WEBVTT 1 00:00.000 --> 00:03.760 Alright, next up we're going to dive into wireless security. 2 00:03.760 --> 00:07.540 Remember on the blueprint, wireless security happens later on, but it just made 3 00:07.540 --> 00:07.780 sense 4 00:07.780 --> 00:09.360 to cover it all at once. 5 00:09.360 --> 00:11.980 So, we're going to want to make sure that we keep all of these security 6 00:11.980 --> 00:12.520 concepts in 7 00:12.520 --> 00:16.640 mind as we advance through the blueprint and eventually cover security. 8 00:16.640 --> 00:18.160 But either way, let's go ahead and jump into this. 9 00:18.160 --> 00:20.990 So again, pause the video as often as needed in order to make sure you can 10 00:20.990 --> 00:21.640 answer these 11 00:21.640 --> 00:23.120 questions yourselves. 12 00:23.120 --> 00:26.680 So first up here, out of eight questions again, which security mechanism is 13 00:26.680 --> 00:27.480 used to control 14 00:27.480 --> 00:30.000 access to the wireless network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 14 00:27.480 --> 00:30.000 access to the wireless network. 15 00:30.000 --> 00:34.700 A big part of the conversation that we had had to do with authentication and 16 00:34.700 --> 00:35.520 encryption 17 00:35.520 --> 00:40.440 being two of the key security concepts required for wireless security. 18 00:40.440 --> 00:44.920 Because I might have an access point that is radiating outward. 19 00:44.920 --> 00:49.680 It doesn't just communicate in a straight line to the laptop, but rather it 20 00:49.680 --> 00:50.360 radiates 21 00:50.360 --> 00:51.360 everywhere. 22 00:51.360 --> 00:54.400 And if this access points against the wall, then there could be cars out here 23 00:54.400 --> 00:55.160 in the parking 24 00:55.160 --> 00:58.400 lot that will receive that RF signal. 25 00:58.400 --> 01:02.090 Trying to limit the RF signal would be useful, but it's ultimately going to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:58.400 --> 01:02.090 Trying to limit the RF signal would be useful, but it's ultimately going to be 26 01:02.090 --> 01:02.760 impossible 27 01:02.760 --> 01:05.880 to fully contain within the walls of our organization. 28 01:05.880 --> 01:10.430 As such, making sure that we have good authentication and good encryption will 29 01:10.430 --> 01:11.440 be required. 30 01:11.440 --> 01:15.860 Encryption for the sake of data privacy, allowing us to communicate freely with 31 01:15.860 --> 01:16.840 the access point 32 01:16.840 --> 01:20.040 in such a way that the message gets garbled. 33 01:20.040 --> 01:24.400 So anybody else listening to the same message is not going to know what it says 34 01:24.400 --> 01:24.720 . 35 01:24.720 --> 01:27.480 It's just standard encryption in that regard. 36 01:27.480 --> 01:32.090 But authentication is all about access control, making sure that I am who I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:27.480 --> 01:32.090 But authentication is all about access control, making sure that I am who I 37 01:32.090 --> 01:33.080 claim to be. 38 01:33.080 --> 01:37.260 I can't just say that I'm the CEO or for that matter, just any staff member, 39 01:37.260 --> 01:37.960 but rather 40 01:37.960 --> 01:39.600 I have to prove it. 41 01:39.600 --> 01:41.160 And we have lots of ways of proving it. 42 01:41.160 --> 01:42.800 We could do a username and password. 43 01:42.800 --> 01:47.090 We could do certificates, multi-factor authentication, lots of ways to prove 44 01:47.090 --> 01:48.800 that I belong on the 45 01:48.800 --> 01:49.800 network. 46 01:49.800 --> 01:52.640 And all of that falls into the category of authentication. 47 01:52.640 --> 01:57.100 So as we talk about different security mechanisms, for example, WPA, personal 48 01:57.100 --> 01:58.560 versus WPA enterprise, 49 01:58.560 --> 02:02.850 we start to see how these different mechanisms handle authentication and how WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 01:58.560 --> 02:02.850 we start to see how these different mechanisms handle authentication and how 50 02:02.850 --> 02:04.840 they handle encryption. 