TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 5.6 NIST 800-53 IA-3 ISC2 CISSP 4.2 NIST CSF PR.AA-04
TechKnowSurge Catalog Videos Encapsulating EAP
VideoSecurityFree

Encapsulating EAP

EAP methods handle the authentication layer in network communications, but require encapsulation protocols like RADIUS or Diameter to carry that authentication traffic between devices. This content covers how EAP encapsulation works within frameworks like 802.1x.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

EAP, or Extensible Authentication Protocol, functions as a framework rather than a protocol itself — a blueprint that defines how authentication protocols, known as EAP methods, are constructed and applied. EAP methods like EAP-FAST are the actual protocols built from that framework, and they are purpose-built to handle the authentication exchange between two endpoints, not the broader communication happening at lower network layers. Because EAP methods address only the authentication piece, something additional is needed to carry that authentication traffic across the network. Encapsulation protocols such as RADIUS, Diameter, or EAP itself serve that transport role, wrapping the chosen EAP method so it can be delivered between devices. Importantly, different encapsulation protocols can be used at different points within the same authentication flow, depending on what devices are communicating with each other. A standard 802.1x implementation illustrates this clearly. Between the supplicant and the authenticator, EAP is used as the encapsulation method to carry the authentication conversation. Between the authenticator and the backend authentication server, RADIUS takes over as the encapsulation protocol. Understanding these distinct layers — the EAP framework, the EAP method, and the encapsulation protocol — is essential for correctly implementing and troubleshooting network access control in enterprise environments.

What you'll learn

What's covered

EAP Encapsulation

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
ISC2 CISSP
5.6 Implement authentication systems
4.2 Secure network components
NIST 800-53
IA-3 Device Identification and Authentication
NIST CSF
PR.AA-04 Identity assertions are protected, conveyed, and verified.

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Extensible Authentication Protocol
EAP
Extensible Authentication Protocol is a flexible authentication framework used in wireless networks and PPP connections that supports multiple authentication methods including certificates, tokens, and passwords.
Extensible Authentication Protocol over LAN
EAPoL
A network access control protocol defined in IEEE 802.1X that encapsulates EAP authentication messages over a local area network before a device is granted access to network resources. EAPoL operates at Layer 2 and is the delivery mechanism for EAP methods such as EAP-TLS and PEAP.
Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Supplicant
In the IEEE 802.1X authentication framework, the device or user requesting network access that must prove its identity to the authenticator before being granted access. The supplicant runs an EAP method such as EAP-TLS or PEAP and communicates with the authenticator using EAPoL.
Authenticator
In the IEEE 802.1X framework, the network device (typically a switch or wireless access point) that sits between the supplicant and the authentication server, relaying EAP messages and enforcing whether the port is opened or blocked based on the authentication result. The authenticator does not verify credentials itself; it passes that responsibility to the RADIUS server.
Authentication Server
The server in a network access control framework (such as 802.1X) that validates supplicant credentials and grants or denies network access based on authentication policy. RADIUS is the most common authentication server protocol.

Topics

Network Authentication Eap 802.1x Radius Eapol Network Access Control Networking

Transcript

The EAP methods are protocols used for authentication between maybe two devices, or a device and a resource, or whatever we're looking to authenticate between. So that's the EAP methods. They're protocols, but those protocols are specific to the authentication piece, not necessarily the communication piece that happens at a lower layer. So there are different layers with this, and we have to do encapsulation. Let's talk about EAP encapsulation.

EAP is a framework, the methods are the protocols

Just a reminder that EAP itself is a framework. It's like a blueprint to a house. There are EAP methods, which are the actual protocol, so that's like the house that's being built. So EAP-FAST is built off of the EAP framework.

There are lots of EAP methods that we can use for this authentication piece. But these EAP methods are purposely built just to establish the authentication piece of this, not the communication between two devices. So we're still missing an element of this authentication piece, and so we need to encapsulate EAP.

Encapsulating the EAP method

To carry out this communication properly, the EAP method, or the actual protocol we've chosen to be carried across here, gets carried over by an encapsulated protocol. So this encapsulation protocol might be EAP, or Diameter, or RADIUS, or one of these others.

In fact, we could be using different encapsulation methods. So in this example right here, between the supplicant and the authenticator, we use EAP to carry across those E conversations there, versus over here we use RADIUS between the authenticator and the authentication service.

This is a common example of 802.1X and how we would implement 802.1X.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →