0Pricing
Cyber Security Academy · Lesson

Enterprise Wi-Fi: EAP and RADIUS

Configure WPA2-Enterprise with EAP-TLS, understand certificate-based auth, and secure RADIUS servers.

Enterprise Wi-Fi: EAP and RADIUS is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Enterprise Wi-Fi?

WPA2-Personal uses a shared password — everyone knows the same secret. WPA2/WPA3-Enterprise uses 802.1X with individual credentials or certificates, enabling per-user authentication, revocation, and audit logs.

802.1X Framework

802.1X defines three roles: Supplicant (client device), Authenticator (AP/switch), and Authentication Server (RADIUS). The AP proxies credentials to RADIUS without knowing them.

# 802.1X flow:
# 1. Client connects to AP
# 2. AP blocks all traffic (uncontrolled port)
# 3. AP proxies EAP to RADIUS server
# 4. RADIUS authenticates client
# 5. RADIUS sends accept + session keys
# 6. AP opens controlled port for client

EAP Methods Comparison

Multiple EAP methods provide different security levels. EAP-TLS (certificates) is the most secure; PEAP and EAP-TTLS are common with password credentials inside a TLS tunnel.

# EAP Methods (least to most secure):
# EAP-MD5: no server auth, vulnerable (avoid)
# PEAP: server cert + password in tunnel (common)
# EAP-TTLS: server cert + various inner methods
# EAP-TLS: mutual certificates (most secure)

RADIUS Server Setup (FreeRADIUS)

FreeRADIUS is the open-source RADIUS implementation. Configure clients (APs), users (or LDAP/AD integration), and certificates. Most enterprise deployments integrate with Active Directory via PEAP-MSCHAPv2.

# Install FreeRADIUS
apt install freeradius

# Configure AP as client in:
# /etc/freeradius/3.0/clients.conf
client ap1 {
    ipaddr = 192.168.1.10
    secret = shared_secret_with_ap
    shortname = AP1
}

Certificate Authority for EAP-TLS

EAP-TLS requires a PKI: a CA issues server certificates (RADIUS) and client certificates (devices). Clients verify the RADIUS server certificate — preventing rogue AP attacks.

# Generate CA and server cert (simplified)
openssl req -new -x509 -keyout ca.key -out ca.pem -days 3650

# Generate RADIUS server cert
openssl req -new -key server.key -out server.csr
openssl x509 -req -in server.csr -CA ca.pem \
  -CAkey ca.key -out server.pem -days 365

PEAP-MSCHAPv2 Configuration

PEAP-MSCHAPv2 is the most common enterprise Wi-Fi setup: server presents a certificate (TLS tunnel), then authenticates the user with their AD domain credentials inside the tunnel.

# FreeRADIUS eap.conf excerpt:
peap {
    default_eap_type = mschapv2
    copy_request_to_tunnel = no
    use_tunneled_reply = no
}

# Client validates server cert CN
# before submitting credentials

Wireless Controller Integration

Enterprise APs connect to a wireless controller (Cisco WLC, Aruba, Ruckus) that handles RADIUS proxy, VLAN assignment per user/group, and centralized policy enforcement.

PEAP Attacks: Credential Harvesting

If clients do not validate the RADIUS server certificate, a rogue AP with a self-signed cert can harvest domain credentials. hostapd-wpe implements this attack — highlighting why cert validation is mandatory.

# hostapd-wpe: PEAP credential harvesting
# (authorized lab use only)
hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

# Defense: enforce server certificate validation
# and pin the CA cert on all clients

Client Certificate Distribution

Deploy client certificates via MDM (Microsoft Intune, Jamf) for automatic distribution and renewal. Certificates can be revoked individually — unlike shared passwords, revocation is instant and targeted.

Network Access Control (NAC)

NAC extends 802.1X with device health checks: is the OS patched? Is antivirus running? NAC grants different network access levels based on device compliance posture.

Monitoring and Logging

RADIUS logs every authentication: user, device, time, result, and assigned VLAN. Integrate with SIEM to detect brute force, unusual login times, and compromised credentials used from unexpected locations.

Quick Check

Which EAP method uses mutual certificate authentication for maximum security?

Summary: Enterprise Wi-Fi

WPA2/WPA3-Enterprise with 802.1X provides per-user authentication, audit trails, and instant revocation. EAP-TLS with mutual certificates is the gold standard. Always enforce server certificate validation on clients to prevent PEAP credential harvesting via rogue APs. Integrate RADIUS with SIEM for continuous monitoring of authentication events.

Frequently asked questions

Is the “Enterprise Wi-Fi: EAP and RADIUS” lesson free?

Yes — the full text of “Enterprise Wi-Fi: EAP and RADIUS” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Enterprise Wi-Fi: EAP and RADIUS”?

Configure WPA2-Enterprise with EAP-TLS, understand certificate-based auth, and secure RADIUS servers. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Enterprise Wi-Fi: EAP and RADIUS” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. 802.11 Security Protocols: WEP, WPA2, WPA3
  2. WPA2 Handshake Capture and Cracking
  3. Evil Twin and Captive Portal Attacks
  4. Enterprise Wi-Fi: EAP and RADIUS
← Back to Cyber Security Academy