Service Connector

By default your network equipment reaches an EntryPoint Context’s RADIUS endpoint over the public internet, optionally with RadSec securing the transport. A Service Connector is the alternative path: EntryPoint’s RADIUS authentication, accounting, and RadSec traffic runs over a private IPSec tunnel to your network instead of crossing the public internet.

Access points

Switches

Wireless controllers

RADIUS / RADSEC→

Your firewall IPsec endpoint

IPSEC⇄Service Connector tunnel

EntryPoint Context cloud · RADIUS

Your network equipment sends RADIUS to the same Context endpoints as before; with a Service Connector bound, the path runs through the IPsec tunnel instead of across the public internet.

See Service Connector for the cross-Service concept and how a connector is stood up; this page covers what it means for EntryPoint specifically.

When to use it

• Your security policy requires RADIUS to stay off the public internet.
• You already run an IPSec-capable firewall and prefer a private path to the platform.
• You want one private tunnel to carry EntryPoint alongside other Services (for example Endpoint Manager, or webhook deliveries to an internal endpoint) rather than exposing each over the internet.

Service Connector and RadSec

They solve different problems and are not exclusive:

	RadSec	Service Connector
What it does	Wraps RADIUS in a TLS session so the transport is encrypted and the server identity is verified	Carries the RADIUS path over a private IPSec tunnel, off the public internet
Where it runs	Over the public internet (or any reachable path)	Over a private IPSec tunnel between your firewall and the platform
Typical use	Securing RADIUS when it must traverse public or semi-trusted networks	Keeping RADIUS traffic private end to end

A Service Connector gives you a private path; RadSec secures the RADIUS session itself. You can use the connector on its own, or carry RadSec over it as well.

Binding a Context to a connector

Once a Service Connector exists, bind the EntryPoint Context to it so its RADIUS path uses the tunnel. The Context’s RADIUS hostname, ports, shared secret, and access allow-list (see RADIUS clients) work the same way; the connector only changes the network path the traffic takes to reach the platform.

Binding an EntryPoint Context to a Service Connector so its RADIUS path runs over the private IPSec tunnel.

Related

Service Connector

The cross-Service concept and how a connector is stood up.

RADIUS clients

Hostname, ports, shared secret, and the access allow-list.

RadSec (RADIUS over TLS)

Securing the RADIUS session, with or without a connector.

Service Connector for Endpoint Manager

Carry Endpoint Manager over the same private tunnel.