{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "slug": "dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies", "url": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/" }, "title": "Validate the complete firewall path for RADIUS requests and replies", "summary": "Which firewall paths must work between RADIUS clients, proxies, and NPS?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:46+00:00", "modified_at": "2026-09-08T18:29:33+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Network administrators reviewing firewall rules for an NPS-based RADIUS deployment.", "dse_recommendation": "Build a rule matrix naming each client or proxy address, NPS endpoint, request type, UDP port, and return path.", "primary_source": { "name": "Configure Firewalls for RADIUS Traffic", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-firewalls-configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft warns that incorrectly filtered RADIUS traffic between access clients, proxies, and servers can prevent network authentication. The documented default NPS UDP ports are 1812, 1813, 1645, and 1646, with local firewall exceptions normally configured during installation. For Windows Server 2019, Microsoft requires changing the IAS service security identifier for that firewall exception; without the change, RADIUS traffic is dropped. For additional restriction, the source describes filtering with the individual RADIUS clients’ addresses rather than an unrestricted set of senders. Microsoft Learn.

\n

Applicability

\n

Identify every firewall crossed by the actual RADIUS path and record the configured authentication and accounting ports. Review the source’s operating-system-specific notes for the NPS server. Keep local listener selection separate from the network rules that permit requests and responses.

\n

DSE recommendation

\n

Build a rule matrix naming each client or proxy address, NPS endpoint, request type, UDP port, and return path. Have both the access-device and firewall owners compare their settings against the same matrix. Preserve the existing rules and pilot one device before broad deployment. Treat an unnecessary source range or open port as a design question requiring an explicit owner.

\n

Verification

\n

Generate a controlled authentication request and a corresponding accounting event where applicable. Correlate device, firewall, and NPS observations to show that both required directions pass. Test a sender that should be excluded. Investigate accounting loss independently from authentication success and record the actual rule responsible for each observed path.

\n

Official references

\n

Microsoft Learn: Configure Firewalls for RADIUS Traffic. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft warns that incorrectly filtered RADIUS traffic between access clients, proxies, and servers can prevent network authentication. The documented default NPS UDP ports are 1812, 1813, 1645, and 1646, with local firewall exceptions normally configured during installation. For Windows Server 2019, Microsoft requires changing the IAS service security identifier for that firewall exception; without the change, RADIUS traffic is dropped. For additional restriction, the source describes filtering with the individual RADIUS clients’ addresses rather than an unrestricted set of senders. Microsoft Learn.\nApplicability\nIdentify every firewall crossed by the actual RADIUS path and record the configured authentication and accounting ports. Review the source’s operating-system-specific notes for the NPS server. Keep local listener selection separate from the network rules that permit requests and responses.\nDSE recommendation\nBuild a rule matrix naming each client or proxy address, NPS endpoint, request type, UDP port, and return path. Have both the access-device and firewall owners compare their settings against the same matrix. Preserve the existing rules and pilot one device before broad deployment. Treat an unnecessary source range or open port as a design question requiring an explicit owner.\nVerification\nGenerate a controlled authentication request and a corresponding accounting event where applicable. Correlate device, firewall, and NPS observations to show that both required directions pass. Test a sender that should be excluded. Investigate accounting loss independently from authentication success and record the actual rule responsible for each observed path.\nOfficial references\nMicrosoft Learn: Configure Firewalls for RADIUS Traffic. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft warns that incorrectly filtered RADIUS traffic between access clients, proxies, and servers can prevent network authentication. The documented default NPS UDP ports are 1812, 1813, 1645, and 1646, with local firewall exceptions normally configured during installation. For Windows Server 2019, Microsoft requires changing the IAS service security identifier for that firewall exception; without the change, RADIUS traffic is dropped. For additional restriction, the source describes filtering with the individual RADIUS clients’ addresses rather than an unrestricted set of senders. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-firewalls-configure).\n\n## Applicability\n\nIdentify every firewall crossed by the actual RADIUS path and record the configured authentication and accounting ports. Review the source’s operating-system-specific notes for the NPS server. Keep local listener selection separate from the network rules that permit requests and responses.\n\n## DSE recommendation\n\nBuild a rule matrix naming each client or proxy address, NPS endpoint, request type, UDP port, and return path. Have both the access-device and firewall owners compare their settings against the same matrix. Preserve the existing rules and pilot one device before broad deployment. Treat an unnecessary source range or open port as a design question requiring an explicit owner.\n\n## Verification\n\nGenerate a controlled authentication request and a corresponding accounting event where applicable. Correlate device, firewall, and NPS observations to show that both required directions pass. Test a sender that should be excluded. Investigate accounting loss independently from authentication success and record the actual rule responsible for each observed path.\n\n## Official references\n\n[Microsoft Learn: Configure Firewalls for RADIUS Traffic](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-firewalls-configure). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "url": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate the complete firewall path for RADIUS requests and replies", "item": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "url": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/", "headline": "Validate the complete firewall path for RADIUS requests and replies", "description": "Which firewall paths must work between RADIUS clients, proxies, and NPS?", "abstract": "Which firewall paths must work between RADIUS clients, proxies, and NPS?", "articleBody": "Source facts\nMicrosoft warns that incorrectly filtered RADIUS traffic between access clients, proxies, and servers can prevent network authentication. The documented default NPS UDP ports are 1812, 1813, 1645, and 1646, with local firewall exceptions normally configured during installation. For Windows Server 2019, Microsoft requires changing the IAS service security identifier for that firewall exception; without the change, RADIUS traffic is dropped. For additional restriction, the source describes filtering with the individual RADIUS clients’ addresses rather than an unrestricted set of senders. Microsoft Learn.\nApplicability\nIdentify every firewall crossed by the actual RADIUS path and record the configured authentication and accounting ports. Review the source’s operating-system-specific notes for the NPS server. Keep local listener selection separate from the network rules that permit requests and responses.\nDSE recommendation\nBuild a rule matrix naming each client or proxy address, NPS endpoint, request type, UDP port, and return path. Have both the access-device and firewall owners compare their settings against the same matrix. Preserve the existing rules and pilot one device before broad deployment. Treat an unnecessary source range or open port as a design question requiring an explicit owner.\nVerification\nGenerate a controlled authentication request and a corresponding accounting event where applicable. Correlate device, firewall, and NPS observations to show that both required directions pass. Test a sender that should be excluded. Investigate accounting loss independently from authentication success and record the actual rule responsible for each observed path.\nOfficial references\nMicrosoft Learn: Configure Firewalls for RADIUS Traffic. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:46+00:00", "dateModified": "2026-09-08T18:29:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-205-validate-the-complete-firewall-path-for-radius-requests-and-replies/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate the complete firewall path for RADIUS requests and replies" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Firewalls for RADIUS Traffic", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-firewalls-configure" } } ] } }