WEBVTT

1
00:00.000 --> 00:06.780
We're going to jump into configuring our iOS XC as well as our AirOS wireless

2
00:06.780 --> 00:07.520
LAN controllers

3
00:07.520 --> 00:09.440
for wireless security.

4
00:09.440 --> 00:14.100
When we configured these earlier on, we would create the WLANs, and those WLANs

5
00:14.100 --> 00:14.680
have our

6
00:14.680 --> 00:21.280
SSIDs and our SSID configurations, and that includes the network security.

7
00:21.280 --> 00:25.950
Now in order to just focus on getting our WLANs and SSIDs configured, we didn't

8
00:25.950 --> 00:26.360
configure

9
00:26.360 --> 00:27.520
any security at all.

10
00:27.520 --> 00:29.600
We simply said no security.

11
00:29.600 --> 00:32.920
But now it's time for us to go in and configure all of the security concepts
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:29.600 --> 00:32.920
But now it's time for us to go in and configure all of the security concepts

12
00:32.920 --> 00:33.640
that we talked

13
00:33.640 --> 00:36.360
about in the previous skill.

14
00:36.360 --> 00:39.700
We're going to get in there, find the security tab, and we'll be able to

15
00:39.700 --> 00:40.520
configure Layer

16
00:40.520 --> 00:46.750
2, Layer 3, as well as the needed AAA configuration for getting our WPA

17
00:46.750 --> 00:48.760
enterprise online.

18
00:48.760 --> 00:53.510
So there are three primary methods that we're going to want to explore for our

19
00:53.510 --> 00:54.360
enterprise

20
00:54.360 --> 00:55.520
networks.

21
00:55.520 --> 01:00.070
We shouldn't just go into our wireless security configuration and configure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:55.520 --> 01:00.070
We shouldn't just go into our wireless security configuration and configure

22
01:00.070 --> 01:01.280
whatever is easiest

23
01:01.280 --> 01:05.000
for us, which would probably be just disabling the security again.

24
01:05.000 --> 01:09.030
But certainly we wouldn't want to necessarily go with pre-shared key unless we

25
01:09.030 --> 01:09.680
have a very

26
01:09.680 --> 01:11.600
specific reason for doing that.

27
01:11.600 --> 01:15.110
But as we look at our three methods, certainly the first one is going to be the

28
01:15.110 --> 01:15.680
pre-shared

29
01:15.680 --> 01:16.680
key.

30
01:16.680 --> 01:22.720
When we see pre-shared key, we are referring to that concept of WPA personal.

31
01:22.720 --> 01:26.620
And we should always be attention to anything labeled "personals" really not

32
01:26.620 --> 01:27.160
designed

33
01:27.160 --> 01:29.760
for being used in the enterprise space.

34
01:29.760 --> 01:33.960
Now pre-shared key will work as well as it's designed to work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:29.760 --> 01:33.960
Now pre-shared key will work as well as it's designed to work.

35
01:33.960 --> 01:37.680
It will allow us to hand the pre-shared key out to individuals.

36
01:37.680 --> 01:42.100
It will serve as our authentication mechanism from that perspective, meaning

37
01:42.100 --> 01:43.040
that again,

38
01:43.040 --> 01:48.600
we prove that we belong on the network by showing that we have the key.

39
01:48.600 --> 01:50.800
And so that's an authentication mechanism.

40
01:50.800 --> 01:53.040
And it will provide encryption, no problem.

41
01:53.040 --> 01:59.200
So the issue here, as we detailed out, is that there's no real scaling here.

42
01:59.200 --> 02:01.640
And there's no real granularity.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:59.200 --> 02:01.640
And there's no real granularity.

43
02:01.640 --> 02:04.320
This is a big concern in the enterprise space.

44
02:04.320 --> 02:09.450
If I have dozens or hundreds or thousands of employees, then if one of them

45
02:09.450 --> 02:10.560
leaves and

46
02:10.560 --> 02:13.600
they know the pre-shared key, that's going to be a big problem for me.

