How to Configure an External RADIUS Server (TekRADIUS) for VPN and WiFi Authentication on USG FLEX H Series

Created July 13, 2026 09:03 - Updated July 15, 2026 08:47

Serhii Boiarynov

This guide demonstrates how to configure a Zyxel USG FLEX H Series firewall to use an external RADIUS server for user authentication.

For demonstration purposes, TekRADIUS is used as the example RADIUS server throughout this guide. The same configuration principles can be applied to other RADIUS servers that support the required authentication methods.

Note: While the USG FLEX H Series supports direct LDAP/LDAPS authentication against Microsoft Active Directory (AD) for some services, a RADIUS server provides a centralized authentication solution for multiple network services. A single RADIUS server can authenticate users for IKEv2 Remote Access VPN, SSL VPN, WPA2/WPA3-Enterprise WiFi, and IEEE 802.1X authentication on switches and access points. The RADIUS server can authenticate users against either its local database or Microsoft Active Directory, while the firewall and other network devices communicate only with the RADIUS server.

Before You Begin

This guide includes configuration examples for both supported editions of TekRADIUS:

Option 1 – TekRADIUS Lite
Option 2 – TekRADIUS (Standard)

The configuration on the USG FLEX H Series firewall is identical for both editions. Only the TekRADIUS configuration differs slightly.

Configure the USG FLEX H Series firewall first, then continue with the TekRADIUS edition you are using.

Important: When using IKEv2 Remote Access VPN with EAP-MSCHAPv2, the Generate-MS-MPPE-Keys attribute must be configured on the RADIUS server. Without this attribute, user authentication succeeds, but the VPN connection cannot be established because the required MPPE keys are not generated. This guide shows where to configure this attribute for both TekRADIUS Lite and TekRADIUS (Standard).

Option 1 – Configure TekRADIUS Lite
Option 2 – Configure TekRADIUS (Standard)

Configure the USG FLEX H Series Firewall

Before configuring the RADIUS server, configure the USG FLEX H Series firewall to use an external authentication server.

Step 1 – Create the AAA Server

Navigate to:

User & Authentication → User Authentication → AAA Server

Click Add and configure the following parameters:

Step 2 – Configure Remote Access VPN (IKEv2)

Navigate to:

VPN → IPSec VPN → Remote Access VPN

Scroll down to the Authentication section and configure:

Primary Server – Select the configured RADIUS server.
Secondary Server – local (optional fallback).
User – Select the user group that is allowed to authenticate.

Save the configuration.

Step 3 – Configure SSL VPN

Navigate to:

VPN → SSL VPN

Under the Authentication section configure:

Primary Server – Select the configured RADIUS server.
Secondary Server – local (optional fallback).
Allowed Users – Select the user group that is allowed to authenticate.

Click Apply to save the configuration.

Option 1 – Configure TekRADIUS Lite

Step 1 – Download and Install TekRADIUS Lite

For this example, we will use TekRADIUS as the external RADIUS server. TekRADIUS is a lightweight RADIUS server for Windows that supports standard RADIUS authentication (RFC 2865) and accounting (RFC 2866), making it suitable for lab environments and interoperability testing with the USG FLEX H Series firewall.

Open the KaplanSoft website:
KaplanSoft – TekRADIUS Lite
Navigate to Download and download the latest available version of TekRADIUS Lite.
Extract the downloaded archive and run Setup.exe.
Follow the installation wizard using the default settings.
After the installation is complete, launch TekRADIUS Manager.

Step 2 - Configure Service Parameters

Open Settings → Service Parameters and configure the following settings:

Authentication Port: 1812
Default EAP Method: PEAP-EAP-MS-CHAP-v2
Startup Logging: Debug (recommended during initial configuration and troubleshooting)

Leave all other settings at their default values unless your environment requires different parameters.

Note: After the deployment has been verified, the logging level can be changed from Debug to Automatic or None to reduce log generation.

Step 3 - Add the Firewall as a RADIUS Client

Open Clients and create a new RADIUS client.

Configure the following parameters:

NAS: IP address of the USG FLEX H Series firewall.
Secret: Shared secret configured on both the firewall and TekRADIUS Lite.
Vendor: ietf
Enabled: Yes

Important: The NAS IP address must match the Source IP (NAS-IP-Address) configured on the firewall. Otherwise, authentication requests will be rejected.

Step 4 - Create a User

Step 5 - Create a User

Open Users and create a new user.

Configure:

Username
Password
Group: Default

The user only requires the User-Password attribute.

Once the user is created, TekRADIUS Lite is ready to authenticate requests from the USG FLEX H Series firewall.

Option 2 – Configure TekRADIUS (Standard)

Step 1 – Download and Install TekRADIUS

Open the KaplanSoft website:
KaplanSoft – TekRADIUS
Navigate to Download and download the latest available version of TekRADIUS.
Extract the downloaded archive and run Setup.exe.
Follow the installation wizard using the default settings.
After the installation is complete, launch TekRADIUS Manager.

Note: The free edition of TekRADIUS is sufficient for the configuration and validation steps described in this article. Some advanced features (such as EAP-TLS, OTP, and Active Directory integration) are available only in the commercial editions.

Step 2 – Install Microsoft SQL Server Express

TekRADIUS requires Microsoft SQL Server to store its configuration, users, and accounting information. If SQL Server is not installed, install Microsoft SQL Server Express before continuing.

Download and install Microsoft SQL Server Express

During the installation, select the Basic or Custom installation type.
Complete the installation using the default settings.
Make sure the SQL Server service is running before proceeding to the next step.

