EAP-PEAP (Protected Extensible Authentication Protocol) #
-
How It Works in Simple Terms:
-
EAP-PEAP creates a secure tunnel using encryption (TLS) to protect the login process.
-
It allows users to authenticate using a username and password while keeping their credentials safe.
-
Only the RADIUS server needs a security certificate, making it easier to set up.
-
-
Common Use:
-
Businesses looking for a balance between security and ease of use without requiring extra setup on user devices.
-
-
Netgraph Entrypoint enhances EAP-PEAP authentication by supporting:
-
Flexible management: By allowing administrators to manually and statically add users directly into specific groups. This capability provides precise control, enabling administrators to pre-define user access permissions based on organizational roles or departments.
-
Simplified onboarding: Providing the option for simplified onboarding through Self-Service Enrollment, where users can be automatically assigned access privileges upon their first login, reducing administrative overhead.
-
EAP-TLS (Extensible Authentication Protocol – Transport Layer Security) #
-
How It Works in Simple Terms:
-
EAP-TLS uses digital certificates instead of passwords to verify users.
-
Both the user device and the RADIUS server must have a certificate to prove they are trustworthy.
-
This makes it extremely secure but requires a system to issue and manage certificates.
-
-
Common Use:
-
Organizations that follow a Zero Trust security model, where every device must prove its identity before connecting.
-
-
Netgraph Entrypoint enhances EAP-TLS authentication by supporting:
-
Device Certificates: Ensuring that only trusted, enrolled devices can access the network.
-
User Certificates: Allowing authentication based on individual user certificates, improving security over password-based methods.
-
Backend Identity Store with Microsoft Entra ID: Verifying user identities against Microsoft’s cloud-based directory service, enabling seamless integration with existing identity management.
-
Intune Compliance Check: Enforcing security policies by verifying that devices meet compliance standards (such as OS updates, security patches, and encryption) before granting access.
-
Certificate validation: Supports automatic certificate validation through integrated Certificate Revocation Lists (CRL), ensuring that only devices with trusted, valid certificates can securely access your network.
-
Both Methods in Netgraph Entrypoint #
Both EAP-PEAP and EAP-TLS can be applied to the same Netgraph Entrypoint RADIUS-as-a-Service. This allows organizations to flexibly support different authentication needs while maintaining security and scalability.