TILab All EAP lower layers that have been defined for network access authentication have the requirement that an EAP peer and an EAP authenticator are in the same IP subnet. This draft describes some scenarios where relaxing this requirement so that the EAP peer and the EAP authenticator are multiple IP hops away from each other could be useful or necessary. The draft also extracts a set of requirements for the design of such a multi-hop EAP lower layer based on the scenarios.