As part of the process of configuring EAP for FreeRADIUS, you will need to test whether or not it works. If you prefer to use a command line tool rather than clicking through windows, this article walks through the steps for testing your EAP configuration.
How to test EAP authentication with command-line tools
Testing EAP authentication before deploying it across your network prevents authentication failures and compatibility issues. This guide covers command-line EAP testing using eapol_test with FreeRADIUS, including configuration examples for PEAP and TTLS.
Whether you're validating a new RADIUS server configuration or troubleshooting authentication failures, command-line tools provide precise control over the EAP authentication process.
While FreeRADIUS comes with a command-line tool called radeapclient, by far and away the best EAP testing tool is the eapol_test program from wpa_supplicant.
The default build of wpa_supplicant does not build the eapol_test program, so you will have to do that yourself.
Building eapol_test
Download the latest version of wpa_supplicant, and un-tar it, then follow these instructions to build it (update <version> as approprite):
$ cd wpa_supplicant-<version>/wpa_supplicant $ cp defconfig .config $ vi .config
Find the line containing
#CONFIG_EAPOL_TEST=y
and change it to
CONFIG_EAPOL_TEST=y
Then, type
$ make eapol_test
Once it is done, copy the file to some where in your PATH. e.g. /usr/local/bin, or ~/bin. The following tests assume that the eapol_test file has been installed, such as via the following command:
$ cp eapol_test /usr/local/bin/
Testing
Run the eapol_test program from the command-line, with one of the following configuration files.
$ eapol_test -c <file> -s testing123
Where <file> is one of the configuration files below. We are also assuming that the RADIUS server is on localhost, and that the shared secret is testing123.
PEAPv0
- EAP-GTC
- EAP-MSCHAPv2
EAP-TTLS
These configuration files assume that you are using the test user bob, with password hello, as given in the PAP howto.
If the production certificates have been created, then the ca_cert entry in each configuration file can be un-commented. The eapol_test program will then verify the server certificate.
Session Resumption, or Fast Reauthentiction
Use eapol_test -r 1 ... in order to test session resumption. See the eapol_test documentation for more information.
When manual testing isn't enough
Command-line testing with eapol_test works excellently for testing specific EAP configurations or troubleshooting authentication failures. However, network engineers managing large-scale deployments often encounter scenarios where manual testing becomes impractical.
Limitations of manual EAP testing
Scale challenges
Organisations managing hundreds or thousands of wireless devices face significant challenges with manual testing.
Each device type may support different EAP methods. Manual testing of each device model is time-consuming, and documenting test results across diverse device fleets requires significant effort. Firmware updates can also change device EAP capabilities without warning.
Incomplete visibility
Command-line tools test authentication success or failure, but don't automatically capture comprehensive device capabilities:
Which specific EAP methods does each device support?
Does the device support TLS session resumption for improved performance?
What TLS versions and cipher suites are compatible?
How does the device handle certificate validation?
Manual testing answers "does it work?" but requires additional effort to answer "what capabilities does it have?"
Automated EAP testing for enterprise deployments
For organisations managing large wireless device fleets - such as ISPs, mobile network operators (MNOs/MVNOs), large enterprises, healthcare organisations, and universities - automated EAP testing provides comprehensive device authentication profiling at scale.
InkBridge EAP Inspector offers automated device characterisation for InkBridge Networks support clients, providing:
Comprehensive device profiling
Supported EAP methods across your entire device fleet
TLS session resumption capability detection (critical for performance)
Certificate validation behaviour analysis
Authentication timing and performance metrics
Compliance-ready documentation
Generate detailed reports documenting device authentication capabilities for:
Regulatory standards and audit requirements
Internal security policy validation
Vendor compatibility verification
Audit trail documentation
Pre-deployment validation
Test device authentication capabilities before rollout:
Validate new handset models before customer distribution (MNO/MVNO use case)
Verify firmware update compatibility before deployment
Test diverse POS and handheld devices (retail use case)
Confirm medical device authentication (healthcare use case)
Post-update verification
After device software updates, immediately determine which EAP and authentication features are now supported, ensuring reliable operation and compliance are maintained.
Choosing the right testing approach
Use command-line testing when:
Validating RADIUS server configuration
Troubleshooting specific authentication failures
Testing new EAP method implementations
Verifying certificate and credential configurations
Learning EAP authentication mechanics in detail
Consider automated testing when:
Managing 100+ wireless devices with diverse capabilities
Deploying new device models or firmware updates at scale
Requiring compliance documentation across device fleets
Operating as an ISP, MNO/MVNO, or large enterprise
Needing systematic device capability profiling
Many organisations use both approaches: command-line testing for RADIUS server validation and troubleshooting, automated testing for device fleet management and compliance.
Learn more about EAP Inspector - available exclusively to InkBridge Networks support clients.
Need more help?
InkBridge Networks has been at the forefront of network security for over two decades, tackling complex challenges across various protocols and infrastructures. Our team of seasoned experts has encountered and solved nearly every conceivable network security issue. If you're looking for insights from the architects behind some of the internet's most foundational authentication systems, you can request a quote for network security solutions here.
Related Articles
Importing the root CA
The final step to configuring EAP for FreeRADIUS is to add the CA (Certificate Authority) to every client machine that performs EAP authentication.
The FreeRADIUS Auth-Type attribute
The FreeRADIUS Auth-Type attribute is often misunderstood and misused. There are actually very few situations where this attribute should be manipulated at all.