APC Enhancements - Proxy by Controller Directly

Zyxel_Claudia

Proxy by Controller Directly (EAP Proxy)

Zyxel Networks has introduced the Proxy by Controller Directly feature, also known as EAP Proxy or EAP Passthrough. This feature instructs managed APs to encapsulate EAP messages within RADIUS messages. RADIUS requests consist of two layers: an outer layer (such as PEAP or EAP-TLS) and an inner EAP message containing credentials and attributes. This setting is configured under the SSID profile when using WPA Enterprise.

Internal vs. External Authentication

In Internal Authentication, the AP controller acts as a RADIUS relay, meaning the external RADIUS server only needs to allow list the controller's IP address. If EAP Proxy is disabled, the controller terminates the TLS tunnel, and the client sees the firewall's certificate. If EAP Proxy is enabled, the controller passes the full original message, allowing the RADIUS server to terminate the tunnel; consequently, the client sees the RADIUS server's certificate.

EAP Method Support

As of firmware version 1.37, the AP controller only supports PEAP for tunnel termination. For other methods like EAP-TLS, users must enable EAP Proxy to allow the RADIUS server to handle the authentication process directly.