WEBVTT

1
00:00.000 --> 00:03.080
Well, we covered quite a bit in this skill.

2
00:03.080 --> 00:06.840
We learned to configure security for iOS, XE, and AroS.

3
00:06.840 --> 00:09.920
And once again, if we do have access to these systems

4
00:09.920 --> 00:11.960
in a lab environment, then it's a great time

5
00:11.960 --> 00:13.720
to go ahead and go through a challenge like this,

6
00:13.720 --> 00:17.240
which makes sure that we know exactly how to configure things.

7
00:17.240 --> 00:18.760
But at a minimum, we do need to be

8
00:18.760 --> 00:20.920
able to look at images and understand

9
00:20.920 --> 00:23.240
which options we're picking when we need

10
00:23.240 --> 00:26.520
to configure specific security options.

11
00:26.520 --> 00:29.120
And so methods, I suppose.

12
00:29.120 --> 00:31.480
So let's go ahead and walk through each one of these.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.120 --> 00:31.480
So let's go ahead and walk through each one of these.

13
00:31.480 --> 00:33.000
We'll just do this very quickly.

14
00:33.000 --> 00:35.280
But make sure that we've got this process down.

15
00:35.280 --> 00:37.320
If you had any struggles doing this yourself,

16
00:37.320 --> 00:39.360
then, hey, this is a good opportunity

17
00:39.360 --> 00:41.680
to figure out maybe what we missed, especially

18
00:41.680 --> 00:43.560
if you tried joining your wireless network

19
00:43.560 --> 00:45.120
and it wasn't working.

20
00:45.120 --> 00:47.160
So we're going to start with task number one, configure

21
00:47.160 --> 00:48.840
WLAN and iOS, XE.

22
00:48.840 --> 00:51.480
That uses WPA2 pre-shared key.

23
00:51.480 --> 00:53.280
So we're going to go to configuration.

24
00:53.280 --> 00:57.480
WLANs configure a new one.

25
00:57.480 --> 01:01.800
And we'll just call this PSK, PSK.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:57.480 --> 01:01.800
And we'll just call this PSK, PSK.

26
01:01.800 --> 01:02.920
Don't forget to enable it.

27
01:02.920 --> 01:04.200
Always important.

28
01:04.200 --> 01:08.160
And then over on security, we'll pick WPA2 and WPA3,

29
01:08.160 --> 01:11.600
but we'll disable the WPA3 policy, which allows me

30
01:11.600 --> 01:14.280
to configure a pre-shared key here.

31
01:14.280 --> 01:17.640
So I select PSK, and I go down to shared key,

32
01:17.640 --> 01:22.400
and I enter whatever it is that I want the pre-shared key to be.

33
01:22.400 --> 01:25.600
So I'm going to click apply here.

34
01:25.600 --> 01:28.440
And never forget that WLANs and iOS XE

35
01:28.440 --> 01:32.600
must be added to our policy tag if we want them to work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.440 --> 01:32.600
must be added to our policy tag if we want them to work.

36
01:32.600 --> 01:35.040
And so we'd have to go over here to configuration

37
01:35.040 --> 01:37.760
and go down to actually our tags down here.

38
01:37.760 --> 01:41.560
This does assume that we have a policy profile in place.

39
01:41.560 --> 01:44.600
And then I can add the WLAN to the policy profile

40
01:44.600 --> 01:46.440
within the policy tag.

41
01:46.440 --> 01:48.400
So we won't do that because we already

42
01:48.400 --> 01:50.400
made that work earlier on.

43
01:50.400 --> 01:52.880
So now we're going to configure the WLAN.

44
01:52.880 --> 01:55.600
Let's go back to our WLANs.

45
01:55.600 --> 01:59.600
And we're going to configure it now for WPA2 Enterprise.

46
01:59.600 --> 02:01.840
The key thing to look for here-- actually,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.600 --> 02:01.840
The key thing to look for here-- actually,

47
02:01.840 --> 02:03.560
let's just go ahead and create a new one, especially

48
02:03.560 --> 02:05.560
since we called that one PSK.

49
02:05.560 --> 02:10.200
But we'll just call this 802 test--

50
02:10.200 --> 02:12.720
I don't know-- 802 1x test.

51
02:12.720 --> 02:13.760
There we go.

52
02:13.760 --> 02:17.800
All right, so I'm going to enable it, go over to security.

53
02:17.800 --> 02:21.400
And here, when we select a WPA2 and WPA3

54
02:21.400 --> 02:26.600
and disable WPA3 policy, now I check the box for 802.1x.

