec destination 10 tls-peer-name FreeRADIUS-Server  <---Radius Server Certificate CN

set access radsec destination 10 tls-timeout 10

 

set access profile RAD-SEC-ACCESS-PROF radius-server 192.168.0.2 radsec-destination 10  <---RadSec Destination ID

set access profile RAD-SEC-ACCESS-PROF radius-server 192.168.0.2 port 1812              <---Radius UDP Port

set access profile RAD-SEC-ACCESS-PROF radius-server 192.168.0.2 secret radsec          <---Radius Server Pass

 

set access radius-server 192.168.0.2 radsec-destination 10

set access radius-server 192.168.0.2 port 1812

set access radius-server 192.168.0.2 secret radsec

 

Note: tls-peer-name must match the CN (Common Name) in the RADIUS server certificate 

 

 

Verification: 

 

root@SRX>show network-access radsec state

Radsec state:

  destination                                   10
  state                                         open
  secs-in-state                                 13
  remainig-secs                                 4294967295
  pause-reason                                  none
  acct-support                                  Y
  remote-failures                               0
  tx-requests                                   0
  tx-responses                                  0

 

root@SRX>show network-access radsec statistics

Radsec general counters:

  destination                                   10
  start-events                                  1
  clear-events                                  0
  timeout-events                                0
  loc-cert-acq-events                           1
  connected-events                              1
  ssl-ready-events                              1

 

root@SRX>show security flow session destination-port 2083

Session ID: 432, Policy name: self-traffic-policy/1, Timeout: 1798, Session State: Valid
  In: 192.168.0.1/61394 --> 192.168.0.2/2083;tcp, Conn Tag: 0x0, If: .local..0, Pkts: 478, Bytes: 47469,
  Out: 192.168.0.2/2083 --> 192.168.0.1/61394;tcp, Conn Tag: 0x0, If: mge-0/0/0.0, Pkts: 241, Bytes: 35297,

 

root@SRX> show system connections | match 2083

tcp4       0      0  192.168.0.1.61394                             192.168.0.2.2083                              ESTABLISHED

 

 

 

Modification History

05/08/2026 - Article Created