WEBVTT

1
00:00.000 --> 00:04.200
Alright, onward and upward, although maybe we should say it's onward and

2
00:04.200 --> 00:05.040
backward because

3
00:05.040 --> 00:07.840
now we're going back to how we did it with ARA-S.

4
00:07.840 --> 00:14.200
And as I mentioned, iOSXC borrowed a lot of its design principles from ARA-S.

5
00:14.200 --> 00:18.340
Now it looks a whole lot nicer on iOS and it runs a whole lot nicer, but what

6
00:18.340 --> 00:18.600
we'll

7
00:18.600 --> 00:23.020
find is that, again, if we can kind of navigate the iOSXC interface, then we

8
00:23.020 --> 00:23.720
can definitely

9
00:23.720 --> 00:26.640
navigate ARA-S because it'll feel similar.

10
00:26.640 --> 00:31.000
I'm going to come over to WLANs and ARA-S. We're going to create a new WLAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:26.640 --> 00:31.000
I'm going to come over to WLANs and ARA-S. We're going to create a new WLAN.

11
00:31.000 --> 00:36.480
We'll call this CBT-N-ARA-OS.

12
00:36.480 --> 00:37.800
This time we have to type it out again.

13
00:37.800 --> 00:39.000
CBT-N-ARA-OS.

14
00:39.000 --> 00:42.880
It'll apply.

15
00:42.880 --> 00:44.200
And we'll enable this.

16
00:44.200 --> 00:48.280
Remember, we've got to make sure it's tied to the correct interface, basically

17
00:48.280 --> 00:48.840
replacing

18
00:48.840 --> 00:52.240
what we did with the adding it to the tag in there.

19
00:52.240 --> 00:55.160
But either way, we're going to broadcast it, so those are all good.

20
00:55.160 --> 00:57.950
So I'm going to come over to the Security tab and once again we see these three

21
00:57.950 --> 00:58.720
sub-tabs.

22
00:58.720 --> 01:01.640
This is what I mean by it feeling pretty similar.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:58.720 --> 01:01.640
This is what I mean by it feeling pretty similar.

23
01:01.640 --> 01:05.750
So now instead of having all of my WPA options across the top, I'm going to see

24
01:05.750 --> 01:07.400
this drop-down.

25
01:07.400 --> 01:09.120
Now none is the same.

26
01:09.120 --> 01:11.480
It'd be disabling layer two security.

27
01:11.480 --> 01:13.520
We do see WPA-WPA2 here.

28
01:13.520 --> 01:17.760
We would see two and three with more modern hardware.

29
01:17.760 --> 01:21.640
What I want to be very careful of is this option right here.

30
01:21.640 --> 01:26.530
We might be inclined to think 802.1x in this drop-down is how we configure WPA

31
01:26.530 --> 01:27.480
Enterprise.

32
01:27.480 --> 01:28.640
It is not.

33
01:28.640 --> 01:32.680
If I click this, notice we go right to web configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:28.640 --> 01:32.680
If I click this, notice we go right to web configuration.

34
01:32.680 --> 01:36.740
This 802.1x drop-down is an extremely legacy option.

35
01:36.740 --> 01:40.760
We don't want to click it unless we, well, yeah, in the modern network we never

36
01:40.760 --> 01:41.040
want

37
01:41.040 --> 01:42.040
to click it.

38
01:42.040 --> 01:45.820
In the same way we'd never want to click static web and web with 802.1x or any

39
01:45.820 --> 01:46.000
of

40
01:46.000 --> 01:50.300
these other options, it's always going to be one of these two primary options

41
01:50.300 --> 01:51.000
up here.

42
01:51.000 --> 01:56.840
Now if we do want to configure 802.1x with WPA, then I would select my WPA and

43
01:56.840 --> 01:57.440
WPA2.

