--- title: "Prototyping RADIUS Server Policies: Part 2" description: Let's test some EAP methods. The most common in enterprises is probably EAP-PEAP with MS-CHAPv2 inner authentication, so we start there. image: https://blog.iptel.com.au/hubfs/Blogs/Prototyping%20RADIUS%20Server%20Policies/Prototyping%20RADIUS%20Server%20Policies%20Part%202%20(Instagram).gif --- [![IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)](https://blog.iptel.com.au/hs-fs/hubfs/IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png?width=200&height=59&name=IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png "IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)")](https://iptel.com.au) - [Home](https://iptel.com.au/) - [Solutions](https://iptel.com.au/solutions) Technologies - [Cisco Access Manager](https://iptel.com.au/technologies/cisco-access-manager) - [Cisco Catalyst Centre](https://iptel.com.au/technologies/cisco-catalyst-center) - [Cisco Meraki](https://iptel.com.au/technologies/cisco-meraki) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco Spaces](https://iptel.com.au/technologies/cisco-spaces) - [Everpure Storage](https://iptel.com.au/technologies/everpure-storage) - [Industrial IoT](https://iptel.com.au/technologies/industrial-iot) - [LAN](https://iptel.com.au/technologies/lan) - [Security and Cisco ISE](https://iptel.com.au/technologies/security-and-cisco-ise) - [Thousand Eyes](https://iptel.com.au/technologies/thousandeyes) - [Virtualisation](https://iptel.com.au/technologies/virtualisation) - [Wi-Fi](https://iptel.com.au/services/wi-fi-surveys) Services - [Backup Assure](https://iptel.com.au/services/backup-assure) - [Cisco URWB](https://iptel.com.au/services/cisco-urb) - [Cisco Webex Calling](https://iptel.com.au/services/cisco-webex-calling) - [Eco-Friendly Network Refresh](https://iptel.com.au/services/eco-friendly-network-refresh) - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Splunk](https://iptel.com.au/services/splunk) - [Wi-Fi Assurance Review](https://iptel.com.au/services/wi-fi-assurance-review) - [Wi-Fi Surveys](https://iptel.com.au/services/wi-fi-surveys) - [Industries](https://iptel.com.au/industries) Education and Healthcare - [Education and Campuses](https://iptel.com.au/industries/education) - [Healthcare and Clinical](https://iptel.com.au/industries/healthcare) - [Aged Care](https://iptel.com.au/industries/aged-care) Enterprise - [Enterprise Networks](https://iptel.com.au/industries/enterprise) Industrial - [Mining and Camps](https://iptel.com.au/industries/mines) - [Utilities](https://iptel.com.au/industries/utilities) Retail & Warehousing - [Retail](https://iptel.com.au/industries/retail-and-stores) - [Warehousing](https://iptel.com.au/industries/warehousing) Entertainment - [Stadiums](https://iptel.com.au/industries/stadiums) - [Hospitality](https://iptel.com.au/hospitality-and-hotels) - [MSP](https://iptel.com.au/managed-services) Meraki MSP - [Meraki Access and Security](https://iptel.com.au/managed-services/meraki-access-and-security) - [Meraki SD Wan](https://iptel.com.au/managed-services/meraki-sd-wan) Cisco MSP - [Cisco Secure Access](https://iptel.com.au/managed-services/cisco-secure-access) - [Security Service Edge](https://iptel.com.au/manged-services/security-service-edge) FSO MSP - [Full Stack Observability](https://iptel.com.au/managed-services/full-stack-observability) Meeting Rooms MSP - [Meeting Rooms as a Service](https://iptel.com.au/managed-services/meeting-rooms-as-a-service) - [Equipment](https://iptel.com.au/services/network-equipment-supply) Equipment Supply - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Buy Cisco Equipment](https://iptel.com.au/services/cisco-equipment-supply) - [Buy Meraki Equipment](https://iptel.com.au/services/meraki-equipment-supply) Get