51 02:04.840 --> 02:09.040 And the way that enterprise does it is a whole lot more scalable than personal, 52 02:09.040 --> 02:09.200 which is 53 02:09.200 --> 02:13.080 why we certainly want to be deploying WPA enterprise when we can in our 54 02:13.080 --> 02:14.560 corporate networks. 55 02:14.560 --> 02:19.680 All right, question number two, which wireless security suite is based on the 56 02:19.680 --> 02:21.080 use of a PSK 57 02:21.080 --> 02:24.400 otherwise known as a pre-shared key. 58 02:24.400 --> 02:29.000 Well the PSK is synonymous with WPA personal. 59 02:29.000 --> 02:34.430 So that would be C. PSK, that whole concept is the idea that I connect to a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 59 02:29.000 --> 02:34.430 So that would be C. PSK, that whole concept is the idea that I connect to a 60 02:34.430 --> 02:35.840 wireless network 61 02:35.840 --> 02:39.080 and I simply provide this password of sorts. 62 02:39.080 --> 02:40.680 I can put that in quotes. 63 02:40.680 --> 02:44.760 It's basically the wireless password that allows me to log in. 64 02:44.760 --> 02:49.710 So if I go to a public cafe, oftentimes they'll say, hey, here's the SSID and 65 02:49.710 --> 02:50.840 here's the network 66 02:50.840 --> 02:51.840 password. 67 02:51.840 --> 02:55.600 Well, this password is really the PSK, which is why we're referring to it here 68 02:55.600 --> 02:56.400 in air quotes 69 02:56.400 --> 03:01.480 because it's not technically a password, but it is a pre-shared key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 69 02:56.400 --> 03:01.480 because it's not technically a password, but it is a pre-shared key. 70 03:01.480 --> 03:05.260 And the reason why we emphasize that is because this key is going to be used to 71 03:05.260 --> 03:05.840 derive the 72 03:05.840 --> 03:08.280 actual encryption keys. 73 03:08.280 --> 03:09.720 This isn't desirable. 74 03:09.720 --> 03:13.590 This is one of the main reasons we want to move away from WPA2 in these types 75 03:13.590 --> 03:14.640 of networks, 76 03:14.640 --> 03:18.040 although this doesn't impact WPA enterprise. 77 03:18.040 --> 03:20.120 It only impacts WPA personal. 78 03:20.120 --> 03:24.540 So for a variety of reasons, a lot of which we've gone into depth on, WPA 79 03:24.540 --> 03:25.680 personal should 80 03:25.680 --> 03:28.560 not be deployed into our corporate networks. 81 03:28.560 --> 03:33.090 Instead, PSK's and the use of WPA personal, this should be reserved for our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 81 03:28.560 --> 03:33.090 Instead, PSK's and the use of WPA personal, this should be reserved for our 82 03:33.090 --> 03:34.160 small office, 83 03:34.160 --> 03:37.810 home office types of environments where we don't necessarily have access to a 84 03:37.810 --> 03:38.240 radius 85 03:38.240 --> 03:40.200 or tack X plus server. 86 03:40.200 --> 03:44.320 Instead, in our corporate networks, we should be deploying WPA enterprise, 87 03:44.320 --> 03:45.120 which does not 88 03:45.120 --> 03:51.640 require a PSK, but it does require the use of those authentication servers. 89 03:51.640 --> 03:56.620 Question number three, which device serves as the supplicant keyword there in 90 03:56.620 --> 03:58.080 the 802.1x 91 03:58.080 --> 04:00.200 architecture? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 03:58.080 --> 04:00.200 architecture? 92 04:00.200 --> 04:01.240 So let's think back. 93 04:01.240 --> 04:06.530 802.1x defines this architecture where we have a device logging in to another 94 04:06.530 --> 04:07.320 device, 95 04:07.320 --> 04:08.560 which might be the access point. 96 04:08.560 --> 04:10.840 It might be the wireless LAN controller. 97 04:10.840 --> 04:15.570 And then we have an authentication server over here running radius or possibly 98 04:15.570 --> 04:16.280 tack X 99 04:16.280 --> 04:17.680 plus. 100 04:17.680 --> 04:22.360 So the 802.1x architecture assigns labels to each one of these. 