{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "slug": "dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces", "url": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/" }, "title": "Bind NPS RADIUS traffic to the intended network interfaces", "summary": "Which interfaces and UDP ports should an NPS server use for RADIUS?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:10+00:00", "modified_at": "2026-09-08T18:26:32+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 224, "potentially_affected": "Administrators configuring Network Policy Server on a multihomed Windows server.", "dse_recommendation": "Write an interface-and-port matrix before changing the NPS Ports settings.", "primary_source": { "name": "Configure NPS on a Multihomed Computer", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-multihomed-configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

By default, NPS listens for IPv4 and IPv6 RADIUS traffic on every installed network adapter using ports 1812, 1813, 1645, and 1646. Administrators can specify particular adapters when they need to exclude an interface from RADIUS traffic. Microsoft requires access servers to use the same RADIUS port numbers as NPS and notes that some devices use the older 1645 and 1646 defaults. Microsoft Learn.

\n

Applicability

\n

Inventory the server interfaces, their intended purpose, and the authentication and accounting ports configured on each access device. Treat IPv4 and IPv6 as explicit entries. Do not infer that an adapter intended only for management is excluded from NPS listening.

\n

DSE recommendation

\n

Write an interface-and-port matrix before changing the NPS Ports settings. Include the exact local address, protocol family, request type, and permitted access devices. Have the network owner compare it with the corresponding device settings and firewall rules. Preserve the original configuration and pilot one access path before changing all devices. Define how operators will recover access if the expected listener is unavailable.

\n

Verification

\n

Send controlled authentication and accounting requests from representative access devices and confirm their arrival on the intended interface. Check an excluded interface as a negative case. Record listener settings, device port values, and correlated results; investigate a silent accounting path separately from a successful sign-in.

\n

Official references

\n

Microsoft Learn: Configure NPS on a Multihomed Computer. Source reviewed September 8, 2026.

", "content_text": "Source facts\nBy default, NPS listens for IPv4 and IPv6 RADIUS traffic on every installed network adapter using ports 1812, 1813, 1645, and 1646. Administrators can specify particular adapters when they need to exclude an interface from RADIUS traffic. Microsoft requires access servers to use the same RADIUS port numbers as NPS and notes that some devices use the older 1645 and 1646 defaults. Microsoft Learn.\nApplicability\nInventory the server interfaces, their intended purpose, and the authentication and accounting ports configured on each access device. Treat IPv4 and IPv6 as explicit entries. Do not infer that an adapter intended only for management is excluded from NPS listening.\nDSE recommendation\nWrite an interface-and-port matrix before changing the NPS Ports settings. Include the exact local address, protocol family, request type, and permitted access devices. Have the network owner compare it with the corresponding device settings and firewall rules. Preserve the original configuration and pilot one access path before changing all devices. Define how operators will recover access if the expected listener is unavailable.\nVerification\nSend controlled authentication and accounting requests from representative access devices and confirm their arrival on the intended interface. Check an excluded interface as a negative case. Record listener settings, device port values, and correlated results; investigate a silent accounting path separately from a successful sign-in.\nOfficial references\nMicrosoft Learn: Configure NPS on a Multihomed Computer. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nBy default, NPS listens for IPv4 and IPv6 RADIUS traffic on every installed network adapter using ports 1812, 1813, 1645, and 1646. Administrators can specify particular adapters when they need to exclude an interface from RADIUS traffic. Microsoft requires access servers to use the same RADIUS port numbers as NPS and notes that some devices use the older 1645 and 1646 defaults. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-multihomed-configure).\n\n## Applicability\n\nInventory the server interfaces, their intended purpose, and the authentication and accounting ports configured on each access device. Treat IPv4 and IPv6 as explicit entries. Do not infer that an adapter intended only for management is excluded from NPS listening.\n\n## DSE recommendation\n\nWrite an interface-and-port matrix before changing the NPS Ports settings. Include the exact local address, protocol family, request type, and permitted access devices. Have the network owner compare it with the corresponding device settings and firewall rules. Preserve the original configuration and pilot one access path before changing all devices. Define how operators will recover access if the expected listener is unavailable.\n\n## Verification\n\nSend controlled authentication and accounting requests from representative access devices and confirm their arrival on the intended interface. Check an excluded interface as a negative case. Record listener settings, device port values, and correlated results; investigate a silent accounting path separately from a successful sign-in.\n\n## Official references\n\n[Microsoft Learn: Configure NPS on a Multihomed Computer](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-multihomed-configure). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "url": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Bind NPS RADIUS traffic to the intended network interfaces", "item": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "url": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/", "headline": "Bind NPS RADIUS traffic to the intended network interfaces", "description": "Which interfaces and UDP ports should an NPS server use for RADIUS?", "abstract": "Which interfaces and UDP ports should an NPS server use for RADIUS?", "articleBody": "Source facts\nBy default, NPS listens for IPv4 and IPv6 RADIUS traffic on every installed network adapter using ports 1812, 1813, 1645, and 1646. Administrators can specify particular adapters when they need to exclude an interface from RADIUS traffic. Microsoft requires access servers to use the same RADIUS port numbers as NPS and notes that some devices use the older 1645 and 1646 defaults. Microsoft Learn.\nApplicability\nInventory the server interfaces, their intended purpose, and the authentication and accounting ports configured on each access device. Treat IPv4 and IPv6 as explicit entries. Do not infer that an adapter intended only for management is excluded from NPS listening.\nDSE recommendation\nWrite an interface-and-port matrix before changing the NPS Ports settings. Include the exact local address, protocol family, request type, and permitted access devices. Have the network owner compare it with the corresponding device settings and firewall rules. Preserve the original configuration and pilot one access path before changing all devices. Define how operators will recover access if the expected listener is unavailable.\nVerification\nSend controlled authentication and accounting requests from representative access devices and confirm their arrival on the intended interface. Check an excluded interface as a negative case. Record listener settings, device port values, and correlated results; investigate a silent accounting path separately from a successful sign-in.\nOfficial references\nMicrosoft Learn: Configure NPS on a Multihomed Computer. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:10+00:00", "dateModified": "2026-09-08T18:26:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-181-bind-nps-radius-traffic-to-the-intended-network-interfaces/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Bind NPS RADIUS traffic to the intended network interfaces" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 224, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure NPS on a Multihomed Computer", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-multihomed-configure" } } ] } }