EAPPEAP

EAP-PEAP, often referred to simply as PEAP, stands for Protected Extensible Authentication Protocol. It is an EAP method used in 802.1X networks to securely authenticate clients and controllers, such as wireless access points. The method creates a secure TLS tunnel between the client (the supplicant) and the authentication server, typically a RADIUS server, and then transmits the user’s credentials inside that protected tunnel.

In operation, the access point or network switch acts as the authenticator and forwards EAP messages to the RADIUS server. The client first authenticates the server by validating its certificate, establishing a mutually trusted TLS channel. Within this tunnel, an inner EAP method performs the actual user authentication. The most common inner method is MSCHAPv2, though PEAP can carry other inner methods such as EAP-GTC. The RADIUS server verifies the user’s credentials against a directory service (for example, Active Directory) and communicates the result back to the authenticator.

PEAP is widely used in WPA2-Enterprise and WPA3-Enterprise deployments, offering centralized credential management and the ability to leverage existing PKI infrastructure. Typical deployments require a server certificate on the authentication server, trusted root certificates on client devices, and compatible client software across operating systems.

Security considerations focus on correct configuration. The outer TLS tunnel protects inner credentials, but proper server certificate validation on the client is essential to prevent man-in-the-middle attacks. Weak passwords or insecure inner methods can undermine security, so organizations commonly enforce strong password policies and, where possible, use certificate-based client authentication or stronger inner methods. PEAP is standardized in RFC 5216 and remains a foundational option for enterprise wireless and wired 802.1X deployments.