101 04:22.360 --> 04:25.040 So the supplicant is actually here. 102 04:25.040 --> 04:28.920 It's going to be the client who's trying to connect to the network. 103 04:28.920 --> 04:31.600 So that would be our supplicant here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 04:28.920 --> 04:31.600 So that would be our supplicant here. 104 04:31.600 --> 04:34.640 And then we have this phrase for the device in the middle. 105 04:34.640 --> 04:37.240 It is the authenticator. 106 04:37.240 --> 04:41.600 So this could be the access point, but in a lot of cases, especially in the 107 04:41.600 --> 04:42.400 lightweight 108 04:42.400 --> 04:44.880 architecture, it will actually be the wireless LAN controller. 109 04:44.880 --> 04:48.340 It will get that request will get handed off from the access point to the 110 04:48.340 --> 04:49.160 wireless LAN 111 04:49.160 --> 04:50.160 controller. 112 04:50.160 --> 04:54.580 But either way, whether it's the WLC or the AP, that would be the authenticator 113 04:54.580 --> 04:54.880 . 114 04:54.880 --> 04:58.600 And then this over here, whether we're running radius or tack X is known as the 115 04:58.600 --> 04:59.520 authentication 116 04:59.520 --> 05:00.600 server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 116 04:59.520 --> 05:00.600 server. 117 05:00.600 --> 05:02.640 So we do need to keep these roles in mind. 118 05:02.640 --> 05:07.790 This is what the 802.1x architecture defines for us, but then it's EAP that 119 05:07.790 --> 05:08.920 ends up defining 120 05:08.920 --> 05:11.720 for us how exactly we're authenticating. 121 05:11.720 --> 05:16.000 But as long as we have this architecture, we can deploy WPA enterprise. 122 05:16.000 --> 05:20.510 This is what's required for WPA enterprise is making sure we have an 123 05:20.510 --> 05:22.720 authentication mechanism 124 05:22.720 --> 05:26.070 thereby making it so we don't have to authenticate with the pre shared key 125 05:26.070 --> 05:26.720 anymore. 126 05:26.720 --> 05:30.850 But rather we can authenticate using our corporate accounts or whatever we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 126 05:26.720 --> 05:30.850 But rather we can authenticate using our corporate accounts or whatever we're 127 05:30.850 --> 05:31.240 going 128 05:31.240 --> 05:33.760 to use for the sake of authentication. 129 05:33.760 --> 05:37.840 And that makes things a whole lot more scalable and a whole lot more granular. 130 05:37.840 --> 05:39.800 All right. 131 05:39.800 --> 05:40.800 Next question. 132 05:40.800 --> 05:45.870 When running WPA enterprise, what is the primary goal of the WPA four way 133 05:45.870 --> 05:47.000 handshake? 134 05:47.000 --> 05:52.440 So the famous four way handshake with WPA, when I first tried to initialize 135 05:52.440 --> 05:53.760 communications 136 05:53.760 --> 05:57.710 with the access point, the access point is going to trigger the WPA four way 137 05:57.710 --> 05:58.600 handshake. 138 05:58.600 --> 06:03.800 And it involves four different messages that go back and forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 138 05:58.600 --> 06:03.800 And it involves four different messages that go back and forth. 139 06:03.800 --> 06:09.010 And the primary goal of the four way handshake is to here be derive the 140 06:09.010 --> 06:10.680 encryption keys. 141 06:10.680 --> 06:17.070 Remember, the PSK is not actually used for encryption directly, but rather it's 142 06:17.070 --> 06:17.440 used 143 06:17.440 --> 06:25.820 to derive the encryption keys, which will then create or be used for encryption 144 06:25.820 --> 06:26.280 . 145 06:26.280 --> 06:30.320 However, that is for WPA personal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 06:26.280 --> 06:30.320 However, that is for WPA personal. 146 06:30.320 --> 06:33.320 So it doesn't really matter whether we're talking about personal enterprise. 