How To Create a Local Shield RADIUS Server That Runs Within Your Network

A local Shield RADIUS server runs within your network and acts as a proxy for improved latency and redundancy. This guide explains how to set up and configure a local Shield RADIUS server in Keytos Shield.

Overview - What is a Local Shield RADIUS Server?

While Keytos Shield is designed with high-availability and geo-redundancy at its core, a fiber cut or internet outages may still disrupt your connection. When this happens, it’s vital that your devices and users are still able to connect to your networks and Wi-Fi.

The Shield local server is a free add-on to your Keytos Shield subscription which can be hosted within your network and act as a proxy between your network and the Shield cloud servers. During normal operation, authentication results are cached on the local server and improve performance for subsequent connections during the cache period. During a service disruption or internet outage, users can continue to authenticate to your network until the connection back to the Shield cloud servers are restored.

What are the Advantages of a Local Shield RADIUS Server?

  1. Reduced Latency: By handling authentication requests locally, you can reduce the latency associated with cloud communication, leading to faster authentication times.
  2. Increased Reliability: RADIUS was created using the UDP protocol, which might lose some packets when going through the internet. Using a local RADIUS server can help mitigate this issue by keeping that protocol local and sending the information to the cloud using a more traditional TCP connection. Additionally, in the event of a cloud outage or connectivity issue, a local RADIUS server can continue to authenticate users, ensuring uninterrupted access to critical services.
  3. Compliance: Some organizations may have compliance requirements that necessitate keeping authentication data on-premises. A local server can help meet these requirements while still leveraging cloud services.
  4. Security for Insecure Protocols: Legacy protocols often lack encryption and secure transmission mechanisms. If your network doesn’t support RadSec, you can add a local RADIUS server to handle authentication requests within your network, ensuring that sensitive information is not transmitted insecurely over the internet.

Do I Need Local Server To Run Keytos Shield Cloud RADIUS?

No, the local server is an optional, free add-on. Keytos Shield cloud RADIUS can fully function without a local RADIUS server. In fact, most of our customers do not use one. However, we understand some organizations may require a local server for compliance, performance, or redundancy reasons for highly critical workloads that have to work even if the connection to the cloud is lost.

How Does the Keytos Shield Local RADIUS Server Work?

The Keytos Shield Local RADIUS Server acts as an intermediary between your network devices (like VPNs, Wi-Fi access points, and firewalls) and the Keytos Shield Cloud RADIUS servers. You run it on-premises within your network, either on a dedicated machine, in a VM, or on an embedded device like a Raspberry Pi. Once it’s up and running, it receives authentication requests from your devices, processes them locally, and then forwards them to the cloud for validation. Since this setup has a configurable cache, it ensures that even if there are connectivity issues with the cloud, your local server can still handle authentication requests.

A Keytos Shield Cloud RADIUS local server can protect against connectivity issues and ensure uninterrupted authentication to your Wi-Fi network with Entra ID and Intune.

How to Set Up a Local RADIUS Server for Keytos Shield - Step-by-Step Guide

Follow these steps to deploy and configure a local RADIUS server for Keytos Shield:

Prerequisites for Deploying a Local RADIUS Server

Before we get into the specific set up steps, let’s review the prerequisites and considerations for deploying a local RADIUS server with Keytos Shield.

Prerequisites for a Shield Local RADIUS Server

Ensure your environment meets the following requirements before deploying the local RADIUS server.

Device Requirements for a Shield Local RADIUS Server

Since the local server runs as a Docker container, you’ll need a Linux server with the following specifications:

  • Operating System: Linux (Ubuntu 24.04 or later is recommended)
  • CPU: 2 cores minimum
  • RAM: 4 GB minimum
  • Software: Docker Engine (20.10 or later)

Docker on Windows is not currently supported due to issues with the IP address of the client not being correctly passed to the container.

Collapses this section and completes the checkmark.

