Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Like, as in requesting a "password" to connect, just wondering.

Also, are any of these (VPN, public key auth?) methods either possible or implemented?

share|improve this question
up vote 19 down vote accepted

You say "WPA2" but I suspect you're not looking for encryption but, rather, authentication. (If you are looking for encryption then skip to the edit at the end of this answer.)

I strongly suspect you're looking for is 802.1X authentication.

802.1X allows you to have wired (and wireless) clients authenticate before being granted access to the network. All the currently-supported versions of Windows support 802.1X, as do most other modern operating systems. Your Ethernet switches (and/or wireless access points) will also need to support 802.1X, which permits the switch to restrict traffic until the client authenticates.

Typically the switches (and/or wireless access points) would be configured to use a RADIUS server that actually performs the authentication. The RADIUS server would have policy definitions such that each of your switches doesn't need to be aware of the allowed clients but, rather, can just offload that decision to the RADIUS server. This gives you a lot of flexibility in defining policy and allows for scale.

The actual authentication uses the Extensible Authentication Protocol (EAP). EAP allows for a variety of authentication credentials to be used, including user/password or certificates.


If you are looking for encryption then IPsec with encapsulating security payload (ESP) is probably the way to go. (Arguably you can also use IPsec for authentication, too, but you won't get security at layer 2 like you will with 802.1X). IPsec can be statically keyed with a pre-shared key, not unlike WPA2, or it can be used with certificates or passwords (via EAP).

share|improve this answer
Might as well toss in that if he's looking for encryption then he's probably interested in IPSec. WPA's encryption was based on the same ideas as IPSec, so the Pre-Shared Key (PSK/Personal) and Certificate (Enterprise) methods of establishing the encrypted sessions are very similar. – Chris S Jul 9 '13 at 19:10
@ChrisS - That's funny. I'd written a sentence like that in the first paragraph and then pulled it because I thought it looked out-of-place. You're right, though-- it ought to be in there. – Evan Anderson Jul 9 '13 at 19:11
Thanks, Evan. I was just wondering how could authentication/encryption be implemented over ethernet. Seems it is actually doable (and it's implemented!). – Pato Sáinz Jul 9 '13 at 20:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.