WEBVTT

1
00:00.000 --> 00:03.360
Next up, we're going to take a look at web auth.

2
00:03.360 --> 00:06.280
And once again, it is a little bit similar between the platforms.

3
00:06.280 --> 00:08.000
But let's start with iOS XE.

4
00:08.000 --> 00:11.520
We're going to go to configuration, down here to security.

5
00:11.520 --> 00:13.800
And as we scroll down, we're going to see web auth.

6
00:13.800 --> 00:15.120
So I'm going to click this.

7
00:15.120 --> 00:17.560
I'm going to take a look at-- well, first of all,

8
00:17.560 --> 00:20.320
I've got this global parameter map name.

9
00:20.320 --> 00:22.800
We could use the default global one.

10
00:22.800 --> 00:25.400
I'm just going to click Add here and add my own, again,

11
00:25.400 --> 00:28.320
what's known as a parameter map name.

12
00:28.320 --> 00:30.040
So we'll see what this is doing in a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.320 --> 00:30.040
So we'll see what this is doing in a moment.

13
00:30.040 --> 00:33.920
I'm going to configure this as CBTN map.

14
00:33.920 --> 00:36.800
And make sure that this is selecting web auth,

15
00:36.800 --> 00:39.000
as opposed to some kind of just consent form.

16
00:39.000 --> 00:42.160
But we're actually expecting a username and password here.

17
00:42.160 --> 00:43.600
Apply it to the device.

18
00:43.600 --> 00:46.920
And now I can click on it and see the different configuration

19
00:46.920 --> 00:48.000
options.

20
00:48.000 --> 00:52.040
So this is sort of my way of configuring the web page.

21
00:52.040 --> 00:53.800
I can come to the banner title.

22
00:53.800 --> 00:57.160
I could say CBTN welcomes you.

23
00:57.160 --> 01:00.800
I could change the banner type.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.160 --> 01:00.800
I could change the banner type.

24
01:00.800 --> 01:02.400
I could actually add a file.

25
01:02.400 --> 01:03.280
So it's an image.

26
01:03.280 --> 01:08.400
I could change it to a banner text and say, please get your user

27
01:08.400 --> 01:10.680
pass from--

28
01:10.680 --> 01:11.760
I don't know--

29
01:11.760 --> 01:15.720
CBTN security or whatever we're doing here.

30
01:15.720 --> 01:17.920
We've got some options here down here

31
01:17.920 --> 01:19.640
as far as the web portal is concerned.

32
01:19.640 --> 01:22.160
And interestingly, on the Advanced tab,

33
01:22.160 --> 01:24.640
this is where we can redirect to an external server.

34
01:24.640 --> 01:31.160
So if we want to fully customize our web portal,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:24.640 --> 01:31.160
So if we want to fully customize our web portal,

35
01:31.160 --> 01:33.560
then we would have to use an external server.

36
01:33.560 --> 01:36.920
Otherwise, we're limited to these options here.

37
01:36.920 --> 01:39.320
Oh, by the way, one thing that might be worth noting,

38
01:39.320 --> 01:42.200
I can disable the Cisco logo so that people don't

39
01:42.200 --> 01:44.440
see that it's a Cisco network.

40
01:44.440 --> 01:46.400
Maybe just a privacy concern there,

41
01:46.400 --> 01:48.640
but it might be worth considering.

42
01:48.640 --> 01:50.600
So now let's go add that to our WLAN.

43
01:50.600 --> 01:53.880
I'm going to come back to my WLAN list.

44
01:53.880 --> 01:54.280
Click it.

45
01:54.280 --> 01:57.200
We left it in 802.1x.

46
01:57.200 --> 01:59.640
As a state, I'm going to just say none now.

47
01:59.640 --> 02:02.360
I'm going to disable layer 2 security,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:59.640 --> 02:02.360
I'm going to disable layer 2 security,

48
02:02.360 --> 02:05.960
come over to layer 3, select the web policy,

49
02:05.960 --> 02:08.440
and select my parameter map here.

50
02:08.440 --> 02:10.600
So that's my parameter map.

51
02:10.600 --> 02:14.520
And then how do I want to perform my authentication?

52
02:14.520 --> 02:17.840
So I've got my authentication list here.

