Here's what happens when you connect to an X-protected network:
You plug in or associate with the wireless network. The authenticator detects you and sends an EAP-Request/Identity.
Your supplicant responds with your identity (username or certificate info).
The authenticator forwards this to the RADIUS server.
RADIUS challenges you through EAP methods (password, certificate, etc.).
Your supplicant responds to challenges via the authenticator.
RADIUS sends Accept or Reject. The authenticator opens or blocks the port based on the result.