Note: SQL Server Express is free and fully sufficient for the lab environment used in this article.

Install SQL Server Management Studio (SSMS)

Step 3 - Launch SQL Server Management Studio

Connect to SQL Server

Launch SQL Server Management Studio (SSMS).
Configure the connection using the following settings:
- Server Name: localhost\SQLEXPRESS
- Authentication: Windows Authentication
Enable Trust Server Certificate.
Click Connect.

Note: If a certificate warning appears during the initial connection, enable Trust Server Certificate and try connecting again. This is expected when using the default SQL Server Express installation in a lab environment.

Restart the SQL Server Service

In Object Explorer, right-click the SQL Server instance.
Select Restart.
Click Yes to confirm the restart.
Wait for the SQL Server service to restart.

Note: Restarting the SQL Server service is required for the authentication mode change to take effect.

At this point, SQL Server is fully configured and ready to be used by TekRADIUS.

Step 4 - Configure the TekRADIUS SQL Database

With SQL Server configured and running, the next step is to configure the SQL database that TekRADIUS will use to store users, groups, accounting records, and session information.

For this guide, we use the built-in sa SQL account to simplify the setup.

Note: The built-in sa account is used in this guide for demonstration purposes only. In a production environment, it is recommended to create a dedicated SQL account with only the permissions required by TekRADIUS.

Launch TekRADIUS Manager.
Open the Settings tab and select the Database page.
In the SQL Server Connection section, configure the connection to your SQL Server instance:
- SQL Server: localhost\SQLEXPRESS
- Username: sa
- Password: your SQL Server sa password
- Timeout: 30 seconds
Enable the Test option to verify the SQL Server connection.
In the Create Database section, enter the name of the database that will be used by TekRADIUS (for example, TekRADIUSZyxel) and click Create Database.
After the database has been created successfully, select the tables you want TekRADIUS to create:
- Users
- Accounting
- Groups
- Sessions
Click Create Table to create the required SQL tables.
Finally, click Save Settings to save the configuration.

Note: If the database already exists, the Create Database button will be unavailable. Likewise, the Create Table button will be disabled if the required tables have already been created.

Step 5 - Add the Zyxel Firewall as a RADIUS Client

Before users can be authenticated, TekRADIUS must trust the Zyxel firewall as a RADIUS client.

Open the Clients tab.
Create a new client and configure the following settings:

NAS: IP address of the Zyxel firewall.
Secret: Shared secret (must exactly match the secret configured on the firewall).
Vendor: zyxel
Label: Any descriptive name (for example, USG FLEX H).
Description: Optional.
Enabled: Yes

Important: The NAS field must contain the IP address of the Zyxel firewall that sends the RADIUS authentication requests, not the IP address of the RADIUS server or the VPN client.
In this example, the firewall IP address is 192.168.162.1.

Step 6 - Create a User

Next, create a user that will be used for VPN authentication.

Open the Users tab.
Create a new user.
Assign the user to the Default group (or another group if required).
Add the following user attribute:

Type	Attribute	Value
Check	User-Password	User password

Save the user configuration.

Step 7 - Configure Group Attributes

Finally, configure the group attributes required for IKEv2 authentication.

Open the Groups tab.
Select the Default group.
Add the following attributes:

Type	Attribute	Value
Check	Generate-MS-MPPE-Keys	VPN-Generate-128
Success-Reply	Filter-Id	radius-users

Save the group configuration.

Important: The Generate-MS-MPPE-Keys attribute is required for IKEv2 Remote Access VPN using EAP-MSCHAPv2. Without this attribute, TekRADIUS cannot generate the required MPPE keys, and VPN authentication will fail even if the username and password are validated successfully.

Note: The Filter-Id attribute is optional for basic authentication but is commonly used to identify the authenticated user group and may be required by some VPN deployments or access policies.

Verify VPN Authentication

After completing the TekRADIUS configuration, verify that both IKEv2 Remote Access VPN and SSL VPN can authenticate users successfully.

Open SecuExtender VPN Client.
Select your IKEv2 Remote Access profile.
Click Connect.
When prompted, enter the username and password of the user created in TekRADIUS.
Click OK.

If the authentication is successful, the VPN tunnel will be established and the connection status will change to Connected.

Verify the RADIUS Authentication

To confirm that authentication is handled by TekRADIUS, capture the traffic between the firewall and the RADIUS server using Wireshark.

Apply the following display filter:

radius

A successful authentication should produce the following packet sequence.

IKEv2 Remote Access VPN

Unlike SSL VPN, IKEv2 performs an EAP-MSCHAPv2 authentication exchange. Therefore, multiple RADIUS packets are expected before authentication completes.

The packet sequence should be similar to the following:

Response, Identity
Request, Protected EAP (EAP-PEAP)
Response, Legacy Nak
Request, MS-Authentication EAP
Response, MS-Authentication EAP
Request, MS-Authentication EAP
Response, MS-Authentication EAP
Success

The final RADIUS packet should be an Access-Accept (Success) response from the RADIUS server.

SSL VPN

SSL VPN performs a standard RADIUS username/password authentication and therefore generates only two RADIUS packets:

Access-Request
Access-Accept

Receiving an Access-Accept response confirms that TekRADIUS successfully authenticated the user.

The same USG FLEX H Series configuration can also be used with other RADIUS servers such as Microsoft NPS, FreeRADIUS, Cisco ISE, or Aruba ClearPass, provided they support the required authentication methods.

Articles in this section

Comments

0 comments

Please sign in to leave a comment.