Extensible Authentication Protocol (EAP) is an authentication framework for exchanging identity and authentication information. It defines multiple authentication methods and message formats, but does not define how those messages travel across a network. section 11.4.3 section 20.2.2
EAP commonly operates through IEEE 802.1X. The supplicant is the client requesting access, the authenticator is the network device controlling access, and the authentication server verifies the credentials, usually through RADIUS. section 11.4.3 section 20.2.2
The access sequence separates authentication from ordinary network communication:
- A wired 802.1X port remains locked after connection and permits only 802.1X authentication traffic until authentication succeeds. section 11.4.3
- For wireless WPA-Enterprise, the client associates with the access point but cannot communicate normally until it completes 802.1X/EAP authentication. section 20.2.2
- EAPoL carries EAP messages between the supplicant and authenticator over Ethernet or 802.11, while RADIUS relays them between the authenticator and authentication server. section 20.2.2
Figure 20.6 The 802.1X/EAP protocol stack. 802.1X defines EAPoL, which allows EAP messages to be transported over Ethernet or 802.11 LANs.
Use the protocol-stack figure to distinguish EAP authentication methods from 802.1X EAPoL transport over Ethernet or 802.11. section 20.2.2
Figure 20.7 EAPoL is used to transport EAP messages between the supplicant and authenticator, and RADIUS between the authenticator and AS.
Use the message-flow figure to trace EAPoL between the client and authenticator and RADIUS between the authenticator and authentication server. section 20.2.2
In split-MAC wireless designs, the wireless LAN controller acts as the authenticator, while the access point tunnels client EAP messages to it using CAPWAP. section 20.2.2
