TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 5.6 NIST 800-53 IA-3 NIST CSF PR.AA-04
TechKnowSurge Catalog Videos EAPOL Protocol
VideoSecurityFree

EAPOL Protocol

EAPOL (Extensible Authentication Protocol over LAN) is the protocol that enables 802.1X port-based authentication by carrying EAP credentials between a device and a network switch before an IP address is assigned. It serves as the communication bridge that allows a supplicant to authenticate against a network before gaining full access.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The 802.1X standard enforces port-based network access control by requiring a device to authenticate before it is allowed to communicate with any other device on the network. This creates a fundamental challenge: the device has no IP address at the point of connection, meaning the standard communication protocols that depend on IP cannot be used. A dedicated protocol was needed to bridge this gap, and that protocol is EAPOL — Extensible Authentication Protocol over LAN. EAPOL operates at the data link layer, enabling direct communication between the supplicant (the connecting device) and the authenticator (typically a managed switch). It encapsulates EAP methods — which handle the actual authentication logic but were not designed for general network communication — and carries them across this local link. Through EAPOL, the supplicant can transmit authentication credentials such as digital certificates, username-and-password combinations, or pre-shared keys to the authenticator without requiring an IP address or any broader network connectivity. Once the supplicant and authenticator establish communication through EAPOL, the authentication process continues toward a backend authentication server. At that stage, the authenticator hands off the EAP exchange using a separate protocol — commonly RADIUS, TACACS+, or Diameter — which is better suited for communication across a routed network. EAPOL's role is confined to that critical early segment between the device and the switch, making it the essential first link in the 802.1X authentication chain.

What you'll learn

What's covered

EAPOL Protocol

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
ISC2 CISSP
5.6 Implement authentication systems
NIST 800-53
IA-3 Device Identification and Authentication
NIST CSF
PR.AA-04 Identity assertions are protected, conveyed, and verified.

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Extensible Authentication Protocol over LAN
EAPoL
A network access control protocol defined in IEEE 802.1X that encapsulates EAP authentication messages over a local area network before a device is granted access to network resources. EAPoL operates at Layer 2 and is the delivery mechanism for EAP methods such as EAP-TLS and PEAP.
Supplicant
In the IEEE 802.1X authentication framework, the device or user requesting network access that must prove its identity to the authenticator before being granted access. The supplicant runs an EAP method such as EAP-TLS or PEAP and communicates with the authenticator using EAPoL.
Authenticator
In the IEEE 802.1X framework, the network device (typically a switch or wireless access point) that sits between the supplicant and the authentication server, relaying EAP messages and enforcing whether the port is opened or blocked based on the authentication result. The authenticator does not verify credentials itself; it passes that responsibility to the RADIUS server.

Topics

Eapol 802 1x Network Access Control Authentication Networking Port Based Authentication

Transcript

Why a New Protocol Was Needed

With the creation of 802.1X, we needed a new protocol — a protocol that would encapsulate our EAP methods so that we could do that authentication piece before that device was allowed to access the rest of the network. That protocol is EAPOL.

The different EAP methods are really protocols that are used for authentication, but not for all of the communication needs that happen across the line. So what we need to do is encapsulate those EAP methods with some other communication protocol, and there are several that exist out there to help us do this.

802.1X is a special case here. Essentially we are connecting a device into a network, and we don't want that device to connect to any other devices until we authenticate it. The problem is that it doesn't even have an IP address at this point in time. That is, we don't even allow it to communicate and get an IP address before it is allowed to connect to the network. We want to do this first thing, before it is allowed to communicate at all to any other devices.

But the problem is that now we don't have our standard communication processes in place. We don't have an IP address or any kind of address that allows that type of communication to happen. The only thing that's allowed is communication directly between the device and the switch, and so all of the starting communication happens right here.

EAPOL

We need a protocol that facilitates that. We need a protocol that is allowed to pass authentication information like certificates or user credentials or pre-shared keys to make a connection to the rest of the network. That's where extensive authentication protocol over local area network, or EAPOL for short, comes into play.

What EAPOL does is it's the communication that starts getting established between a device and the switch to set up this authentication process. So it uses EAPOL to create that communication between these two devices.

What we have is the supplicant, which needs to use some sort of EAP method to communicate with the authenticator. What it will do is establish an EAPOL tunnel here to create that connection between the two and start that communication.

The EAP continues on to the authentication server, but we use a different protocol for that. We use RADIUS or TACACS or Diameter or one of the others.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →