User Guide: AT-RADGate for VST-APL/VST-VRT version 1.2.0

# RADIUS Management

The "RADIUS Management" page has the following submenus: General, Proxy Settings, Active Directory Settings, and LDAP Server Settings, each of which allows you to configure settings related to authentication.
You can only change the settings if the account you are logged in with has the "Allow to configure system settings" privilege assigned to it. If no permissions are assigned, you can only view.

## General

RADIUS Management > General
On the User-Name Attribute Settings, EAP‑TLS Settings, and Trusted CA Certificate pages, you can configure the corresponding settings.

### User-Name Attribute Settings

RADIUS Management > General > User-Name Attribute Settings
You can choose to include or exclude the realm (domain) portion of the User-Name attribute during authentication. Click the "Edit" button at the bottom right to enter edit mode.
◼ Edit mode

Table 1: User-Name Attribute Settings
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
If the User-Name attribute contains '`\`' (e.g. DOMAIN`\`user), authenticate excluding the realm (domain) part. | − | Check box | If you check the checkbox, when the User-Name attribute contains '`\`', authentication is performed excluding the realm (domain) part.
If the User-Name attribute contains '@' (e.g. user@domain), authenticate with excluding the realm (domain) part. | − | Check box | If you check the checkbox, when the User-Name attribute contains '@', authentication is performed excluding the realm (domain) part.
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

### EAP-TLS Settings

RADIUS Management > General > EAP-TLS Settings
During EAP‑TLS authentication, it is possible to verify that the Common Name (CN) of the Client Certificate matches the value of the User‑Name attribute. Click the "Edit" button at the bottom right to enter edit mode.
◼ Edit mode

Table 2: EAP-TLS Settings
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
Verify that the certificate's Common Name (CN) matches the User‑Name attribute. | − | Check box | When the checkbox is selected, the system verifies during EAP‑TLS authentication that the Common Name (CN) of the Client Certificate matches the value of the User‑Name attribute. If they do not match, authentication is denied.
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

### Trusted CA Certificate

RADIUS Management > General > Trusted CA Certificate
The EAP-TLS authentication method uses an SSL client certificate instead of a password to authenticate users. Authentication is performed by verifying that the received SSL client certificate is signed by a CA that AT-RADgate trusts. This page allows you to manage the SSL Certificate of CAs trusted by AT-RADgate.
◼ Importing CA certificate
You can upload a CA certificate file in PEM format. If the CA Certificate is successfully imported, it is added to the list and a description of the CA Certificate, a "Detail" button, and a "Delete" button are displayed.

Table 3: Trusted CA Certificate
Item / Button Name | Description
--- | ---
Common Name(CN) | The value of the certificate's Common Name field.
Effective Date | The certificate's effective date.
Expiry Date | The expiration date of the certificate.
"Import" button | When you click it, "Import Certificate" and "Use local CA certificate" are displayed. Import Certificate : When you click it, a file selection dialog appears. Select the CA Certificate file and upload it. Use local CA certificate: This option is displayed only when a CA Certificate has been created on the CA Management page. The Certificate of the Local CA is used as a Trusted CA Certificate.
"Detail" button | The Certificate Detail dialog opens.
"Delete" button | Delete the CA Certificate.

#### Certificate Detail

Click the "Details" button on the Trusted CA Certificate page to display the "Certificate Detail" dialog.

Table 4: Certificate Detail
Item / Button Name | Description
--- | ---
Common Name (CN) | The value of the certificate's Common Name field.
Subject | The identity of the certificate's owner (user or server).
Serial Number | A unique number assigned to each certificate.
Effective Date | The certificate's effective date.
Expiry Date | The expiration date of the certificate.
Public Key Algorithm | This is the cryptographic algorithm used for the Certificate.
Fingerprint (SHA256) | This is the hash value of the Certificate.
Usage | This is the purpose of the Certificate.
"Close" button | Close the Certificate Detail dialog.

## Proxy Settings

RADIUS Management > Proxy Settings
You can configure the RADIUS Proxy function.

> Note

> > In order for the RADIUS Server to receive packets from a RADIUS Proxy, you must register the RADIUS Proxy on the Policy Management > NAS > RADIUS Proxy page.

> Note

> > Proxying CoA/Disconnect packets is not supported.

### General

RADIUS Management > Proxy Settings > General
You can select whether to forward only the User-Name attribute of the received RADIUS packet if the user is not registered in the authentication policy of this server. Click the "Edit" button at the bottom right to enter edit mode.
◼ Edit mode

Table 5: General
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
Forwarding only users not registered to this server's authentication policy. | × | Check box | If you check the check box, the received authentication request is treated as a packet to be forwarded only if the User-Name attribute does not exist in the authentication policy of this server. The final decision on whether to forward the request depends on the result of realm analysis by the proxy rules. Note The authentication policies in question are User policies and Endpoint policies.
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

### Proxy Rules

RADIUS Management > Proxy Settings > Proxy Rules
Manage proxy rules.
A list of registered proxy rules is displayed.
A proxy rule defines whether to forward received RADIUS packets and, if so, to which server.