47
02:13.600 --> 02:17.350
I'm going to have to change the pre-shared key on every single mobile device if

48
02:17.350 --> 02:17.960
I consider

49
02:17.960 --> 02:20.760
that pre-shared key to be compromised.

50
02:20.760 --> 02:24.870
Furthermore, if I have the pre-shared key, then I'm next to somebody else who's

51
02:24.870 --> 02:25.240
using

52
02:25.240 --> 02:27.000
the same pre-shared key.

53
02:27.000 --> 02:30.470
Well, since they're using it to encrypt traffic and derive their encryption
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:27.000 --> 02:30.470
Well, since they're using it to encrypt traffic and derive their encryption

54
02:30.470 --> 02:31.800
keys ultimately,

55
02:31.800 --> 02:35.320
well, I can use it to decrypt their traffic as well.

56
02:35.320 --> 02:39.480
And so that's a real danger to even using this in a cafe, for example.

57
02:39.480 --> 02:44.040
This is why we have to be careful when we're using our corporate devices at our

58
02:44.040 --> 02:44.520
on public

59
02:44.520 --> 02:45.520
Wi-Fi.

60
02:45.520 --> 02:49.050
We should always be using a VPN or something to encrypt our traffic on top of

61
02:49.050 --> 02:49.760
the wireless

62
02:49.760 --> 02:54.690
security, because even if we're using a pre-shared key to connect to a cafe's

63
02:54.690 --> 02:55.920
Wi-Fi, well, anybody

64
02:55.920 --> 03:00.690
who is sitting around who also has that pre-shared key could not only use it to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:55.920 --> 03:00.690
who is sitting around who also has that pre-shared key could not only use it to

65
03:00.690 --> 03:01.600
listen in on

66
03:01.600 --> 03:05.330
my communications, but then decrypt it, and they'll be able to see everything I

67
03:05.330 --> 03:05.840
'm doing

68
03:05.840 --> 03:08.760
that isn't itself encrypted.

69
03:08.760 --> 03:12.420
So we have to be very careful with pre-shared key, but as we see here, WPA

70
03:12.420 --> 03:13.520
Personal, again,

71
03:13.520 --> 03:17.020
not really designed for use in the enterprise space, and yet we'll still have

72
03:17.020 --> 03:17.520
to know how

73
03:17.520 --> 03:18.840
to configure this.

74
03:18.840 --> 03:22.600
When we do configure a pre-shared key, it's going to be an ASCII pre-shared key

75
03:22.600 --> 03:23.200
, which

76
03:23.200 --> 03:27.490
means it can be a memorable word or phrase, whatever it is that we want to

77
03:27.490 --> 03:28.280
deploy as the

78
03:28.280 --> 03:33.440
key that will be used to allow devices to access the wireless network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:28.280 --> 03:33.440
key that will be used to allow devices to access the wireless network.

79
03:33.440 --> 03:38.990
From there, our second option is going to involve 802.1x, and when we see that

80
03:38.990 --> 03:39.800
option,

81
03:39.800 --> 03:44.840
we're going to know that that's referring to WPA Enterprise.

82
03:44.840 --> 03:49.180
And there's the name Enterprise, which tells me that we are now talking about a

83
03:49.180 --> 03:49.800
solution

84
03:49.800 --> 03:52.520
we should be deploying into our corporate networks.

85
03:52.520 --> 03:58.970
So this is going to require the configuration of AAA services, especially

86
03:58.970 --> 03:59.680
something like

87
03:59.680 --> 04:04.800
a radius or possibly a TAC-AC server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:59.680 --> 04:04.800
a radius or possibly a TAC-AC server.