Network Requirements for a Shield Local RADIUS Server

On your network side, you’ll need:

  • Outbound Internet Access: The local RADIUS server needs to communicate with the Keytos Shield and the Entra ID cloud servers. Ensure that the server has outbound internet access on port 443 (HTTPS). Inbound access is not required.
  • Ports: Ensure that your network devices (like VPNs, Wi-Fi access points, and firewalls) can send RADIUS authentication requests to the local RADIUS server on UDP ports 1812 (authentication) and 1813 (accounting) for RADIUS and/or 2083 (RadSec). These do not need to be open to the internet, only between your devices and the local server.

Collapses this section and completes the checkmark.

Shield Network Profile Requirements for a Shield Local RADIUS Server

You will need at least one Keytos Shield network profile configured in your Keytos Shield account before deploying the local RADIUS server.

Collapses this section and completes the checkmark.

{completed} so far

Step 1: How Create an Entra ID App Registration for Your Local Server

To allow your local RADIUS server to authenticate directly against Entra ID and Intune without a dependency on the Keytos Shield cloud service, you’ll register a separate Entra ID application for your server which will handle the authentication requests from the local server to Entra ID.

How to Register a Keytos Shield Local Server App Registration

Follow these steps to register your local server app in Entra ID

  1. Navigate to the Azure Portal.

  2. Go to Microsoft Entra ID > App registrations > + New registration.

    Create a new application registration in Entra ID for the Keytos Shield Local RADIUS server

  3. Fill in the details for your application:

    • Name: Keytos Shield Local RADIUS Server
    • Supported account types: Single tenant only - <Your Organization Name>
    • Redirect URI: Leave this blank as the local server does not require a redirect URI.

  4. Click Register.

    Details for the Entra ID Application Registration for the Keytos Shield Local RADIUS server

Collapses this section and completes the checkmark.

How to Add API Permissions For Entra ID Username and Password Validation

Now that you have a new Entra ID application for the local RADIUS server, we need to give it permission to authenticate users against Entra ID if you plan to use EAP-TTLS Entra ID username and password authentication.

  1. Within your newly created Entra ID application, navigate to API permissions and click on Add a permission.

    API Permissions for Entra ID Application

  2. From the tab bar, select APIs my organization uses and search for “EZRADIUS”. Select the EZRADIUS API from the search results.

    Select the EZRADIUS API for the Local RADIUS server Application in Entra ID

  3. Select Delegated permissions, check the box for API.Access permission, and click Add permissions.

    Select API.Access permission for the Local RADIUS server Application in Entra ID

  4. Click on the button for Grant admin consent for <Your Organization Name> and click Yes to grant the necessary permissions for the local RADIUS server to authenticate users against Entra ID.

    Grant admin consent for the Local RADIUS server Application in Entra ID

Collapses this section and completes the checkmark.

How to Add API Permissions For Entra ID Group Checks and Intune Compliance Checks

For the local RADIUS server to renew its own client certificate, perform group membership checks, and perform Intune device compliance checks, it needs permissions to read directory data in Entra ID and to read the status of Intune devices.

  1. Within the Entra ID application you created for your local RADIUS server, navigate back to API permissions and click on Add a permission.

    API Permissions for Entra ID Application

  2. From the tab bar, select Microsoft APIs and then select Microsoft Graph.

    Select Microsoft Graph API for the Local RADIUS server Application in Entra ID

  3. Select Application permissions since these permissions are for the application itself to read directory data and Intune device status, not on behalf of a signed-in user.

  4. Search for and select the following permissions:

    • Application.ReadWrite.OwnedBy Allows the local RADIUS server service to renew its own client certificate by updating the application registration in Entra ID with the new certificate information when the certificate is close to expiring.
    • DeviceManagementManagedDevices.Read.All Allows it to check the device status on your Intune devices when using the Intune Device compliance check.
    • Directory.Read.All Allows it to read all directory data in your Entra ID tenant for Group membership checks and to check if the device or user is still active.

  5. Click Add permissions to add these permissions to the local RADIUS server application.

  6. Click Grant admin consent for <Your Organization Name> and click Yes to grant the necessary permissions for the local RADIUS server to perform certificate renewal, group membership checks, and Intune device compliance checks.