44
01:57.440 --> 02:01.470
Once again, seeing I've got WPA and WPA2 policy, we've got encryption options,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:57.440 --> 02:01.470
Once again, seeing I've got WPA and WPA2 policy, we've got encryption options,

45
02:01.470 --> 02:02.040
we have those

46
02:02.040 --> 02:06.080
in iOSXE as well, and then down here authentication key management.

47
02:06.080 --> 02:07.600
Well, that should feel familiar.

48
02:07.600 --> 02:12.390
We had an authentication key management section in iOSXE, and so it's going to

49
02:12.390 --> 02:13.200
be pretty much

50
02:13.200 --> 02:14.200
the same thing here.

51
02:14.200 --> 02:18.720
In fact, we see our fast transition options, we see our PSK option.

52
02:18.720 --> 02:23.680
So if I want to configure WPA2 pre-shared key, I can check this box for PSK,

53
02:23.680 --> 02:24.520
come down,

54
02:24.520 --> 02:29.960
configure my CVTN1234, and that should be good.

55
02:29.960 --> 02:32.440
So I'm going to click apply.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:29.960 --> 02:32.440
So I'm going to click apply.

56
02:32.440 --> 02:39.370
Now if I go back to WLANs, this should automatically, so we see over here, WPA2

57
02:39.370 --> 02:40.680
, PSK, enabled, it

58
02:40.680 --> 02:45.680
should automatically actually get applied to the default AP group.

59
02:45.680 --> 02:47.160
Let's just make sure I come in here.

60
02:47.160 --> 02:49.240
Look at my WLANs, and there it is.

61
02:49.240 --> 02:52.040
So I would expect, actually let's just check the AP list.

62
02:52.040 --> 02:53.720
Yep, our AP is in there.

63
02:53.720 --> 02:56.120
So I would expect it's already broadcasting.

64
02:56.120 --> 03:00.520
Let me go ahead and pull that up over here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:56.120 --> 03:00.520
Let me go ahead and pull that up over here.

65
03:00.520 --> 03:06.080
And we'll take a look at this and see, oh yeah, we've got CVTNROS and iOSXE.

66
03:06.080 --> 03:11.570
Now, iOSXE isn't working right now because of the fact that we changed it from

67
03:11.570 --> 03:12.160
PSK to

68
03:12.160 --> 03:13.160
802.1x.

69
03:13.160 --> 03:16.800
So I'm just going to click on here, connect automatically.

70
03:16.800 --> 03:18.160
Oh, what's that key again?

71
03:18.160 --> 03:20.560
CVTN1234.

72
03:20.560 --> 03:21.720
What a secure password.

73
03:21.720 --> 03:26.770
This time I won't share my PC on this highly suspicious network, but hopefully

74
03:26.770 --> 03:27.400
we'll see

75
03:27.400 --> 03:28.400
in a moment.

76
03:28.400 --> 03:29.400
There we go.

77
03:29.400 --> 03:31.120
We are connected and we are secured.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:29.400 --> 03:31.120
We are connected and we are secured.

78
03:31.120 --> 03:34.980
So that was pretty straightforward, mostly because we already have experience

79
03:34.980 --> 03:36.280
with configuring

80
03:36.280 --> 03:39.000
Cisco wireless thanks to iOSXE.

81
03:39.000 --> 03:41.120
So that's all there is to it.

82
03:41.120 --> 03:45.870
So now if I want to configure 802.1x, we're also going to come to security and

83
03:45.870 --> 03:46.400
we're going

84
03:46.400 --> 03:51.300
to have more or less the same situation where now we need to configure AAA

85
03:51.300 --> 03:52.200
servers.

86
03:52.200 --> 03:54.440
But this interface is going to look a little bit different.

87
03:54.440 --> 03:57.830
In fact, if I drop down here, we're going to find I don't have anything any of

88
03:57.830 --> 03:58.760
my authentication

89
03:58.760 --> 04:00.400
servers configured yet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:58.760 --> 04:00.400
servers configured yet.

