I have just had a lecture on VPNs and RADIUS and have a question with regards to authentication. I am aware of protocols such as EAP and PEAP and was wondering how these protocols work alongside RADIUS, if at all.

Ultimately as the question title suggests, if a user would like to connect to a network device on an internal network using SSL VPN how would they authenticate?

My initial thoughts were that the VPN server defines an authentication protocol such as EAP, the user then provides the correct credentials in accordance with the protocol and the VPN server acting as a RADIUS client forwards the data to the RADIUS server using the RADIUS protocol. The RADIUS server looks up the given credentials and if correct issues an acceptance message. The user is then authenticated and the VPN server can allow access to the network resources.

I would be grateful if someone could give me some guidance. I appteciate that my initial thoughts may be completely incorrect.


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 20, 2022 at 0:10

1 Answer 1


Microsoft says it well:

Architecturally, an EAP infrastructure consists of the following:

  • EAP peer Computer that is attempting to access a network, also known as an access client. EAP authenticator An access point or network access server (NAS) that is requiring EAP authentication prior to granting access to a network.
  • Authentication server A server computer that negotiates the use of a specific EAP method with an EAP peer, validates the EAP peer's credentials, and authorizes access to the network.
  • Typically, the authentication server is a Remote Authentication Dial-In User Service (RADIUS) server.

EAP is extensible through EAP methods that plug-in at both the EAP peer and authenticating server ends of a connection. To add support for a new EAP method, you install an EAP method library file on both the EAP peer and the authenticating server. This capability to extend EAP provides vendors with the opportunity to create new authentication schemes. EAP provides the highest flexibility to allow for more secure authentication methods.

The EAP peer and the EAP authenticator send EAP messages using a supplicant-a software component that uses EAP to authenticate network access-and a data link layer transport protocol such as PPP or IEEE 802.1X. The EAP authenticator and the authentication server send EAP messages using RADIUS. The end result is that EAP messages are exchanged between the EAP components on the EAP peer and the authentication server. The following figure shows EAP infrastructure and information flow.

enter image description here

  • EAP isn't used in SSL/TLS authentication
    – Ron Trunk
    Jan 3, 2017 at 23:50
  • #1 SSL does not Equal TLS, in fact TLS 1.2 replaces SSL. "The Protected Extensible Authentication Protocol, also known as Protected EAP or simply PEAP, is a protocol that encapsulates EAP within a potentially encrypted and authenticated Transport Layer Security (TLS) tunnel." - wikipedia Jan 4, 2017 at 1:15
  • You are correct, but you still have to authenticate the TLS tunnel first. More importantly, though, I think you could have provided a better answer for the OPs question.
    – Ron Trunk
    Jan 4, 2017 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.