802.1x, Encryption and Authentication - PEAP

Protected Extensible Authentication Protocol (PEAP), with PEAP only the server requires a certificate, installing a certificate on every client is not required. The RADIUS server must support self-issuing of certificates.

PHASE1 - server-side authentication is performed and an encrypted TLS tunnel is created.
PHASE2 - Client is authenticated using EAP-MSCHAPv2 or EAP-GTC, GTP can use generic databases to authenticate, such as LDAP/NDS, MSCHAP enables MS active directory single sign-on.

Client associates with the AP, only AES traffic is permitted by the AP until RADIUS server authenticates. PEAP goes through phase1/2, the client authenticates the server using the CA to verify the certificate. The client and server establish a secure tunnel, the client submits it's credentials to the server inside the tunnel. The RADIUS server sends a session key in a success packet, the RADIUS server and client negotiate a session encryption key (based on WEP or 802.11i

At the end of the session the client sends an EAPOL logoff packet to the AP, from this point only AES is accepted from the client.