Pricing - [Get a Hardware Quote](https://iptel.com.au/services/network-equipment-supply#hardware-quote) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) - [Blog](https://blog.iptel.com.au) - [Resources](https://iptel.com.au/resources) Free Resources - [Top Wi-Fi Secrets](https://iptel.com.au/top-8-wi-fi-secrets) - [Cisco SDA Fabric](https://iptel.com.au/the-cios-guide-to-sda-fabric) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) Assessments - [Cloud AI Assessment](https://score.iptel.com.au/cloud-ai-assessment) - [Collaboration Assessment](https://score.iptel.com.au/collaboration-assessment) - [Network Assessment](https://score.iptel.com.au/network-assessment) - [Security Assessment](https://score.iptel.com.au/security-assessment) - [Splunk Assessment](https://score.iptel.com.au/splunk-assessment) Tools - [Automating Meraki](https://www.automatingmeraki.com) - [MAC Address Converter](https://iptel.com.au/resources/mac-address-converter) - [MSP Assessment Tool](https://score.iptel.com.au/cisco-managed-services) - [Thousand Eyes Option Tool](https://score.iptel.com.au/thousandeyes) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) Demos and Design - [Request a Meraki Demo](https://iptel.com.au/free-meraki-demo) - [FREE Meeting Room Design](https://iptel.com.au/schedule-meeting-room-design-session) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) - [About](https://iptel.com.au/about-us) IPTel Solutions - [About us](https://iptel.com.au/about-us) - [Job Applications](https://careers.iptel.com.au/job-application) - [Privacy Policy](https://iptel.com.au/privacy-policy) - [Careers Blog](https://careers.iptel.com.au) Contact Us - [Contact Us Form](https://iptel.com.au/contact-us) - [Email Us](mailto:sales@iptel.com.au) Customer - [Customer Feedback](https://iptel.com.au/customer-feedback) - [Customer Referral](https://iptel.com.au/customer-referral) - [Terms and Conditions](https://iptel.com.au/terms-and-conditions) News Stories - [IPTel partners for monitoring for Meeting Rooms as a Service](https://www.commsbusiness.co.uk/content/news/highlight-partners-with-iptel-solutions) - [Webex Monitoring with Highlight](https://itbrief.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [ITBrief with Meeting Room Monitoring](https://itbrief.com.au/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [Cisco Webex Meeting Rooms Monitoring](https://telconews.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [IPTel adopts Highlight](https://itbrief.com.au/story/iptel-adopts-highlight-to-enhance-managed-services) - [Highlight MSP Upgrade](https://datacentre.solutions/news/71753/iptel-solutions-upgrade-with-highlights-service-platform) - [Cisco 360](https://www.crn.com.au/news/2026/networking/aussie-partners-react-cisco-360) - [DP World Transformation](https://www.cisco.com/site/us/en/about/case-studies-customer-stories/dp-world.html) - [Cisco Managed Services](https://www.arnnet.com.au/article/1251771/how-partners-can-take-a-leap-of-faith-with-managed-services.html) - [Project Delivery Excellence](https://channellife.com.au/story/cisco-honours-top-nz-partners-cisco-live) - [Great Place to Work](https://greatplacetowork.com.au/companies/iptel-solutions/) - [Wi-Fi Doesn't have to be Unreliable](https://www.techpartner.news/feature/iptel-wi-fi-doesnt-have-to-be-unreliable-494069) Buying from IPTel - [Buying Panels](https://iptel.com.au/professional-supply-panels) - [IPTel Store](https://store.iptel.com.au) - [Request a Quote](https://iptel.com.au/request-a-quote) - [Managed Services](https://iptel.com.au/managed-services-enquiry) Case Studies - [DP World Video](https://blog.iptel.com.au/hubfs/Case%20Studies/DP%20World_Case_Study.mp4) - [DP World](https://blog.iptel.com.au/dp-world-case-study) - [Backup