RADIUS (Remote Authentication Dial-In User Service) is a client-server protocol that centrally authenticates users who want to join a network, authorizes what they may access, and records their usage. It has three roles: authentication (who is the user?), authorization (what may they reach?) and accounting (when and how much did they connect?). Acting as a RADIUS server, SignLogger manages all three from a single point across hotspot/captive portal, NAC/802.1x and VPN 2FA scenarios.
This content is for general information only and does not constitute legal advice. Always verify your obligations for your own organization with current regulations and expert counsel.
How Does the RADIUS Protocol Work?
A RADIUS deployment has three core components: the user (supplicant), the access device (NAS - Network Access Server; a firewall, wireless controller, VPN gateway or switch) and the RADIUS server. When a user tries to connect, the access device forwards the supplied credentials to the RADIUS server. The server validates them against a local database, LDAP/Active Directory, SMS-OTP or another source, then returns an "accept" or "reject" response to the access device.
The three pillars of the protocol are:
- Authentication: verifying that the identity a user claims genuinely belongs to them.
- Authorization: deciding which VLAN, speed limit, session duration or resource permissions the verified user receives.
- Accounting: recording session start/end, assigned IP and data used. These records form the basis of traceability.
In Which Scenarios Is SignLogger Used as a RADIUS Server?
SignLogger is brand-independent; it works with any firewall, wireless controller or VPN device that supports RADIUS, and runs entirely on the organization's own infrastructure (VMware/Hyper-V). Data never leaves the premises. The same RADIUS engine serves different needs:
| Scenario | Access device | RADIUS method | Typical purpose |
|---|---|---|---|
| Hotspot / Captive Portal | Firewall, wireless controller | PAP | Guest/visitor Wi-Fi, Law 5651 identification |
| NAC / Corporate LAN-Wi-Fi | Switch, wireless AP | 802.1x (EAP) | Device- and user-based network access control |
| VPN 2FA | VPN gateway | RADIUS + OTP | Second-step verification for remote access |
Captive Portal and Law 5651: Identification via RADIUS
Businesses that offer public internet must identify their visitors. In SignLogger's captive portal solution, the user declares their identity on the landing page (for example via SMS verification), and the firewall passes this information to SignLogger over RADIUS using PAP only. In a captive portal scenario PEAP or EAP-TTLS is not used; PAP is the expected standard method between the portal and the firewall. The accounting records of the verified session become access logs showing which user connected with which IP and when.
SignLogger signs these logs every day with the timestamp and e-signature of TÜBİTAK Kamu SM, an authorized electronic certificate authority, guaranteeing the integrity and time accuracy of the records. The Kamu SM timestamp works with credits (kontör). For details, see our hotspot management solution page. Base your retention period and accepted identification methods on current regulations.
NAC and 802.1x: RADIUS on the Corporate Network
On corporate LAN and Wi-Fi the goal is to admit only authorized devices and users. Here RADIUS works together with the 802.1x standard using EAP-based methods; verification happens per port and the user is steered to the correct VLAN. This is a different layer from the guest portal and provides stronger corporate control. Explore the end-to-end approach on our NAC (network access control) solution page.
VPN 2FA: A Second Step for Remote Access
A password alone is not enough for remote workers. During the VPN gateway's RADIUS requests, SignLogger adds a one-time code (OTP) layer on top of username-password verification. This way, even if a password is compromised, access does not occur without the second step. For setup details, see our VPN 2FA two-factor authentication solution page.
Frequently Asked Questions
What is the difference between RADIUS and TACACS+?
RADIUS is common for network access verification (should a user/device join the network?) and carries authentication and authorization together. TACACS+ is used more for network device administration (administrator command authorization). SignLogger relies on RADIUS for access scenarios.
Why is only PAP used for captive portal?
In the captive portal architecture the RADIUS flow between portal and firewall runs on PAP; PEAP or EAP-TTLS is not recommended in this scenario. EAP-based methods belong to 802.1x corporate access, not the guest portal.
Which firewalls and devices does SignLogger work with?
SignLogger is brand-independent. It is compatible with any firewall, wireless controller or VPN gateway that supports RADIUS, creating no lock-in to a specific vendor.
Where are the logs stored?
SignLogger runs on the organization's own infrastructure (VMware/Hyper-V) and logs are kept on-premises; data does not leave the company.
How is log signing performed?
SignLogger signs access logs every day with the timestamp and e-signature of the authorized certificate authority TÜBİTAK Kamu SM. The Kamu SM timestamp works with credits, providing integrity and time assurance.
Why are accounting records important?
Accounting records show which user connected with which IP and when. This information is the foundation of traceability and legal identification obligations.