Table 6: Proxy Rule
Item / Button Name | Description
--- | ---
Realm (Domain) | The value of the registered realm is displayed. The realm part of the User-Name attribute is used to determine if it applies to this realm.
Proxy | If "Do", it means that RADIUS packets are forwarded if the realm part of the User-Name attribute corresponds to this realm. If "Don't" is selected, it means that RADIUS packets are not forwarded even if the realm part of the User-Name attribute corresponds to this realm.
"Add" button | Open the Proxy Rule dialog.

#### Proxy Rules

Clicking the "Add" button in the upper right corner of the Proxy Rules displays the Proxy Rule dialog, where you can add a new proxy rule. Clicking the "Edit" menu on the right side of an already registered proxy rule displays the Proxy Rule dialog, allowing you to edit the proxy rule.
The two dialogs share a common form.

Table 7: Proxy Rule
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
Condition | − | Realm / No Realm / Default | "No Realm" means that there is no delimiter (see "Realm Parsing Rules" for more information). "Default" means that no such realm exists.
Realm (Domain) | × | String (Max 63 characters) | This is displayed and can be entered only if you select "Realm" in the "Condition" item. If you select anything other than "Realm", it is hidden. Any character from A-Za-z0-9._- can be used. "LOCAL", "DEFAULT", and "NULL" cannot be registered.
Forwarding Servers | − | − | The server to which RADIUS packets are forwarded. You can select from the IP addresses registered in the "Forwarding Servers" settings. You can add a destination server to the list of Forwarding Servers by selecting it and clicking the "Add" button. If multiple destination servers are registered, the one at the top of the list has the highest priority, and the further down the list the lower the priority.
"Add" button | − | − | Add the destination server to the Forwarding Servers list in "Proxy Rules".
"Delete" button | − | − | Remove the Forwarding Server from the Forwarding Servers list in "Proxy Rules".
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

#### Realm

The RADIUS Proxy finds the realm part of the User-Name attribute of the received RADIUS packet and compares it with the realms of the registered proxy rules. If a matching proxy rule is found, the RADIUS packet is forwarded to the destination server associated with that proxy rule.

##### Realm Delimiter Characters

The delimiter is used to find the realm portion of the User-Name attribute.

Table 8: Realm Delimiter Characters
Delimiter | Description
--- | ---
`\` | For a User-Name attribute such as Realm`\`User, the part before `\` is the realm.
@ | If you have a User-Name attribute like User@Realm, the part after the @ is the realm.

##### Realm Parsing Rules

The rules for determining the realm are as follows:

- If no such realm exists, it is treated as the "default" realm.
- If there is no "default" realm configured, then the server will authenticate to its own server without proxying.
- Even if the realm is determined, if the destination server is not bound to the realm, authentication will be performed on the server itself without proxying.

### Forwarding Servers

RADIUS Management > Proxy Settings > Forwarding Servers
Manage Forwarding Servers.
A list of registered Forwarding Servers is displayed.
The Forwarding Servers define the server to which the received RADIUS packets are forwarded.

Table 9: Forwarding Server
Item / Button Name | Description
--- | ---
Server Address | This is the IP address of the registered Forwarding Servers.
"Add" button | Open the Forwarding Servers dialog.

#### Forwarding Servers

Clicking the "Add" button in the upper right corner of the Forwarding Servers display the Forwarding Server dialog, allowing you to add a new Forwarding Server. If you click the "Edit" menu on the right side of a Forwarding Server that has already been registered, the Forwarding Server dialog appears, allowing you to edit the Forwarding Server.
The two dialogs share a common form.

Table 10: Forwarding Server
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
IPv4 Address | × | IPv4 Address | This is the IP address of the Forwarding Servers.
Authentication Port Number | − | 1-65535 | The port number on which the Forwarding Server receives authentication packets. If left blank and saved, the default value of 1812 is used.
Accounting Port Number | − | 1-65535 | The port number on the Forwarding Server to receive accounting packets. If left blank and saved, the default value of 1813 is used.
"Configure Pre-Shared Key" button | − | − | This is only displayed in the dialog when editing the Forwarding Server. Clicking this displays the "Pre-shared Key" item, allowing you to change the pre-shared key.
Pre-Shared Key | × | Password | The pre-shared key for the Forwarding Server.
Timeout | × | 5-60 | The time to wait for a response from the Forwarding Server when forwarding a RADIUS packet.
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

#### Failover/Failback

The RADIUS Proxy maintains the status of Forwarding Servers. If multiple Forwarding Servers are registered, and the Forwarding Server with the highest priority goes down, the proxy fails over to the Forwarding Server with the next highest priority. Also, if a Forwarding Server that was down recovers, it is failed back based on the original priority. The conditions are as follows:
If the transfer of a RADIUS packet to the Forwarding Server fails, or if the transfer is successful but there is no response before the timeout setting is reached, the server is considered down after 40 seconds, and an attempt is made to transfer the packet to another Forwarding Server with a lower priority.
AT-RADgate assumes that a Forwarding Server that it has deemed down has recovered after 120 seconds and attempts to forward the RADIUS packet again.