Assure](https://blog.iptel.com.au/backup-assure-a-disaster-recovery-case-study) [Contact Us](https://iptel.com.au/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ## Prototyping RADIUS Server Policies: Part 2 July 24, 2026 This is part 2 of my blog series on rapid prototyping without any real networking equipment. In [part 1](https://blog.iptel.com.au/rapid-prototyping-radius-server-policies-part-1) I covered PAP and CHAP authentication and later on in [part 3](https://blog.iptel.com.au/ise-radius-server-policies-part-3) we will be covering EAP-TLS (X.509 certificate based) authentication. ![Prototyping RADIUS Server Policies (Part 2)](https://blog.iptel.com.au/hs-fs/hubfs/Blogs/Prototyping%20RADIUS%20Server%20Policies/Prototyping%20RADIUS%20Server%20Policies%20(Part%202).gif?width=1440&name=Prototyping%20RADIUS%20Server%20Policies%20(Part%202).gif) There is a wealth of information on the internet about configuring Radius Servers (Cisco ISE or Aruba ClearPass) to perform a multitude of operations. This blog series aims to help the network administrator in configuring their RADIUS Server policies. Related reading - [Prototyping RADIUS Server Policies: Part 1](https://blog.iptel.com.au/rapid-prototyping-radius-server-policies-part-1) - Prototyping RADIUS Server Policies: Part 2 (this blog) - [Prototyping RADIUS Server Policies: Part 3](https://blog.iptel.com.au/ise-radius-server-policies-part-3) --- ## Introduction Let's get more creative and look at testing some EAP methods. The most common method found in enterprises is probably EAP-PEAP with MS-CHAPv2 inner authentication. Typical real-world use case examples include Windows/OSX/Android supplicants where the credentials are typically looked up in Active Directory or LDAP. There is a great test utility from the wpa\_supplicant suite (a suite of tools to test EAP methods, and simulate a supplicant and/or wireless access points). You can do amazing things with wpa\_supplicant when combined with a real wireless access point. But what if you just want to simulate the EAP authentication without all the nuts and bolts of a wireless infrastructure? Let's face it, our AAA server ultimately processes Radius packets which are the result of the interactions of the supplicant and NAD (authenticator). Keep reading to find out how to mimic a real EAP conversation to a Radius server. ![RADIUS Server Policies](https://blog.iptel.com.au/hs-fs/hubfs/Imported_Blog_Media/Radius_Server_Policies_blog_series_Small2.png?width=462&name=Radius_Server_Policies_blog_series_Small2.png) --- ## EAP Framework in wpa\_supplicant As mentioned in the introduction, the wpa\_supplicant package contains the tools we need, and this suite is available in most Linux distributions - in the Red Hat/CentOS distribution it can be installed with yum: ``` yum install wpa_supplicant ``` In this blog we’re only interested in the utility called eapol\_test contained in the package. Related reading - [Troubleshooting with Catalyst Center](https://blog.iptel.com.au/troubleshooting-with-cisco-dna-center) - [Cisco Catalyst Center Assurance](https://blog.iptel.com.au/blog/cisco-catalyst-center-assurance) - [5 Ways Catalyst Center Solves your Challenges](https://info.iptel.com.au/cisco-dna) --- ## EAP-PEAP Example Using eapol\_test There is a command line component as well as a configuration file. The configuration file (let's call it mschap.conf) should contain the following text - edit it appropriately - however the only things you should need to edit are the identity (MSCHAP username) and the password, which are the credentials stored in your AAA or AD. The ca\_cert is a nice to have and it will be used during the TLS setup to validate the Radius Server certificate. ``` network={ ssid="example" key_mgmt=WPA-EAP eap=PEAP