88
04:04.800 --> 04:08.090
So whatever we're running in our environment, and if in your lab environment

89
04:08.090 --> 04:08.920
you don't have

90
04:08.920 --> 04:12.330
this running, but you still want to configure it, then we can still configure

91
04:12.330 --> 04:13.480
dummy addresses,

92
04:13.480 --> 04:16.140
but we're going to want to make sure we at least know the configuration process

93
04:16.140 --> 04:16.440
, even

94
04:16.440 --> 04:19.160
if we can't test it on the back end.

95
04:19.160 --> 04:24.700
Now the pre-shared key is going to be pretty similar between iOS and iOS, but

96
04:24.700 --> 04:26.440
802.1x, when

97
04:26.440 --> 04:33.340
we configure this on iOSXE, iOSXE is going to configure AAA services like it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:26.440 --> 04:33.340
we configure this on iOSXE, iOSXE is going to configure AAA services like it

98
04:33.340 --> 04:34.440
does on an

99
04:34.440 --> 04:38.910
iOSXE switch, meaning that we're going to configure our servers, and we're

100
04:38.910 --> 04:39.280
going to

101
04:39.280 --> 04:41.280
configure our server groups.

102
04:41.280 --> 04:45.770
We're going to add the servers specifically into our groups, and then we're

103
04:45.770 --> 04:46.840
going to reference

104
04:46.840 --> 04:51.160
those as part of our 802.1x configuration.

105
04:51.160 --> 04:56.830
Meanwhile, if we're looking at iOS, iOS is going to be a little bit simpler

106
04:56.830 --> 04:57.720
than iOSXE,

107
04:57.720 --> 05:02.600
I'm just going to manually configure servers and specify them in my security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:57.720 --> 05:02.600
I'm just going to manually configure servers and specify them in my security

108
05:02.600 --> 05:03.440
policy.

109
05:03.440 --> 05:08.130
So not particularly ideal if I have a lot of servers, for example, but again,

110
05:08.130 --> 05:08.640
this is

111
05:08.640 --> 05:14.220
where iOSXE is falling back on the fact that it's truly running iOSXE on the

112
05:14.220 --> 05:15.520
back end.

113
05:15.520 --> 05:20.400
If I log in to my iOSXE device at CLI, I'm going to feel very comfortable if I

114
05:20.400 --> 05:21.160
know switch

115
05:21.160 --> 05:23.560
and router configuration.

116
05:23.560 --> 05:27.210
And so anything that we're doing in the graphical user interface, like servers

117
05:27.210 --> 05:28.000
and groups, we

118
05:28.000 --> 05:30.240
say, well, this isn't how AROS did it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
05:28.000 --> 05:30.240
say, well, this isn't how AROS did it.

119
05:30.240 --> 05:31.640
Why is it doing it that way?

120
05:31.640 --> 05:37.870
Well, it's because again, it really is running iOSXE, and probably that's how

121
05:37.870 --> 05:38.600
iOSXE is.

122
05:38.600 --> 05:41.280
Handles, whatever it is we're configuring.

123
05:41.280 --> 05:45.620
Now, the last thing to look at, or the last option or method that we have

124
05:45.620 --> 05:46.600
available to

125
05:46.600 --> 05:52.200
us is going to be that web auth, which is considered by Cisco, and I guess

126
05:52.200 --> 05:53.200
everyone,

127
05:53.200 --> 05:57.190
to be a layer three security method, meaning that we're not going to use layer

128
05:57.190 --> 05:58.160
two security,

129
05:58.160 --> 06:00.440
which are these other two options.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
05:58.160 --> 06:00.440
which are these other two options.

130
06:00.440 --> 06:06.610
So web auth is going to allow both of our wireless LAN controller types to host

131
06:06.610 --> 06:06.960
that

132
06:06.960 --> 06:09.280
web page.

133
06:09.280 --> 06:13.000
And we'll do some minor customization of that web page and take a look at that.

134
06:13.000 --> 06:19.040
But we can also redirect to an external web page, if that's what we desire.