55
02:26.600 --> 02:29.080
Now, we might think, OK, good.

56
02:29.080 --> 02:30.200
That's good to go.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:29.080 --> 02:30.200
That's good to go.

57
02:30.200 --> 02:33.120
But remember, this is going to require me

58
02:33.120 --> 02:36.960
to configure this, the AAA subtab.

59
02:36.960 --> 02:39.240
This is where I need to select my authentication list.

60
02:39.240 --> 02:40.840
I could use the default list.

61
02:40.840 --> 02:43.880
But let's just go ahead and save this

62
02:43.880 --> 02:46.920
and go over to configuration, security AAA,

63
02:46.920 --> 02:49.040
and make sure we know how this works.

64
02:49.040 --> 02:51.640
So remember, I have to start by configuring a server.

65
02:51.640 --> 02:55.160
I can click Add, add my own server here,

66
02:55.160 --> 02:57.960
and then I can go over to server groups in here.

67
02:57.960 --> 02:58.880
So don't miss this.

68
02:58.880 --> 03:00.160
It's right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:58.880 --> 03:00.160
It's right here.

69
03:00.160 --> 03:02.200
And then I can create my own group.

70
03:02.200 --> 03:04.200
From here, I do need to create a method list.

71
03:04.200 --> 03:06.000
So I would add a method list.

72
03:06.000 --> 03:08.520
I can either do choose a .1x method list,

73
03:08.520 --> 03:11.680
or again, one that I can use for web auth.

74
03:11.680 --> 03:16.280
So I created one here, default for .1x.

75
03:16.280 --> 03:18.480
But I could create my own if I wanted to.

76
03:18.480 --> 03:22.720
So that's the process for creating my radius or takx

77
03:22.720 --> 03:24.080
server reference.

78
03:24.080 --> 03:26.840
Now that I have it inside of a method list,

79
03:26.840 --> 03:30.000
which references the group, which references the server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:26.840 --> 03:30.000
which references the group, which references the server,

80
03:30.000 --> 03:34.640
now I can go to configuration, go back to my WLAN,

81
03:34.640 --> 03:39.240
open up my 802.1x test as this ID,

82
03:39.240 --> 03:42.080
and scroll-- actually, wait, we already did that part.

83
03:42.080 --> 03:44.280
So we've got 802.1x checked.

84
03:44.280 --> 03:46.520
Now I just need to go to AAA.

85
03:46.520 --> 03:50.040
In the authentication list, I select my list

86
03:50.040 --> 03:52.040
that I created, my method list.

87
03:52.040 --> 03:52.960
So there we go.

88
03:52.960 --> 03:56.200
We've configured 802.1x in iOSXZ.

89
03:56.200 --> 03:57.720
Lastly is web auth.

90
03:57.720 --> 03:59.520
So let's just go ahead and create one more,

91
03:59.520 --> 04:01.160
just for the fun of it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:59.520 --> 04:01.160
just for the fun of it.

92
04:01.160 --> 04:04.440
Web auth, enable it.

93
04:04.440 --> 04:08.720
Security, I'm going to go to layer 2 security and click none.

94
04:08.720 --> 04:11.680
And then go to layer 3 security right here,

95
04:11.680 --> 04:15.960
enable my web policy, enable the parameter map,

96
04:15.960 --> 04:18.320
and enable the authentication list.

97
04:18.320 --> 04:20.880
So we just covered where the authentication list came from.

98
04:20.880 --> 04:23.520
But where did this web auth parameter come from?

99
04:23.520 --> 04:25.680
Well, let's go ahead and go find out.

100
04:25.680 --> 04:27.560
We go to configuration.

101
04:27.560 --> 04:30.000
Down here in security, we have to scroll down,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:27.560 --> 04:30.000
Down here in security, we have to scroll down,

102
04:30.000 --> 04:32.040
depending on your resolution, I suppose.

103
04:32.040 --> 04:34.920
Click on web auth here.

104
04:34.920 --> 04:36.880
Now scroll back up.

105
04:36.880 --> 04:40.680
And now I can create my web auth parameter map.

106
04:40.680 --> 04:43.360
So we'll just call this test or lab or something.

107
04:43.360 --> 04:45.400
Make sure this is selecting web auth.

108
04:45.400 --> 04:47.880
And then when I open it up, this is what gives me

109
04:47.880 --> 04:50.760
all of my options, including configuring a banner

110
04:50.760 --> 04:53.480
and a message, going to add a banner text in here,

111
04:53.480 --> 04:55.240
and so on and so forth.

112
04:55.240 --> 04:59.920
So that is how I configure that and map it in via iOSXZ.