90
04:00.400 --> 04:04.140
So in order to do that, we're going to first go to security over on AAA, which

91
04:04.140 --> 04:04.800
is the default

92
04:04.800 --> 04:05.800
option.

93
04:05.800 --> 04:09.280
I can look at radius authentication or tack X authentication.

94
04:09.280 --> 04:14.170
I'm just going to do radius authentication and we're going to click new at the

95
04:14.170 --> 04:14.880
top here.

96
04:14.880 --> 04:19.080
From here, I can set a server priority in case I've got multiple servers.

97
04:19.080 --> 04:23.050
We have that instead of the concept of a radius server group, I'm going to

98
04:23.050 --> 04:24.360
configure my dummy

99
04:24.360 --> 04:30.400
IP address of 10.0.0.1 and my shared secret, which I believe we kept CBT on 1,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:24.360 --> 04:30.400
IP address of 10.0.0.1 and my shared secret, which I believe we kept CBT on 1,

100
04:30.400 --> 04:32.160
2, 3, 4,

101
04:32.160 --> 04:33.160
and the other one as well.

102
04:33.160 --> 04:35.840
I can change the port number, server status if I want to take it out of

103
04:35.840 --> 04:36.960
commission, whatever

104
04:36.960 --> 04:38.400
the situation is.

105
04:38.400 --> 04:41.680
So all my radius options are here, I'm going to click apply.

106
04:41.680 --> 04:43.920
So now I have a radius server.

107
04:43.920 --> 04:44.920
Great.

108
04:44.920 --> 04:47.800
So let's go back to WLANs.

109
04:47.800 --> 04:49.720
Go to the security layer two security.

110
04:49.720 --> 04:55.120
I want to come down here, disable pre shared key, enable 802.1x.

111
04:55.120 --> 04:59.640
From here, I'm going to go to AAA servers and I'm going to select my server.

112
04:59.640 --> 05:02.480
So here I'm going to select it by IP and port.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:59.640 --> 05:02.480
So here I'm going to select it by IP and port.

113
05:02.480 --> 05:03.760
Notice I didn't get to name it.

114
05:03.760 --> 05:05.560
It's one nice thing iOS XE does.

115
05:05.560 --> 05:07.880
It allows me to name my servers.

116
05:07.880 --> 05:11.830
Instead I'm just going to have to remember which one is which based on IP

117
05:11.830 --> 05:12.600
address.

118
05:12.600 --> 05:16.210
So my IP import specified there, if I had multiple other servers, I could list

119
05:16.210 --> 05:16.720
them here

120
05:16.720 --> 05:18.000
as well.

121
05:18.000 --> 05:19.360
And that would be the extent of it.

122
05:19.360 --> 05:21.400
So I'm going to scroll back up, click apply.

123
05:21.400 --> 05:25.560
Yes, we know that that's going to be just a very disruptive change.

124
05:25.560 --> 05:30.400
And now we see over here that we're using 802.1x instead of PSK.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
05:25.560 --> 05:30.400
And now we see over here that we're using 802.1x instead of PSK.

125
05:30.400 --> 05:34.960
So like I've said multiple times, it's very similar to iOS XE or we could say

126
05:34.960 --> 05:35.520
iOS XE is

127
05:35.520 --> 05:37.320
very similar to AROS.

128
05:37.320 --> 05:40.510
But either way, once we kind of get that process down in one, it's really just

129
05:40.510 --> 05:41.120
a matter of

130
05:41.120 --> 05:45.090
understanding the nuances in the other, which really especially the differences

131
05:45.090 --> 05:45.560
we're going

132
05:45.560 --> 05:50.120
to find are how we configure our radius servers and how we apply them with

133
05:50.120 --> 05:51.560
groups and that

134
05:51.560 --> 05:58.320
list in iOS XE versus just mapping out individual radius servers in AROS.

135
05:58.320 --> 06:09.300
[ movie ]