147 06:33.320 --> 06:35.160 I called out enterprise here. 148 06:35.160 --> 06:39.920 And the primary reason I did that was because in enterprise, the PSK having 149 06:39.920 --> 06:41.200 that also authenticates 150 06:41.200 --> 06:42.200 the user. 151 06:42.200 --> 06:46.600 So in that sense, with personal mode, the PSK sort of serves both. 152 06:46.600 --> 06:51.160 It serves to authenticate because, hey, I have the PSK PSK and therefore I 153 06:51.160 --> 06:51.880 belong on 154 06:51.880 --> 06:52.880 the network. 155 06:52.880 --> 06:57.050 However, I also use the PSK to derive the encryption keys and then I can 156 06:57.050 --> 06:58.520 encrypt and decrypt my 157 06:58.520 --> 07:00.000 traffic that way. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 06:58.520 --> 07:00.000 traffic that way. 158 07:00.000 --> 07:05.100 However, in the enterprise space, remember, this four way handshake follows the 159 07:05.100 --> 07:06.720 802.1x 160 07:06.720 --> 07:08.000 back and forth. 161 07:08.000 --> 07:11.610 So the messages look kind of like this, where we have a bunch of messages going 162 07:11.610 --> 07:12.080 back and 163 07:12.080 --> 07:15.000 forth for 802.1x. 164 07:15.000 --> 07:18.400 And this handles fully the authentication process. 165 07:18.400 --> 07:23.410 Only if I properly authenticate do I then get to do the four way handshake at 166 07:23.410 --> 07:23.920 which point 167 07:23.920 --> 07:29.380 the sole focus to the sole purpose and focus, that was a combination of those 168 07:29.380 --> 07:30.000 words, the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 07:29.380 --> 07:30.000 words, the 169 07:30.000 --> 07:34.810 sole purpose and focus of the four way handshake is to derive the encryption 170 07:34.810 --> 07:36.040 keys, which will 171 07:36.040 --> 07:40.320 allow us to encrypt and decrypt our traffic. 172 07:40.320 --> 07:44.280 Question number five, what are the primary limitations of PSK that prevent it 173 07:44.280 --> 07:44.840 from being 174 07:44.840 --> 07:48.720 useful in enterprise networks choose to? 175 07:48.720 --> 07:53.310 Well I just sort of alluded to this, but when we're talking about PSK being WPA 176 07:53.310 --> 07:54.200 personal, 177 07:54.200 --> 07:56.240 it's going to be a challenge for a couple of reasons. 178 07:56.240 --> 08:00.440 First of all, be here, rotating keys doesn't scale well at all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 178 07:56.240 --> 08:00.440 First of all, be here, rotating keys doesn't scale well at all. 179 08:00.440 --> 08:05.510 So if we think about it, everybody who has the PSK I just said, therefore is 180 08:05.510 --> 08:06.440 able to, 181 08:06.440 --> 08:12.080 or by the definition of having the PSK is able to authenticate to the network. 182 08:12.080 --> 08:15.660 And so if we're able to authenticate to the network with the PSK, that means 183 08:15.660 --> 08:16.440 anybody who 184 08:16.440 --> 08:20.560 ever has that PSK can authenticate and gain access. 185 08:20.560 --> 08:22.520 And that's a problem in the enterprise space. 186 08:22.520 --> 08:25.200 People come and go all the time in enterprise networks. 187 08:25.200 --> 08:29.720 And so I might be a consultant, I might join the organization and quit two 188 08:29.720 --> 08:30.720 weeks later. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 188 08:29.720 --> 08:30.720 weeks later. 189 08:30.720 --> 08:32.840 And meanwhile, I was given the pre shared key. 190 08:32.840 --> 08:36.730 And so does that mean that I as a temporary employee or just for that matter, 191 08:36.730 --> 08:37.320 somebody 192 08:37.320 --> 08:40.000 who was listening to a conversation. 193 08:40.000 --> 08:44.360 Now that we have the PSK, we are forever able to authenticate to the corporate 194 08:44.360 --> 08:45.160 network. 