WEBVTT

1
00:00.000 --> 00:05.730
Let's touch quickly on the concept of 802.1x and E, and we'll start with 802.1x

2
00:05.730 --> 00:05.880
.

3
00:05.880 --> 00:12.600
802.1x is a set of authentication standards created by the IEEE.

4
00:12.600 --> 00:16.480
It defines how to perform authentication when a host joins a network.

5
00:16.480 --> 00:21.960
And what's cool about this is it can be deployed for wireless authentication,

6
00:21.960 --> 00:22.360
but it can also

7
00:22.360 --> 00:24.320
be deployed for wired authentication.

8
00:24.320 --> 00:31.340
A lot of us might have some level of experience deploying 802.1x into our wired
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:24.320 --> 00:31.340
A lot of us might have some level of experience deploying 802.1x into our wired

9
00:31.340 --> 00:32.560
LAN space.

10
00:32.560 --> 00:36.760
However, once again, we can use it on the wireless side in order to make sure

11
00:36.760 --> 00:37.640
that our

12
00:37.640 --> 00:41.600
clients are actually supposed to be getting onto our wireless network.

13
00:41.600 --> 00:48.040
Now there's a specific architecture in mind with 802.1x.

14
00:48.040 --> 00:51.560
And so we need to understand what that architecture looks like.

15
00:51.560 --> 00:56.320
So in our case, we've got a station that's trying to authenticate.

16
00:56.320 --> 01:01.920
We've got a device here that is trying to perform that authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:56.320 --> 01:01.920
We've got a device here that is trying to perform that authentication.

17
01:01.920 --> 01:04.840
And then we also have a server on the back end.

18
01:04.840 --> 01:08.200
802.1x gives us specific terms for these.

19
01:08.200 --> 01:11.880
The station is known as a supplicant.

20
01:11.880 --> 01:15.240
It's the one that's trying to authenticate to the network.

21
01:15.240 --> 01:19.480
The device here in the middle, this is the authenticator.

22
01:19.480 --> 01:23.220
The authenticator is responsible for deciding whether or not the supplicant is

23
01:23.220 --> 01:23.800
allowed to

24
01:23.800 --> 01:25.040
join the network.

25
01:25.040 --> 01:28.800
So we've got some amount of communications going back and forth here.

26
01:28.800 --> 01:32.550
But even though the authenticator is responsible for that, usually we're going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:28.800 --> 01:32.550
But even though the authenticator is responsible for that, usually we're going

27
01:32.550 --> 01:33.200
to still have

28
01:33.200 --> 01:38.720
another device over here, which is the authentication server.

29
01:38.720 --> 01:43.600
The authentication server is usually going to be running radius or tack-acts.

30
01:43.600 --> 01:49.330
And it's going to have the credentials or otherwise it's going to understand

31
01:49.330 --> 01:49.800
who's

32
01:49.800 --> 01:52.120
allowed to access the network.

33
01:52.120 --> 01:55.960
And so we have communications going back and forth between the authenticator

34
01:55.960 --> 01:56.280
and the

35
01:56.280 --> 01:58.120
authentication server.

36
01:58.120 --> 02:03.320
Now in a wireless world, the authenticator is usually the access point or it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:58.120 --> 02:03.320
Now in a wireless world, the authenticator is usually the access point or it

37
02:03.320 --> 02:04.080
could be

38
02:04.080 --> 02:06.200
the wireless LAN controller.

39
02:06.200 --> 02:12.770
Meaning that the access point passes this information through to the wireless

40
02:12.770 --> 02:16.080
LAN controller here.

41
02:16.080 --> 02:20.090
And then the wireless LAN controller has the communication back and forth with

42
02:20.090 --> 02:21.040
the authentication

43
02:21.040 --> 02:22.080
server.

44
02:22.080 --> 02:26.440
And so we've got two different potential sources of architecture here or

45
02:26.440 --> 02:27.520
different ways of

46
02:27.520 --> 02:29.400
doing this in the wireless world.

47
02:29.400 --> 02:32.800
And with lightweight architecture very often, it's going to be the wireless LAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.400 --> 02:32.800
And with lightweight architecture very often, it's going to be the wireless LAN

48
02:32.800 --> 02:33.360
controller

49
02:33.360 --> 02:38.680
that's actually serving the authenticator role.

50
02:38.680 --> 02:44.480
So it's not just 802.1x, but we also have EAP involved with this process.

51
02:44.480 --> 02:45.480
EAP is interesting.

52
02:45.480 --> 02:50.920
It actually stands for the extensible authentication protocol.

53
02:50.920 --> 02:54.320
And yet it's not really a protocol.

54
02:54.320 --> 02:58.320
Or at least it's not a protocol we would deploy into our network.

55
02:58.320 --> 03:03.610
Instead this is more of a framework that helps us to define different protocols
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:58.320 --> 03:03.610
Instead this is more of a framework that helps us to define different protocols

56
03:03.610 --> 03:04.080
that can

57
03:04.080 --> 03:05.800
be built on EAP.

58
03:05.800 --> 03:10.110
So for example, we're going to have protocols such as protected EAP, which is P

59
03:10.110 --> 03:10.560
EEP.

60
03:10.560 --> 03:15.400
And we're going to have EAP TLS and EAP TTLS.

61
03:15.400 --> 03:20.850
We've got a lot of different types of EAP protocols that are built on this ext

62
03:20.850 --> 03:22.240
ensible authentication

63
03:22.240 --> 03:23.640
protocol.

64
03:23.640 --> 03:33.000
And the type of EAP is what's going to determine the authentication mechanism.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:23.640 --> 03:33.000
And the type of EAP is what's going to determine the authentication mechanism.

65
03:33.000 --> 03:36.880
Namely, are we going to use a username and password?

66
03:36.880 --> 03:40.920
Are we going to use certificates and so on and so forth?

67
03:40.920 --> 03:45.800
Now anytime we're talking about wireless security, we tend to group these two

68
03:45.800 --> 03:45.880
together.

69
03:45.880 --> 03:49.770
And it makes sense because when we look at an 802.1x supplicant, communicating

70
03:49.770 --> 03:50.200
with an

71
03:50.200 --> 03:55.160
authenticator, 802.1x doesn't tell us how to authenticate.

72
03:55.160 --> 03:58.120
It just defines this architecture for us.

73
03:58.120 --> 04:03.170
So it's EAP that actually allows us to communicate back and forth between the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:58.120 --> 04:03.170
So it's EAP that actually allows us to communicate back and forth between the

74
04:03.170 --> 04:04.200
supplicant and the

75
04:04.200 --> 04:05.640
authenticator.

76
04:05.640 --> 04:09.080
And then it's, as mentioned, something like radius on the back end or

77
04:09.080 --> 04:10.440
potentially takx

78
04:10.440 --> 04:14.070
plus that is going to allow the authenticator to communicate with the

79
04:14.070 --> 04:15.600
authentication server.

80
04:15.600 --> 04:21.840
And so all of these protocols and frameworks, 802.1x, EAP and radius or takx,

81
04:21.840 --> 04:22.600
these are

82
04:22.600 --> 04:26.260
going to work together to allow us to authenticate a station, allow it to

83
04:26.260 --> 04:27.680
connect to the network.

84
04:27.680 --> 04:37.680
[BLANK_AUDIO]