113
04:59.920 --> 05:02.920
Next, let's task for just says to do all of this again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:59.920 --> 05:02.920
Next, let's task for just says to do all of this again.

114
05:02.920 --> 05:05.880
But in arrow s, we'll be brief with this.

115
05:05.880 --> 05:07.680
We go to WLANs.

116
05:07.680 --> 05:09.920
And I can create a new WLAN here.

117
05:09.920 --> 05:15.360
I'm just going to call this test and test.

118
05:15.360 --> 05:16.760
And enable it.

119
05:16.760 --> 05:18.520
Make sure the interface is correct.

120
05:18.520 --> 05:20.680
Then I come to security for layer two.

121
05:20.680 --> 05:25.080
If I want WPA2, make sure WPA2 is there.

122
05:25.080 --> 05:27.920
And then I can select my encryption.

123
05:27.920 --> 05:32.120
But down here, I would select PSK and add the PSK here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:27.920 --> 05:32.120
But down here, I would select PSK and add the PSK here.

124
05:32.120 --> 05:37.400
Or I can add 802.1x and reference my AAA servers.

125
05:37.400 --> 05:39.960
Now, where did the AAA servers come from?

126
05:39.960 --> 05:42.640
Well, we can go to our security tab here.

127
05:42.640 --> 05:45.360
Over on the left, we have radius and takx.

128
05:45.360 --> 05:47.120
Go to the authentication tab.

129
05:47.120 --> 05:50.920
Add a radius server here or add a takx server here.

130
05:50.920 --> 05:52.400
Either way is fine.

131
05:52.400 --> 05:56.880
So at that point, I can go back to my WLAN,

132
05:56.880 --> 06:00.200
go into a test here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
05:56.880 --> 06:00.200
go into a test here.

133
06:00.200 --> 06:04.120
Security, AAA, add it using the dropdown.

134
06:04.120 --> 06:06.320
So that is our layer two options.

135
06:06.320 --> 06:08.920
Now, what about layer three with my web auth?

136
06:08.920 --> 06:10.360
Well, same thing here.

137
06:10.360 --> 06:12.440
I can say none for layer two.

138
06:12.440 --> 06:14.640
Select web policy here.

139
06:14.640 --> 06:17.200
But keep in mind that I do still need

140
06:17.200 --> 06:20.160
to make sure that I have some way of the client

141
06:20.160 --> 06:22.840
authenticating using a username and password.

142
06:22.840 --> 06:24.920
And so I want to make sure that we still

143
06:24.920 --> 06:29.000
have this configured on the AAA side.

144
06:29.000 --> 06:30.680
So a little bit of a whirlwind tour there,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
06:29.000 --> 06:30.680
So a little bit of a whirlwind tour there,

145
06:30.680 --> 06:32.720
just to make sure that we've got that process down.

146
06:32.720 --> 06:34.880
Again, if you don't have access to these systems,

147
06:34.880 --> 06:37.200
then it probably helps to see it a couple of times.

148
06:37.200 --> 06:38.560
Feel free to go through this video.

149
06:38.560 --> 06:42.160
Maybe grab some screenshots and quiz yourself as far as,

150
06:42.160 --> 06:46.480
hey, where would I go to configure PSK versus 802.1x?

151
06:46.480 --> 06:50.640
Or where do I configure a radius server in both of these platforms?

152
06:50.640 --> 06:52.640
And how do I get web auth fired back up?

153
06:52.640 --> 06:54.520
All of this is going to be very important

154
06:54.520 --> 06:58.760
that we know exactly how to navigate these interfaces.

155
06:58.760 --> 07:00.880
Whether we have access to them or not,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
06:58.760 --> 07:00.880
Whether we have access to them or not,

156
07:00.880 --> 07:02.160
we need to be familiar with them,

157
07:02.160 --> 07:04.200
make sure we understand how to configure it.

158
07:04.200 --> 07:06.760
And again, think all the way back to that first video

159
07:06.760 --> 07:07.920
within this skill.

160
07:07.920 --> 07:10.200
We are primarily looking at three different methods

161
07:10.200 --> 07:13.560
here, configuring PSK, configuring 802.1x

162
07:13.560 --> 07:16.520
with radius or tack x, and then configuring web auth.

163
07:16.520 --> 07:18.760
That's usually the goal of configuring

164
07:18.760 --> 07:23.480
our modern wireless networks, whether we're using iOSXE or AroS.

165
07:23.480 --> 07:24.840
I hope this has been informative for you,

166
07:24.840 --> 07:26.960
and I'd like to thank you for viewing.