identity="bob" anonymous_identity="anonymous" password="AbCd123" phase2="auth=MSCHAPV2" # Line below performs server certificate validation. # It is optional - just comment it out if you have no certificate ca_cert="/home/someuser/Downloads/MegaRootCert.cer"} ``` Now you can execute a PEAP authentication as follows: ``` eapol_test -c mschap.conf -s RadiusS3cret -a 192.168.21.101 -M '00:00:00:00:00:10' -N '6:d:2' ``` The Radius server in my example is Cisco ISE but it could be any Radius product that supports EAP. In my example the Radius server listens on 192.168.21.101. We shall pretend to be a Wi-Fi client with MAC address (Calling-Station-Id) of 00:00:00:00:00:10. The -N '6:d:2' is a handy argument to add additional Radius attributes to the request. The effect of the argument is to send a Service-Type=Framed attribute (see RFC2865 section 5.6). The value 6 is the radius attribute value that specifies 'Service-Type', and 2 is the decimal constant that defines 'Framed'. The output of the command is quite verbose and mostly not needed. We generally look out for the last few lines of the command’s output, to reveal a success or failure. ``` MPPE keys OK: 1 mismatch: 0SUCCESS ``` Related reading - [Zero Trust Architecture (ZTA) Introduction](https://blog.iptel.com.au/zero-trust-architecture) - [Cisco Catalyst Center Beginners Guide](https://blog.iptel.com.au/cisco-dna-center) --- ## Prototyping RADIUS Server Policies: Summary The ISE server and the eapol\_test utility enter into the usual EAP exchange and the result is true to the real world. You can test your Radius server’s EAP policy logic without ever having to touch a real networking device! This is a real productivity boost. But be aware that there is no substitute for the real experience since the real devices may not always do the right thing. Related reading - [Cisco ISE: Top 5 Unique Features](https://blog.iptel.com.au/why-cisco-ise) - [Cisco Catalyst Center Enablement](https://blog.iptel.com.au/cisco-dna-center-enablement) - [Cisco SD-Access Lab: Part 1](https://blog.iptel.com.au/cisco-sd-access-lab-part-1)   As with all work you undertake on your RADIUS installation, take great care to have a backup and backout plan: this tends to be critical infrastructure, so take care when making any changes to a live network.   #### Related Articles ###### [Prototyping RADIUS Server Policies: Part 3](https://blog.iptel.com.au/prototyping-radius-server-policies-part-3) July 24, 2026 ###### [Prototyping Radius Server Policies - Part 1](https://blog.iptel.com.au/prototyping-radius-server-policies-part-1) July 24, 2026 ###### [Wi-Fi and The Problem With RADAR (DFS)](https://blog.iptel.com.au/wifi-and-the-problem-with-radar) July 21, 2025 Free tool ### How Many Wi-Fi Access Points Do You Need? Work out APs, PoE and switch ports floor by floor, using the same survey grades our Cisco wireless engineers design to. Takes under a minute. [Try the AP Estimator →](https://iptel.com.au/resources/wifi-access-point-estimator?utm_source=blog&utm_medium=cta&utm_campaign=ap-estimator) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "IPTel Solutions", "url" : "https://blog.iptel.com.au/author/iptel-solutions" }, "dateModified" : "2026-10-03T07:37:06.732Z", "datePublished" : "2026-07-24T03:24:05.000Z", "headline" : "Prototyping RADIUS Server Policies: Part 2", "image" : [ "https://blog.iptel.com.au/hubfs/Blogs/Prototyping%20RADIUS%20Server%20Policies/Prototyping%20RADIUS%20Server%20Policies%20Part%202%20(Instagram).gif" ], "mainEntityOfPage" : { "@id" : "https://blog.iptel.com.au/prototyping-radius-server-policies-part-2", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.iptel.com.au/hubfs/IPTel_Solutions_February2020%20-%20Header%20SiteMap/Images/IPTellogo-byline-2020-dark-v2.png" }, "name" : "IPTel Solutions Pty Ltd" } } ```