135
06:19.040 --> 06:21.990
If we want something a little bit more customizable, something that we design

136
06:21.990 --> 06:22.720
ourselves, it's

137
06:22.720 --> 06:27.480
going to have to be an external type of web page that we redirect to.

138
06:27.480 --> 06:30.910
If we're okay with the basic web page that Cisco gives us, then we can simply
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:27.480 --> 06:30.910
If we're okay with the basic web page that Cisco gives us, then we can simply

139
06:30.910 --> 06:33.400
use that.

140
06:33.400 --> 06:37.790
Now I also want to chat very briefly about WPA versions, because we're going to

141
06:37.790 --> 06:38.340
see those

142
06:38.340 --> 06:41.120
versions get addressed in our configuration.

143
06:41.120 --> 06:45.780
And this is a little bit of a history lesson as well with how wireless security

144
06:45.780 --> 06:46.880
was developed.

145
06:46.880 --> 06:54.320
So infamously, meaning famous for the wrong reasons, web was deployed as our

146
06:54.320 --> 06:55.800
first wireless

147
06:55.800 --> 06:57.880
security.

148
06:57.880 --> 07:01.520
And we used to configure web by using a key sort of like a pre shared key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
06:57.880 --> 07:01.520
And we used to configure web by using a key sort of like a pre shared key.

149
07:01.520 --> 07:04.790
We type the key in, it was in hexadecimal, and that would allow us to connect

150
07:04.790 --> 07:05.160
to the

151
07:05.160 --> 07:06.160
network.

152
07:06.160 --> 07:10.970
So this key is once again, providing authentication and encryption, sort of

153
07:10.970 --> 07:12.480
like our WPA pre shared

154
07:12.480 --> 07:13.880
key option.

155
07:13.880 --> 07:18.720
The problem with web is that it we used a mechanism known as RC4, which was

156
07:18.720 --> 07:19.480
actually

157
07:19.480 --> 07:24.590
fairly crackable with the way that it brought data in and used it to encrypt

158
07:24.590 --> 07:25.520
traffic.

159
07:25.520 --> 07:29.800
But what's interesting about this is the encryption algorithm or the cipher

160
07:29.800 --> 07:30.240
known as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

160
07:29.800 --> 07:30.240
known as

161
07:30.240 --> 07:33.280
T-Kip, this was actually okay.

162
07:33.280 --> 07:35.480
RC4 was the problem.

163
07:35.480 --> 07:42.300
And so what the wireless world did was they developed WPA, and WPA was able to

164
07:42.300 --> 07:43.720
be a software

165
07:43.720 --> 07:46.280
upgrade for web clients.

166
07:46.280 --> 07:50.740
The reason why it was software upgradeable was because it's still used the same

167
07:50.740 --> 07:51.520
hardware,

168
07:51.520 --> 07:53.480
it's still used T-Kip.

169
07:53.480 --> 07:58.920
It just redefined how exactly it was using T-Kip to encrypt the traffic.

170
07:58.920 --> 08:04.990
So then WPA2 came out, and WPA2 said, okay, so T-Kip is still kind of an old
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
07:58.920 --> 08:04.990
So then WPA2 came out, and WPA2 said, okay, so T-Kip is still kind of an old

171
08:04.990 --> 08:05.920
algorithm

172
08:05.920 --> 08:06.920
here.

173
08:06.920 --> 08:09.960
We don't necessarily want to use T-Kip, we're going to use AES.

174
08:09.960 --> 08:16.560
And AES to this day is considered to be a secure encryption protocol.

175
08:16.560 --> 08:24.160
So we're using AES, however, we can also use T-Kip for backward compatibility.

176
08:24.160 --> 08:27.960
Now these days T-Kip is considered to be unsecure.

177
08:27.960 --> 08:31.890
We do not want to run that backward compatibility, or at least that's not the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
08:27.960 --> 08:31.890
We do not want to run that backward compatibility, or at least that's not the

178
08:31.890 --> 08:33.000
desire anymore.