  7. Your application should now look like this (EZRADIUS > API.Access will only show if you completed the previous section for Entra ID username and password authentication):

    API Permissions for Local RADIUS Proxy Application in Entra ID

Collapses this section and completes the checkmark.

{completed} so far

Step 2 - How to Register a New Local RADIUS Server in Keytos Shield

Now that you have your Entra ID application set up for the local RADIUS server, you can proceed to register the new local RADIUS server in your Keytos Shield instance. This will allow you to download the configuration files needed to set up the local server container on your Linux machine.

Register a New Local RADIUS server in Keytos Shield

Follow these steps to register your local RADIUS server in Keytos Shield

How to Register a New Local RADIUS Server in Keytos Shield

  1. In another tab, navigate to your Keytos Shield portal. If you’re unsure, you can find your portal endpoint at portal.keytos.io.

  2. From the left-hand navigation bar, go to the Local server page.

    Local Server section in Keytos Shield for Local RADIUS

  3. Click the + New Local Server button to start the registration process for your local RADIUS server.

  4. Under New Local Server, enter the following details:

    • Friendly Name: Enter a name to identify your local RADIUS server (e.g., Main Office Local RADIUS Server).

    • Entra ID Application ID: The Application (client) ID from the Entra ID application you created for the local RADIUS server. You can find this in the Overview page of your Entra ID application.

      Application (client) ID for Entra ID Application

  5. (optional) If you’d like to send service logs to Azure Application Insights:

    1. Create an Application Insights resource for your RADIUS server.
    2. Copy your Application Insights connection string from the Azure Portal.
    3. Paste your Application Insights connection string local server registration form.

  6. (optional) For additional configuration you can expand Advanced Settings to configure additional settings.

    Note: The server will attempt to renew its own certificate once 75% of its lifetime has elapsed. The maximum certificate lifetime is determined by the maximum certificate validity period of you CA.

  7. Click Register Local Server

    Register Local RADIUS server for Local RADIUS in Keytos Shield

  8. You will be prompted to download a zip file with the configuration for your local RADIUS server. This zip file contains the necessary files to set up and run the local RADIUS server container on your Linux machine, including:

    • The RADIUS server configuration file script.sh, which contains your Docker run command with all the necessary environment variables and settings pre-configured based on the information you provided during registration.
    • A .pem file with the certificate Note: This file has the private key and should be kept secure.
    • A .cer file with the public certificate.

  9. Extract the zip file and keep it in a secure location. You will need the contents of this file to set up your local RADIUS server registration and container on your Linux machine in the next steps.

Collapses this section and completes the checkmark.

How to Upload the Client Certificate to Your Entra ID Application

  1. Back in the Azure Portal, navigate back to your Entra ID Application Registration that you previously created.

  2. Click on Certificates & secrets. select the Certificates tab and then click on Upload certificate to upload the .cer file from the zip file you downloaded from EZRADIUS. This will allow your local RADIUS server to authenticate to Entra ID using the client certificate when it performs authentication requests and certificate renewal.

    Certificates and Secrets for Entra ID Application

  3. Upload the .cer file from the zip file you downloaded from Keytos Shield (not the .pem file).

    Upload client certificate for Entra ID Application for Local RADIUS server

  4. Click Add to upload and associate the certificate with your Entra ID application.

Collapses this section and completes the checkmark.

{completed} so far

Step 3 - How to Run Your Shield Local RADIUS Server Docker Container

Now that you have registered your local Shield RADIUS server and set up the necessary Entra ID application, you can proceed to run the local RADIUS server container on your Linux machine using the configuration files you downloaded from Shield.

The following steps use the bash script that is included in the zip file you downloaded from EZRADIUS when you registered your local RADIUS proxy. This script will set up and run the Docker container for your local RADIUS proxy with all the necessary environment variables and configurations.

The following docker run command requires a volume mount for the client certificate that you downloaded from EZRADIUS, so make sure to update the path to the certificate file on your server in the --volume parameter. See the Docker Container reference section above for more details on the container specifications and environment variables. (For example: APPLICATION_INSIGHTS_CONNECTION_STRING is an optional variable.)

