...

Upon connecting a device to an ethernet port on a switch or associating to a wireless SSID, the network switch or wifi router concerned will initially not allow any data to be transmitted/received by the device. It will request the connected device to identify itself and, upon approval of the supplied credentials by an authentication server, start accepting packets from/to the newly connected device, or continue dis-allowing, in the case the authentication server did not approve the credentials.

Architecture

802.1X is the protocol that defines how EAP messages are transmitted over an IEEE 802 network (e.g. ethernet, wifi).

In the above example, a wifi router is providing access to the 192.168.254.0/24 network. When a device (called a supplicant) attempts to connect to the wifi network, the wireless router starts an EAP conversation with the supplicant over 802.1X, requesting it to supply credentials. The router then connects to the authentication server (which, in the example above is also part of the 192.168.254.0/24 network) and sends the EAP response it received from the supplicant over the RADIUS protocol. A well known RADIUS server software is called FreeRADIUS.

Things to mention:

What RADIUS/802.1X is able to provide and not and in which situations.

...

Terminology: NAS, RADIUS, FreeRADIUS, Authenticator, Supplicant, Authentication server

Diameter

Protocols used: EAP, MSCHAP, PEAP, TTLS, TLS

...

sites-available

mods-available 

Wifi keying, session timeout, etc.

Sources

Support / Knowledge places

...