portnox/portnox-radius repository overview

⁠Portnox local RADIUS server

The Portnox local RADIUS server is an optional on-prem component of Portnox Cloud. It lets clients keep authenticating when the connection to the cloud is unavailable, most commonly during an internet outage. If your switches or other NAS devices point to the local RADIUS server instead of Portnox Cloud RADIUS, the local server detects an outage and authenticates previously known clients, those that authenticated within the last 7 days, for as long as the outage lasts. These fallback authentications rely on MAC addresses rather than full certificate or credential checks, so they are meant as a temporary bridge, not a replacement for cloud authentication.

You can deploy the container by copying the ready-made run command from Portnox Cloud, or by copying only the environment variables and building a custom command. A custom command is recommended for experienced users, since it allows options such as persistent cache storage. With persistent storage, the container keeps authenticating known clients from cache even after a restart, so a container restart during an outage does not interrupt fallback authentication.

⁠Deploy on Linux

Copy the following three values from your Portnox Cloud tenant and export them as environment variables:

export RADIUS_GATEWAY_ORG_ID=copied_RADIUS_GATEWAY_ORG_ID
export RADIUS_GATEWAY_PROFILE=copied_RADIUS_GATEWAY_PROFILE
export RADIUS_GATEWAY_TOKEN=copied_RADIUS_GATEWAY_TOKEN

Then run the container. For example, you can use the -v flag that mounts a persistent volume, so the authentication cache survives container restarts instead of being held only in memory:

sudo docker run -d -p 1812:1812/udp -p 1813:1813/udp \
  --name portnox-radius --restart=on-failure \
  --ulimit nproc=65535 \
  --ulimit nofile=65535 \
  -v portnox-radius-data:/data \
  -e RADIUS_GATEWAY_PROFILE=$RADIUS_GATEWAY_PROFILE \
  -e RADIUS_GATEWAY_ORG_ID=$RADIUS_GATEWAY_ORG_ID \
  -e RADIUS_GATEWAY_TOKEN=$RADIUS_GATEWAY_TOKEN \
  portnox/portnox-radius:latest

⁠Additional functionality

The local RADIUS server also allows you to use CoA (Change of Authorization) with Portnox Cloud, and it helps avoid certificate fragmentation issues that some NAS devices run into with large certificates.

⁠Updating

Update the container by redeploying it manually, or automate updates with the portnox-autoupdate container⁠.

⁠Full documentation

For full documentation, see: docs.portnox.com⁠.