FreeRADIUS Setup: Centralized Auth with AD/LDAP, WPA2-Enterprise

Imagine: 50 switches, 100 access points, and each with its own password database. One forgotten password and access is lost. Engineers spend hours on resets, while security suffers. We solve this by configuring FreeRADIUS—a centralized authentication server for all network devices. It checks credentials via LDAP or Active Directory, eliminating local passwords. Typical scenarios: corporate Wi-Fi (WPA2-Enterprise), VPN clients, 802.1X on access ports. FreeRADIUS handles up to 100,000 requests per second, significantly faster than many commercial alternatives.

Let's get straight to it: we'll break down how to configure FreeRADIUS for centralized authentication and why it's the best choice for your infrastructure. We recently helped a company with 500 employees migrate from local passwords to AD authentication in two days—zero downtime on password changes and up to 70% savings on administration.

What Problems Does FreeRADIUS Solve?

• Fragmented password management — Instead of 20 local databases on each device, a single RADIUS server with a unified directory. Changing a password in AD applies immediately to all network services: Wi-Fi, VPN, managed switches. No manual copying.
• Lack of connection audit — Accounting logs every session: who, when, how much data transferred. This enables anomaly tracking, report generation, and meeting GDPR/ISO 27001 requirements. Savings on SIEM licenses—up to $15,000 per year when switching to a free stack.
• Complexity of WPA2-Enterprise deployment — Many companies postpone implementation due to perceived difficulty. In practice, one certificate + EAP config solves the problem in a day. Centralized management eliminates the risk of password leaks through open networks.

How to Integrate FreeRADIUS with Active Directory?

Let's consider a step-by-step setup on Ubuntu LTS. FreeRADIUS documentation recommends this approach.

Step 1: Install FreeRADIUS with the LDAP module:

apt install freeradius freeradius-ldap freeradius-utils 

Step 2: Add NAS clients—switches and access points, specifying their IP and secret:

# /etc/freeradius/3.0/clients.conf

client wifi-ap-01 {
    ipaddr = 10.0.1.50
    secret = shared_secret_here
    shortname = wifi-ap-01
    nastype = other
}

client core-switch {
    ipaddr = 10.0.0.1
    secret = switch_secret
    shortname = sw-core
    nastype = cisco
}

client network-devices {
    ipaddr = 10.0.0.0/24
    secret = net_secret
    shortname = internal-net
}

Step 3: Configure the LDAP module to connect to AD. Replace the server IP and credentials with your own:

# /etc/freeradius/3.0/mods-available/ldap
ldap {
  server = "ldap://192.168.1.10"
  identity = "CN=freeradius,OU=ServiceAccounts,DC=example,DC=com"
  password = "service_account_password"
  base_dn = "DC=example,DC=com"

  user {
    base_dn = "OU=Users,${..base_dn}"
    filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
  }

  group {
    base_dn = "OU=Groups,${..base_dn}"
    filter = "(objectClass=group)"
    membership_attribute = memberOf
  }

  tls {
    start_tls = no
  }
}

Step 4: Add authorization by AD groups in the authorize section:

# /etc/freeradius/3.0/sites-available/default
authorize {
    filter_username
    preprocess
    ldap
    if (LDAP-Group == "CN=VPN-Users,OU=Groups,DC=example,DC=com") {
        update control {
            Auth-Type := LDAP
        }
    }
    else {
        reject
    }
}

Why is FreeRADIUS Optimal for WPA2-Enterprise?

For WPA2-Enterprise, EAP-PEAP with MSCHAPv2 is used. The EAP module configuration requires a server certificate:

# /etc/freeradius/3.0/mods-enabled/eap
eap {
    default_eap_type = peap
    timer_expire = 60
    peap {
        default_eap_type = mschapv2
        copy_request_to_tunnel = yes
        use_tunneled_reply = yes
    }
    tls-config tls-common {
        private_key_file = /etc/ssl/private/radius.key
        certificate_file = /etc/ssl/certs/radius.crt
        ca_file = /etc/ssl/certs/ca.crt
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "ECDHE+AESGCM:EDH+AESGCM"
        tls_min_version = "1.2"
    }
}

The RADIUS server certificate must be trusted by clients (or imported into a corporate CA). Otherwise, Windows/macOS will prompt for confirmation when connecting.

What is RADIUS Accounting and Why is it Needed?

Accounting collects session data: connection time, traffic volume, disconnection reason. FreeRADIUS can write logs to an SQL database, e.g., MySQL, or detail files. This allows building dashboards in Grafana and integrating with SIEM. Our team has implemented this for over 50 clients, achieving 99.9% uptime.

Testing the Configuration

Run debugging: freeradius -X. The output shows every processing step. For a quick authentication test, use radtest [email protected] password 127.0.0.1 0 testing123.

Comparison of FreeRADIUS and Commercial Solutions

FreeRADIUS wins in performance and flexibility with zero license cost. For comparison, Cisco ISE license is about $10,000 per server. However, manual configuration is required—that's where we help. With 10+ years of experience and over 100 successful deployments, we ensure a smooth setup.

What are the Setup Timelines?

What's Included in the Work

• Audit of current network infrastructure
• Installation and configuration of FreeRADIUS on your server
• Integration with Active Directory or LDAP
• Configuration of WPA2-Enterprise with certificates (EAP-PEAP)
• Configuration of NAS clients (switches, access points, VPN gateways)
• Setup of Accounting and log export to SIEM
• Testing of authentication and authorization scenarios
• Creation of documentation (diagram, administrator manual, runbook)
• Training for your engineers (2 hours)

Get a consultation—we will assess your infrastructure and offer the optimal solution. Order a turnkey setup with a full set of documentation.

RADIUS is an authentication protocol described in Wikipedia.