  1. SSH into or open a terminal window on the server where you want to deploy the RADIUS proxy.
  2. Create the directory where you want to deploy the RADIUS proxy. For this example we will use ~/Keytos/EZRADIUS/. 
    mkdir -p ~/Keytos/EZRADIUS/
  3. From your local machine, upload the contents of the zip file you downloaded from EZRADIUS to the server. You can use scp or any other method you prefer. For example: 
    scp path/to/your/downloaded/localserver_<GUID>.zip user@your-server-ip:/home/keytos-pi-0/Keytos/EZRADIUS/
  4. Back in the terminal on your server, navigate to the directory where you uploaded the zip file. 
    cd ~/Keytos/EZRADIUS/
  5. Unzip the zip file. 
    unzip localserver_<GUID>.zip
  6. Navigate into the unzipped directory. 
    cd localserver_<GUID>/
  7. Make the script executable. 
     chmod +x script.sh
  8. Run the script. 
    ./script.sh
  9. The script will install and configure the RADIUS proxy.

If you prefer to manually run the Docker container without using the provided bash script, you can use the docker run command that is included in the script.sh file. This command is pre-configured with all the necessary environment variables and settings based on the information you provided during registration of your local RADIUS proxy in EZRADIUS.

docker run --detach --restart=always --pull=always \
	--publish 1812:1812/udp --publish 1813:1813/udp --publish 2083:2083/tcp --publish 8080:8080 \
	--env LocalServer__providerEndpointUrl=https://local.<region>.ezradius.io/ \
	--env LocalServer__certificateFilePath=/app/certificate.pem \
	--env AppDetails__ClientID=<YourClientID> \
	--env AppDetails__AppID=<YourAppID> \
	--env AppDetails__HomeTenant=<YourHomeTenant> \
    --env APPLICATIONINSIGHTS_CONNECTION_STRING="<YourApplicationInsightsConnectionString>" \
	--volume <YourCertificateFile>.pem:/app/certificate.pem:rw \
	keytos-eqgzasb8bufxa0cd.azurecr.io/ezradius/local-server:latest

If you prefer to use Docker Compose to manage your local RADIUS proxy container, you can create a docker-compose.yml file with the following content. Make sure to update the environment variables and volume mount path with the correct values for your setup.

See the Docker Container reference section above for more details on the container specifications and environment variables. (For example: APPLICATION_INSIGHTS_CONNECTION_STRING is an optional variable.)

name: ezradius

services:
  local-server:
    image: keytos-eqgzasb8bufxa0cd.azurecr.io/ezradius/local-server:latest
    restart: always
    pull_policy: always
    ports:
      - "1812:1812/udp" # RADIUS authentication
      - "1813:1813/udp" # RADIUS accounting
      - "2083:2083/tcp" # RADIUS Over TLS (RadSec)
      - "8080:8080/tcp" # Health checks and management API
    environment:
      LocalServer__providerEndpointUrl: "https://local.<region>.ezradius.io/"
      LocalServer__certificateFilePath: "/app/certificate.pem"
      AppDetails__ClientID: "<YourClientID>"
      AppDetails__AppID: "<YourAppID>"
      AppDetails__HomeTenant: "<YourHomeTenant>"
      APPLICATIONINSIGHTS_CONNECTION_STRING: "<YourApplicationInsightsConnectionString>"
    volumes:
      - type: bind
        source: ./data/setup/<YourCertificateFile>.pem
        target: /app/certificate.pem
        read_only: false

Your local RADIUS server should now be up and running.

Step 4 - Connect Your Network Devices to Your Local RADIUS Server

Now that your local RADIUS server is up and running, you need to configure your network devices to point to it for authentication requests. This typically involves updating the RADIUS server settings on your devices to use the IP address of your local RADIUS server. Visit our set of network device configuration guides for detailed instructions on how to configure various types of network devices.

View Network Device Configuration Guides

We also recommend setting your backup/secondary RADIUS server to point to the Keytos Shield cloud servers. This ensures that if your local RADIUS server becomes unavailable, authentication requests can still be processed by the cloud servers, maintaining uninterrupted access for your users.