195 08:45.160 --> 08:46.640 That's not a good deal at all. 196 08:46.640 --> 08:50.540 So we'd want to at that point change the pre shared key, but imagine doing that 197 08:50.540 --> 08:51.200 to dozens 198 08:51.200 --> 08:55.160 if not hundreds or thousands of devices, that would not scale well at all. 199 08:55.160 --> 08:58.430 It's one of the biggest limitations that we have just from a practicality 200 08:58.430 --> 08:59.280 perspective. 201 08:59.280 --> 09:03.040 But we also have the low granularity for individual users. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 201 08:59.280 --> 09:03.040 But we also have the low granularity for individual users. 202 09:03.040 --> 09:07.440 So I can't actually do anything from an individual user perspective. 203 09:07.440 --> 09:09.400 I can't remove individual users. 204 09:09.400 --> 09:11.240 I can't add individual users. 205 09:11.240 --> 09:14.160 It all comes down to who has the PSK. 206 09:14.160 --> 09:16.320 So they're definitely tied together here. 207 09:16.320 --> 09:21.300 But at the same time, these would be two very good reasons for avoiding WPA 208 09:21.300 --> 09:22.200 personal and 209 09:22.200 --> 09:23.280 enterprise networks. 210 09:23.280 --> 09:30.200 And I do keep in mind, it does encrypt just as well as WPA enterprise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 210 09:23.280 --> 09:30.200 And I do keep in mind, it does encrypt just as well as WPA enterprise. 211 09:30.200 --> 09:32.680 It also does have an authentication mechanism. 212 09:32.680 --> 09:34.400 We can't say it lacks one. 213 09:34.400 --> 09:35.400 It does have one. 214 09:35.400 --> 09:36.880 It's just not very effective. 215 09:36.880 --> 09:39.200 And it absolutely is available on Cisco hardware. 216 09:39.200 --> 09:41.440 We can configure it if we so desire. 217 09:41.440 --> 09:45.210 And there might be situations, especially for guest networks, where it makes 218 09:45.210 --> 09:45.680 sense to 219 09:45.680 --> 09:48.360 configure the pre shared key type of methodology. 220 09:48.360 --> 09:54.040 It allows our users to gain access to the guest network just by way of a PSK. 221 09:54.040 --> 09:56.840 So we're not going to be held back by those other options. 222 09:56.840 --> 10:01.760 However, for the enterprise side, especially our internal users, we usually at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 222 09:56.840 --> 10:01.760 However, for the enterprise side, especially our internal users, we usually at 223 10:01.760 --> 10:02.400 all costs 224 10:02.400 --> 10:04.880 want to avoid using WPA personal. 225 10:04.880 --> 10:07.680 All right, we're in the home stretch here. 226 10:07.680 --> 10:09.000 Three more questions. 227 10:09.000 --> 10:13.520 WebAuth is considered to be security deployed at which layer. 228 10:13.520 --> 10:18.480 So this especially is going to be useful to us in the graphical user interface 229 10:18.480 --> 10:18.960 in the 230 10:18.960 --> 10:20.880 wireless LAN controllers. 231 10:20.880 --> 10:24.600 Because when we're configuring things, we get these tabs and the different tabs 232 10:24.600 --> 10:24.960 allow 233 10:24.960 --> 10:28.600 us to configure different aspects of the configuration. 234 10:28.600 --> 10:32.310 One of those is going to be layer two security and one's going to be layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 234 10:28.600 --> 10:32.310 One of those is going to be layer two security and one's going to be layer 235 10:32.310 --> 10:33.480 three security. 236 10:33.480 --> 10:37.880 And so how do we go about knowing where which options are where? 237 10:37.880 --> 10:39.720 Well, we're talking about web auth. 238 10:39.720 --> 10:44.100 That is layer three security because layer two security is anything at the 239 10:44.100 --> 10:44.960 actual Wi-Fi 240 10:44.960 --> 10:48.000 or 802.11 layer. 241 10:48.000 --> 10:53.700 These are going to use the phrase that's properly named, I suppose, which is Wi 242 10:53.700 --> 10:54.560 -Fi protected 243 10:54.560 --> 10:55.560 access. 244 10:55.560 --> 10:59.760 So WPA is tied directly into the protocol at layer two. 245 10:59.760 --> 11:01.880 And that's where wireless stops. