Platform Planes
| Plane | What it handles |
|---|---|
| Data plane | RadSec ingress, TLS termination, NAS identity, Access-Request handling, Accounting-Request handling, and dynamic authorization packet flow. |
| Control plane | Web UI, REST API, users, folders, groups, realms, NAS devices, certificates, quotas, metadata, workflows, and configuration changes. |
| Analytics plane | Authentication logs, accounting data, usage metrics, accounting triggers, search, dashboards, and insight queries. |
Request Flow
The NAS connects to the global ingress
A NAS device starts a RadSec connection to the global service endpoint. Global routing sends the connection to the nearest healthy regional deployment rather than waiting on DNS propagation.
Regional load balancing keeps the data plane fast
The connection reaches a regional Network Load Balancer, which forwards the TCP flow to the RadSec proxy layer running on containerized infrastructure.
The edge verifies the client certificate
The RadSec edge uses mutual TLS and validates the NAS certificate against the client CA issued for the workspace.
The edge binds traffic to the registered NAS
The certificate identifies the workspace, organization, and NAS. The edge rewrites the
NAS-Identifier to the registered NAS identity, so authorization and logs rely on the trusted certificate identity instead of a mutable packet field.Authentication requests go to the RADIUS backend
Access requests are handled by horizontally scalable RADIUS server tasks and translated into secure, region-local API calls for policy evaluation, password handling, check attributes, realm logic, quota state, and reply attributes.
Accounting is handled without slowing auth
Accounting and post-authentication data are streamed into the analytics plane so accounting load does not block authentication throughput.
Authentication Behavior
The policy service supports common access patterns used by broadband, Wi-Fi, VPN, and network-access devices:- PAP-style password authentication.
- CHAP authentication when the NAS sends CHAP attributes.
- MS-CHAP and MS-CHAPv2, including NT password material needed by FreeRADIUS.
- EAP challenge handling where the upstream RADIUS flow needs to continue the exchange.
- MAC-based lookup using Calling-Station-Id or MAC-like usernames.
- Optional auto-registration for unknown MAC-based users when the NAS allows it.
NAS-Identifier; RadSec traffic is normalized to the NAS identity from the client certificate.
Why The Architecture Scales
| Layer | Scaling behavior |
|---|---|
| Global ingress | Routes RadSec traffic to the nearest healthy regional deployment and can fail over across regions without waiting for DNS changes. |
| Network load balancing | Uses high-performance Layer 4 regional load balancing for TCP/RadSec traffic. |
| RadSec edge | Uses a concurrent Go runtime with a goroutine per NAS connection and per-client UDP backend handling to avoid contention between devices. |
| RADIUS core | Runs as horizontally scalable container tasks so authentication capacity can grow with live traffic. |
| Internal API | Uses serverless regional API workers for elastic policy evaluation and management operations. |
| Device identity | Uses mTLS certificate validation so the platform can trust which workspace, organization, and NAS produced the traffic. |
| Policy lookup | Caches NAS devices, authentication profiles, and group profiles for short windows to reduce repeated database reads during busy authentication periods. |
| Data storage | Uses DynamoDB-backed records, global replication, write sharding, sharded counters, and deterministic username sharding for fast lookups and hot-partition protection. |
| Logs | Uses sharded log access patterns so recent operational views can page through high-volume NAS logs without loading broad time ranges into memory. |
| Analytics | Streams accounting and post-auth events independently of the authentication path, then stores time-series data for dashboards, triggers, and insight queries. |
| Quotas | Reads quota status from a DynamoDB quota table during authorization, while scheduled workers refresh quota state from accounting usage data. |
| Imports | Large migration jobs stream CSV rows in chunks instead of loading entire files into memory, with lookup data prefetched once for the batch. |
Data Plane Responsibilities
The RadSec edge handles:- Global and regional ingress for RadSec traffic.
- TLS termination for RadSec.
- Client certificate authentication.
- Registered NAS identity extraction.
- RADIUS packet framing and forwarding.
NAS-Identifiernormalization.- Accounting response generation.
- Accounting metric extraction.
- Session start, stop, usage, and last-IP metric publishing.
- Dynamic authorization metric extraction for Disconnect and CoA packets when observed.
Control Plane Responsibilities
The RADIUS service handles:- NAS registration and certificate material.
- User, folder, group, realm, tag, and metadata management.
- Check and reply attribute validation.
- Password storage and reset flows.
- PAP, CHAP, MS-CHAP, and MS-CHAPv2 handling.
- EAP challenge pass-through behavior where applicable.
- Realm matching and optional NAS-to-realm locking.
- MAC-based lookup and optional auto-registration.
- Quota status checks and top-ups.
- Manual session disconnects.
- Authentication metrics and NAS logs.
Control Plane
The control plane is the management surface used by operators and integrations. The web UI and REST API manage configuration changes through authenticated and authorized API calls. Use the control plane for:- Creating and updating users, folders, groups, realms, and NAS devices.
- Managing certificate material and RadSec device configuration.
- Updating check attributes, reply attributes, metadata, tags, quotas, and account status.
- Connecting provisioning, billing, identity management, and workflow systems through the API.
- Searching operational records and reviewing logs.
Analytics Plane
The analytics plane receives accounting and post-authentication events from the data plane. It is designed for high-throughput ingestion and fast time-series queries across historical RADIUS events. Use the analytics plane for:- Authentication logs and 12-month log retention.
- Accounting data and 12-month accounting retention.
- Usage charts, sessions, quotas, and top-ups.
- Accounting triggers, such as usage-threshold automation.
- Dashboards, Live View, and insight queries.
- Full-text operational search.
Quota And Session Control Path
Quota enforcement is deliberately split:- Groups define quota attributes such as
X-Octet-Quotaand reset behavior. - Accounting packets update usage metrics.
- Scheduled quota workers calculate current usage, apply active top-ups, and write quota state.
- Authorization reads the current quota state during login.
- When a user first crosses quota, the platform can dispatch a disconnect workflow for the active session.
Multi-Tenant Isolation
The platform uses several layers of isolation:- NAS traffic is tied to a certificate identity.
- Authorization rejects unknown NAS devices.
- Users must belong to the same customer as the NAS.
- Realms can limit which group attributes apply for a matching username suffix.
- NAS devices can be locked to a realm when that behavior is configured.
Metrics And Observability
RADIUS operations feed the monitoring views with:- Access-Accept, Access-Reject, and Access-Challenge counters.
- Reject reasons when available.
- Accounting packets by status type.
- Input and output bytes, including 64-bit Gigawords accounting.
- Input and output packets.
- Session time.
- Session start and stop timestamps.
- Last observed framed IP address.
- Admin request events for Disconnect and CoA.
Operational Implications
- Use RadSec certificates from the NAS detail page rather than sharing credentials between devices.
- Keep accounting enabled when you rely on usage, sessions, quotas, top-ups, or disconnect workflows.
- Use groups for policy because group profiles are cache-friendly and reusable.
- Use realms when username suffixes should constrain policy.
- Use CoA and PoD only on devices that support dynamic authorization and allow the configured source address.
- Review Limits and Availability before large migrations, high-rate authentication deployments, or multi-region planning.