179
08:33.000 --> 08:37.360
So we do want to make sure that T-Kip is disabled unless we very specifically

180
08:37.360 --> 08:38.480
need very old wireless

181
08:38.480 --> 08:40.800
clients to connect to our network.

182
08:40.800 --> 08:46.640
Furthermore, WPA3 is out now because WPA2 has found to have some problems of

183
08:46.640 --> 08:47.520
its own.

184
08:47.520 --> 08:52.360
And so we certainly would want to move to WPA3 if we can, but this is going to

185
08:52.360 --> 08:53.000
require

186
08:53.000 --> 08:58.480
new hardware, and it's going to use GCMP for the encryption.

187
08:58.480 --> 09:04.070
So what we find is when we enable WPA, we can do it as WPA and WPA2 together
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

187
08:58.480 --> 09:04.070
So what we find is when we enable WPA, we can do it as WPA and WPA2 together

188
09:04.070 --> 09:04.800
because

189
09:04.800 --> 09:09.870
again of the backward compatibility, we just want to make sure T-Kip and WPA is

190
09:09.870 --> 09:10.640
disabled

191
09:10.640 --> 09:12.040
with that policy.

192
09:12.040 --> 09:16.920
We can also do a WPA2 and a WPA3 policy, but that disables a lot of the most

193
09:16.920 --> 09:17.560
useful

194
09:17.560 --> 09:22.500
features of WPA3, and that we might just not have a choice until most of all of

195
09:22.500 --> 09:23.560
our stations

196
09:23.560 --> 09:25.880
are upgraded for WPA3.

197
09:25.880 --> 09:31.570
Or we can simply migrate fully to WPA3, but again, like I just said, we need to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
09:25.880 --> 09:31.570
Or we can simply migrate fully to WPA3, but again, like I just said, we need to

198
09:31.570 --> 09:32.160
make sure

199
09:32.160 --> 09:36.920
that we're not excluding WPA2 stations that really need to be part of our

200
09:36.920 --> 09:37.800
network.

201
09:37.800 --> 09:41.500
So over the course of time, we see this progression happening, and hopefully

202
09:41.500 --> 09:42.320
eventually we're

203
09:42.320 --> 09:47.040
all running on WPA3 without the need to worry about running WPA2 from a

204
09:47.040 --> 09:48.680
backward compatibility

205
09:48.680 --> 09:50.000
perspective.

206
09:50.000 --> 09:52.720
So with that, let's go ahead and jump into the configuration.

207
09:52.720 --> 09:57.140
Again, we're going to configure iOSXE and AROS, but hopefully this gives us a

208
09:57.140 --> 09:57.840
good overview

209
09:57.840 --> 10:03.150
of what we're trying to accomplish, and the focus should be on two main points
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

209
09:57.840 --> 10:03.150
of what we're trying to accomplish, and the focus should be on two main points

210
10:03.150 --> 10:03.720
here,

211
10:03.720 --> 10:07.640
understanding the different policies that we could configure with WPA, and then

212
10:07.640 --> 10:08.200
especially

213
10:08.200 --> 10:12.280
these three methods, and really understanding that these are our primary

214
10:12.280 --> 10:13.000
options.

215
10:13.000 --> 10:16.450
When we look at the graphical user interface, we're going to see a lot of

216
10:16.450 --> 10:17.440
different things

217
10:17.440 --> 10:21.620
we can click and drop downs and such, but if we really stick to these methods

218
10:21.620 --> 10:22.200
and keep

219
10:22.200 --> 10:26.160
in mind what we're trying to accomplish here, as far as just configuring one of

220
10:26.160 --> 10:26.600
these at

221
10:26.600 --> 10:30.560
a time, that will help us to digest the graphical user interface and make sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

221
10:26.600 --> 10:30.560
a time, that will help us to digest the graphical user interface and make sure

222
10:30.560 --> 10:31.200
that we know

223
10:31.200 --> 10:34.160
how to configure our wireless LAN controllers for wireless security.