53
02:17.840 --> 02:20.880
We've selected that as default.

54
02:20.880 --> 02:22.400
And this is not showing up.

55
02:22.400 --> 02:24.800
So let's go ahead and take a quick look at this.

56
02:24.800 --> 02:26.240
OK, default.

57
02:26.240 --> 02:29.200
Because it's labeled as a .1x.

58
02:29.200 --> 02:32.000
So let's go ahead and just add our own real quick.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:29.200 --> 02:32.000
So let's go ahead and just add our own real quick.

59
02:32.000 --> 02:35.360
We're going to call this web auth.

60
02:35.360 --> 02:39.000
And using the dropdown, I can select login.

61
02:39.000 --> 02:41.200
So from here, I'll add my radius group.

62
02:41.200 --> 02:45.760
So we can still log in using radius using this method.

63
02:45.760 --> 02:47.080
So now I've got that configured.

64
02:47.080 --> 02:50.360
So unfortunately, now I have to go back to my WLANs.

65
02:50.360 --> 02:51.320
Let's go ahead and do that.

66
02:51.320 --> 02:52.760
That's good practice, right?

67
02:52.760 --> 02:55.920
So we come back to security, say none.

68
02:55.920 --> 03:01.760
Layer 3, enable the web policy, select my parameter map.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:55.920 --> 03:01.760
Layer 3, enable the web policy, select my parameter map.

69
03:01.760 --> 03:04.240
And now I can select my web auth authentication list.

70
03:04.240 --> 03:06.720
So I'm going to update and apply that.

71
03:06.720 --> 03:10.680
And now we're going to log into the network.

72
03:10.680 --> 03:12.920
So I'm going to share my screen again.

73
03:12.920 --> 03:19.080
Over here, I'm going to fire up and look for CBT and iOSXE.

74
03:19.080 --> 03:20.400
So hopefully, this is the new one.

75
03:20.400 --> 03:22.480
We know that the old one, both of these now

76
03:22.480 --> 03:25.720
are configured for 802.1x, although this is old.

77
03:25.720 --> 03:26.920
So I'm going to click here.

78
03:26.920 --> 03:28.360
And it's an open network.

79
03:28.360 --> 03:32.040
Notice that it's an open network I'm going to say connect.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:28.360 --> 03:32.040
Notice that it's an open network I'm going to say connect.

80
03:32.040 --> 03:33.440
And well, that was easy.

81
03:33.440 --> 03:34.200
All right.

82
03:34.200 --> 03:35.040
And look at this.

83
03:35.040 --> 03:38.240
I'm getting redirected over-- oops-- on the other screen.

84
03:38.240 --> 03:40.800
Let me do this over here.

85
03:40.800 --> 03:44.080
And now we see that we are taken to this login page.

86
03:44.080 --> 03:46.840
I need to provide my username and password.

87
03:46.840 --> 03:50.360
Now notice CBT and welcomes you to an exact page.

88
03:50.360 --> 03:51.720
It's a very quickly fit, I suppose.

89
03:51.720 --> 03:54.240
But Cisco is pleased to provide-- now, this is interesting.

90
03:54.240 --> 03:56.960
This is the default banner.

91
03:56.960 --> 03:59.200
And so it didn't take my text there,

92
03:59.200 --> 04:01.520
but we do see that it took that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:59.200 --> 04:01.520
but we do see that it took that.

93
04:01.520 --> 04:03.960
So either way, we can enter the username and password.

94
04:03.960 --> 04:05.120
We can play around with this.

95
04:05.120 --> 04:06.080
Try to customize it.

96
04:06.080 --> 04:08.600
We can remove this Cisco logo up here.

97
04:08.600 --> 04:10.400
It's a very basic web page.

98
04:10.400 --> 04:12.400
This is not going to impress anybody.

99
04:12.400 --> 04:15.320
If you want it to look a little bit more impressive,

100
04:15.320 --> 04:17.480
we could try to customize it with a logo.

101
04:17.480 --> 04:19.760
But for the most part, we would want to just develop

102
04:19.760 --> 04:21.560
our own external web application.

103
04:21.560 --> 04:24.760
But hey, this is certainly the simple option.