Table 11: Glossary
Glossary | Description
--- | ---
Failover | This is a function that automatically switches to the next highest priority Forwarding Server and continues processing when the RADIUS Proxy determines that it is no longer able to exchange RADIUS packets with the Forwarding Server.
Failback | This is a function that returns processing from a lower priority Forwarding Server to the original higher priority Forwarding Server when a higher priority Forwarding Server that was unable to exchange RADIUS packets recovers.

## Active Directory Settings

RADIUS Management > Active Directory Settings
Configure the Active Directory domain to be linked with Windows Active Directory for RADIUS Authentication. Click the "Edit" button at the bottom right to enter edit mode.
If an Active Directory domain is not registered, the message "Active Directory domain is not set." is displayed. If registered, information about the currently registered Active Directory domain is displayed.

> Note

> > The following Windows Active Directory on Windows Server is available.
> > Windows Server 2019 (Standard and Datacenter editions)
> > Windows Server 2022 (Standard and Datacenter editions)
> > Windows Server 2025 (Standard and Datacenter editions)

> Note

> > LDAP authentication and Windows Active Directory authentication cannot be used together.

◼ Edit mode
◼ After registration

Table 12: Domain Information
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
Domain Name | × | String (Max 255 characters) | Enter the Active Directory domain name.
NetBIOS Name | × | String (Max 63 characters) | Enter the NetBIOS name. For example, if the Active Directory domain name is "example.co.jp", enter "EXAMPLE" as the NetBIOS name.
Character Set | × | String | Enter the character code setting for the domain controller. The default is "CP1252" (Latin 1/Western European). Note Use the default setting, "CP1252". Changing to “CP932” (Japanese/Shift-JIS) is not supported in this version.
"Edit" button | − | − | Start editing.
"Cancel" button | − | − | Stop editing.
"Join" button | − | − | Save your edits and join the Active Directory domain.
"Leave" button | − | − | The Domain Controller Administrator Account dialog appears. Click this when leaving the Active Directory domain or when deleting the Active Directory domain settings of AT‑RADgate.

#### Domain Controller Administrator Account

Leave the Active Directory domain by accessing the Active Directory Domain Controller.
If the check box is selected, the device leaves the Active Directory domain and the Active Directory domain settings of AT-RADgate are also removed.
If the check box is not selected, the Active Directory domain settings of AT-RADgate are removed. In this case, the User Name and Password are not entered (the input fields for the User Name and Password are disabled).

Table 13: Domain Controller Administrator Account
Item / Button Name | Description
--- | ---
User Name | Enter the user name for the Active Directory domain. This field is entered when the check box for “Leave the Active Directory domain by accessing the Active Directory Domain Controller.” is selected.
Password | Enter the password for the Active Directory domain. This field is entered when the check box for “Leave the Active Directory domain by accessing the Active Directory Domain Controller.” is selected.
"Cancel" button | Cancel leaving the Active Directory domain or deleting the Active Directory domain settings of AT-RADgate.
"Leave" button | Leave the Active Directory domain or delete the Active Directory domain settings of AT-RADgate.

## LDAP Server Settings

RADIUS Management > LDAP Server Settings
If you enable the LDAP Server authentication function, you can authenticate users using user information registered in the LDAP Server instead of the user policy in your own authentication database. The authentication protocol used is PAP or EAP-TTLS (PAP).

> Note

> > Only the following Windows Active Directory servers are available for use as LDAP servers.
> > Windows Server 2019 (Standard and Datacenter editions)
> > Windows Server 2022 (Standard and Datacenter editions)

> Note

> > Certificate validation is not performed during communication between the LDAP Server and the RADIUS Server.

> Note

> > LDAP authentication and Windows Active Directory authentication cannot be used together.

Configure the settings for linking with the LDAP Server. Click the "Edit" button at the bottom right to enter edit mode.
If the LDAP Server is not registered, the message "LDAP server is not configured." is displayed. If registered, information about the currently registered LDAP Server is displayed.
◼ Edit mode

Table 14: LDAP Server Settings
Item / Button Name | Mandatory | Format | Description
--- | --- | --- | ---
Hostname / IP Address | × | Hostname / IP Address | The host name or IP address of the LDAP Server.
Port Number | × | 1-65535 | The port number of the LDAP Server. The default port number is 389.
Base DN | × | String (Max 255 characters) | The distinguished name at which to begin a search in the LDAP directory.
Bind DN | × | String (Max 63 characters) | The distinguished name of the user to use when authenticating (binding) to the LDAP Server.
Password | × | String (Max 63 characters) | This is the password used in combination with the bind DN (user distinguished name) for authentication when binding to the LDAP Server.
"Connection Test" button | − | − | Test whether you can connect to the LDAP Server.
"Cancel" button | − | − | Stop editing.
"Save" button | − | − | Save the settings.

29 Jan 2026 17:20