eapol_test Over a VPN: Does the RADIUS Exchange Need Layer 2?

Ask for a lab switch port so you can run eapol_test and you have probably misread the tool. The peer and the RADIUS client both live inside that single binary, so the only conversation leaving the machine is the RADIUS exchange itself. A routed tunnel between the test host and the authentication server is the whole network requirement. The physical 802.1X path is a different thing you may still need to test, and it is not this.

Why the name sends people hunting for a switch port

EAPOL is the frame format a supplicant and a switch use on a LAN, and the tool borrows the name because it grew out of that world. What ships is a test program that carries the peer state machine and the RADIUS client in one process, so the two halves of an 802.1X conversation never meet over a wire. The name is history, not a topology requirement.

People still ask for the port because the program sits on authenticator behaviour, and that sounds like hardware. Its glue reproduces the authenticator state machine, so a test completes with no access point in the room; the compiled binary links wpa_supplicant's EAP peer with hostapd's RADIUS client. Removing the switch removes the EAPOL hop, not the authentication logic. What remains is a client-server exchange between two IP hosts.

Follow one RADIUS exchange hop by hop

Trace a single attempt and the path is short. The peer inside eapol_test produces an EAP-Response for the method you configured, and the RADIUS client in the same process puts it into an Access-Request, carrying the payload in EAP-Message attributes next to a Message-Authenticator. That datagram is addressed to the server on UDP port 1812, and it leaves the host like any other IP packet, which is where the tunnel comes in. The server evaluates it against its policy and its method modules, then answers with Access-Challenge, Access-Accept or Access-Reject.

eapol_test -c peap-mschapv2.conf -a 198.51.100.20 -p 1812 \
  -s REPLACE_WITH_RADIUS_SECRET -t 30

The binary takes the server address, the port and the shared secret from the command line, and the method and credentials from a wpa_supplicant-style configuration block. Nothing in that invocation depends on a Layer 2 adjacency: -a is reached by routing, and a VPN that routes it is enough. If the tunnel drops the datagram, the test fails exactly as it would against an unreachable server on a flat LAN.

The binary and the server policy are different lists

Two independent lists decide whether a method can pass, and confusing them wastes a day. The first list is compiled into the binary: the build configuration selects which EAP methods exist, so a build without a method cannot negotiate it no matter what the server allows. The second list lives on the server, where policy says which of the supported methods this client class may use. A pass requires an intersection, and neither list can fill a gap in the other.

Check that first list before you blame the server. Search the installed binary for the method name, or read the build configuration it came from. If the method is absent, rebuild rather than editing RADIUS policy; if it is present and the exchange still fails, the problem has moved to credentials, policy or certificate trust.

What a pass still does not cover

A successful run proves one method, for one credential set, against one RADIUS policy, over one network path. It does not exercise the radio of the access point, the EAPOL handling of a switch, the VLAN assignment that follows authentication, or the way a VPN concentrator integrates with the same server. Those components were never on the tested path. Treat the result as bounded evidence, and say which bound it covers when you report it.

The useful record is what the server and the process each observed: which method was negotiated, where the exchange stopped, and what the server logged. Keep shared secrets and private keys out of that record.

Checklist before you quote the result

Before anyone treats the output as an approval, confirm four things. The build includes the method under test, the RADIUS endpoint and shared secret belong to the environment being tested, the server policy admits this test identity, and the network path is the same class of path production clients use. Then name what the run did not touch: access point, switch, VLAN and concentrator integration each need their own line in the test plan.

Two tests with two owners beat one ambiguous sign-off. The eapol_test run answers the method-and-server question; the access service answers the enforcement question.