The laptop's Wi-Fi radio powers on and scans channels — either passively listening for beacon frames or actively sending probe requests. It finds an AP advertising SSID "Corp-Secure" with WPA2-Enterprise (AES-CCMP) in its capability information.
ScanThe laptop sends an 802.11 Authentication Request; the AP replies Success almost unconditionally. This is a carryover from the original 802.11 spec and is not the real security check — despite the name, it does essentially nothing on a WPA2-Enterprise network.
802.11 AuthThe laptop sends an Association Request (its supported rates, capabilities); the AP replies with an Association Response and an Association ID. The client now has a Layer 2 association with the AP — but its 802.1X controlled port is still blocked for everything except EAP traffic. No DHCP, no browsing, nothing yet.
AssociationFrom here, three distinct roles drive the process: the laptop is the Supplicant, the AP is the Authenticator (a pass-through — it never makes the auth decision itself), and a back-end RADIUS server (e.g. Cisco ISE, Microsoft NPS) is the Authentication Server — the only party that actually decides whether the credentials are valid.
802.1XThe AP requests an identity; the Supplicant responds with something like user@corp.com. The AP encapsulates this — and every subsequent EAP message — inside RADIUS Access-Request packets and relays them to the RADIUS server over the wired network.
Client and RADIUS server negotiate an EAP method and perform a TLS exchange. Critically, this is mutual: the RADIUS server presents its certificate and the client validates it against a trusted CA before trusting the network — this is exactly what prevents a rogue AP from harvesting credentials by impersonating the real SSID.
EAP-TLSOnce EAP authentication succeeds, the client and RADIUS server each independently derive the same key material from the completed TLS session — never transmitted directly. RADIUS sends this to the AP as the PMK (Pairwise Master Key) inside a RADIUS Access-Accept. The client already holds its own copy. Neither the AP nor anyone listening over the air ever sees the raw key in transit.
CheckpointHolding the PMK from RADIUS, the AP sends EAP-Success to the client over EAPOL (EAP over LAN). Both sides now share the same PMK — but the PMK itself is never used to encrypt traffic directly.
EAP-SuccessAP and client exchange four EAPOL-Key messages carrying nonces (ANonce from the AP, SNonce from the client). Each side independently derives a fresh, session-unique PTK (Pairwise Transient Key) from the PMK plus both nonces plus both MAC addresses — proving live possession of the same PMK without ever transmitting it, and without ever reusing the same encryption key across sessions.
4-Way HandshakeAs part of the same handshake, the AP also delivers the GTK (Group Temporal Key) — used for broadcast/multicast traffic shared by every client on the SSID — encrypted using the PTK that was just derived, so it's protected in transit even though it's shared network-wide.
GTKWith PTK and GTK both installed on the client and the AP, the 802.1X controlled port moves from "EAP-only" to fully open — every traffic type is now permitted, and every frame from here on is encrypted with AES-CCMP under the PTK.
Port OpenOnly now does the laptop send its first DHCP Discover — this is the very first "normal" packet able to pass through the AP. From here the standard DORA sequence proceeds exactly as it would on a wired PC.
DHCPThe laptop has an IP, gateway, and DNS, and can reach corporate resources and the internet — with every frame's payload encrypted end-to-end between the client and AP under the session's unique PTK, distinct from every other client on the same SSID.
Delivered| Term | Meaning |
|---|---|
| Supplicant | The client device requesting network access (the laptop) |
| Authenticator | The device enforcing the controlled port and relaying EAP to RADIUS — the AP/controller |
| Authentication Server | The RADIUS server that actually validates credentials and issues the accept/reject decision |
| EAPOL | EAP over LAN — the framing used to carry EAP messages between Supplicant and Authenticator |
| PMK | Pairwise Master Key — derived from a successful EAP exchange, delivered to the AP by RADIUS |
| PTK | Pairwise Transient Key — session-unique key derived in the 4-way handshake, used to encrypt unicast traffic |
| GTK | Group Temporal Key — shared key used to encrypt broadcast/multicast traffic on the SSID |
| 4-Way Handshake | The nonce-based exchange that derives the PTK/GTK and proves both sides hold the same PMK |
| AES-CCMP | The encryption/integrity protocol WPA2 uses to protect data frames once keys are installed |
| 802.11r | Fast BSS Transition — speeds up roaming between APs by skipping the full re-authentication |