104
04:24.760 --> 04:27.880
So having seen that, let's go ahead and go back to AroS

105
04:27.880 --> 04:29.320
and do the same thing.

106
04:29.320 --> 04:31.200
I'm going to follow a very similar pattern.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:29.320 --> 04:31.200
I'm going to follow a very similar pattern.

107
04:31.200 --> 04:33.080
I'm going to go to security.

108
04:33.080 --> 04:35.000
And down here on the left, I'm going to see web auth

109
04:35.000 --> 04:37.000
and go to web login page.

110
04:37.000 --> 04:38.360
So here we see our options.

111
04:38.360 --> 04:41.720
I've got my ability to go to an external redirection

112
04:41.720 --> 04:44.640
if I want to, or I can use the internal right here.

113
04:44.640 --> 04:47.440
I can redirect to a URL after login.

114
04:47.440 --> 04:53.440
So I could say something like, hey, take us to CBTnuggets.com.

115
04:53.440 --> 04:56.240
And then we can hide or show the Cisco logo.

116
04:56.240 --> 04:57.880
And then we've got a headline message here.

117
04:57.880 --> 05:02.440
Let's just call it headline and then custom message.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:57.880 --> 05:02.440
Let's just call it headline and then custom message.

118
05:02.440 --> 05:04.760
And then we'll see exactly where these show up.

119
05:04.760 --> 05:05.920
So I'm going to click apply.

120
05:05.920 --> 05:07.080
And here's the cool thing.

121
05:07.080 --> 05:08.480
I can actually preview it here.

122
05:08.480 --> 05:10.080
So I'm going to click the preview button.

123
05:10.080 --> 05:11.600
And we see exactly what this looks like.

124
05:11.600 --> 05:16.760
Hey, this looks very similar to what we just did on iOS XE.

125
05:16.760 --> 05:18.000
It's entirely possible.

126
05:18.000 --> 05:19.320
They copied that code.

127
05:19.320 --> 05:20.960
Either way, we see where headline shows up.

128
05:20.960 --> 05:22.360
We see where the message shows up.

129
05:22.360 --> 05:26.120
Usernaming password are going to be able to provide

130
05:26.120 --> 05:27.440
our login here.

131
05:27.440 --> 05:30.600
And I guess we just said to hide the Cisco logo.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:27.440 --> 05:30.600
And I guess we just said to hide the Cisco logo.

132
05:30.600 --> 05:31.280
I didn't notice that.

133
05:31.280 --> 05:32.200
That was set to hide.

134
05:32.200 --> 05:35.640
So if we wanted to show it, I could apply it, preview it.

135
05:35.640 --> 05:38.560
And now we see the Cisco logo showing up over here.

136
05:38.560 --> 05:41.280
So let's go ahead and add it to our SSID.

137
05:41.280 --> 05:44.800
I'm going to go to WLANs.

138
05:44.800 --> 05:47.720
Go to my security tab, disable layer to security.

139
05:47.720 --> 05:49.240
So I'm going to say none here.

140
05:49.240 --> 05:51.600
Then I will go to layer three security,

141
05:51.600 --> 05:53.160
change it to web policy.

142
05:53.160 --> 05:55.400
Say, yeah, we understand what we're doing here.

143
05:55.400 --> 05:57.000
Make sure it's on authentication.

144
05:57.000 --> 05:58.640
The interface looks a little different,

145
05:58.640 --> 06:01.040
but we're basically following the same process.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:58.640 --> 06:01.040
but we're basically following the same process.

146
06:01.040 --> 06:02.560
And then I go to AAA servers.

147
06:02.560 --> 06:05.960
Make sure that I've got my AAA configured properly there.

148
06:05.960 --> 06:07.840
And then I add apply.

149
06:07.840 --> 06:10.320
Yes, it will be a disruptive change to the SSID.

150
06:10.320 --> 06:14.600
But hey, now we are using our web policy using web auth.

151
06:14.600 --> 06:18.600
And so now anybody who is associating to that SSID

152
06:18.600 --> 06:20.520
will have to go through the web portal.

153
06:20.520 --> 06:22.720
We're still providing a username and password

154
06:22.720 --> 06:26.240
that I give them in order to access our network.