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 245 10:59.760 --> 11:01.880 And that's where wireless stops. 246 11:01.880 --> 11:07.310 This is a wireless physical layer and has its own headers at layer two being 247 11:07.310 --> 11:09.280 802.11. 248 11:09.280 --> 11:11.640 Wireless Ethernet headers is what they're known as. 249 11:11.640 --> 11:13.600 And so that's the end of it. 250 11:13.600 --> 11:14.920 And so if we say, hey, guess what? 251 11:14.920 --> 11:18.710 We're going to have absolutely no security here at layer one or layer two, 252 11:18.710 --> 11:19.360 especially 253 11:19.360 --> 11:21.520 layer two. 254 11:21.520 --> 11:25.620 At that point, we might want to deploy security that happens outside of the 255 11:25.620 --> 11:26.760 wireless layer, 256 11:26.760 --> 11:31.040 which would be our web authentication that happens at layer three. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 256 11:26.760 --> 11:31.040 which would be our web authentication that happens at layer three. 257 11:31.040 --> 11:34.200 So web auth is at layer three, WPA is at layer two. 258 11:34.200 --> 11:37.930 And again, that's going to help us navigate around inside of our wireless LAN 259 11:37.930 --> 11:38.640 controller 260 11:38.640 --> 11:41.160 interfaces. 261 11:41.160 --> 11:45.720 Next question for both iOSXE and iOS, where can the security method be 262 11:45.720 --> 11:46.880 configured for 263 11:46.880 --> 11:49.360 the SSID? 264 11:49.360 --> 11:53.960 Well, all SSID configuration is going to happen at the WLAN. 265 11:53.960 --> 11:56.400 So A is going to be our answer here. 266 11:56.400 --> 11:59.680 Now it looks a little bit different between iOSXE and iOS. 267 11:59.680 --> 12:05.040 However, keep in mind that AroS was used as an inspiration of sorts, or maybe a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 267 11:59.680 --> 12:05.040 However, keep in mind that AroS was used as an inspiration of sorts, or maybe a 268 12:05.040 --> 12:05.680 foundation 269 12:05.680 --> 12:08.840 for iOSXE's graphical user interface. 270 12:08.840 --> 12:12.530 The big difference is on the back end, AroS commands look a whole lot different 271 12:12.530 --> 12:12.840 than 272 12:12.840 --> 12:17.720 iOSXE commands, which look like and feel like we're on a switch. 273 12:17.720 --> 12:22.150 And so some things are going to be a little bit different, but graphically, 274 12:22.150 --> 12:22.560 visually, 275 12:22.560 --> 12:23.920 some things will look very similar. 276 12:23.920 --> 12:24.920 And this is one of them. 277 12:24.920 --> 12:29.560 So as I just kind of drew out here, we're going to go over to the security tab. 278 12:29.560 --> 12:32.940 And then we'll see these individual tabs, including layer two and layer three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 278 12:29.560 --> 12:32.940 And then we'll see these individual tabs, including layer two and layer three 279 12:32.940 --> 12:33.600 security, 280 12:33.600 --> 12:39.410 where I can configure my WPA or I can configure my web auth, as well as triple 281 12:39.410 --> 12:40.520 A aspects. 282 12:40.520 --> 12:43.120 That all happens inside of the WLAN. 283 12:43.120 --> 12:47.830 And although we're going to need to configure site tags in iOSXE, AP groups in 284 12:47.830 --> 12:48.600 AroS, the 285 12:48.600 --> 12:52.060 triple A is still going to be important because we need to configure our radius 286 12:52.060 --> 12:52.480 and tack 287 12:52.480 --> 12:53.840 acts servers. 288 12:53.840 --> 13:00.070 But as far as deciding the security method to use, that all happens within the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 288 12:53.840 --> 13:00.070 But as far as deciding the security method to use, that all happens within the 289 13:00.070 --> 13:00.720 WLAN. 290 13:00.720 --> 13:04.940 And last question, when configuring WPA enterprise on a Cisco wireless LAN 291 13:04.940 --> 13:06.120 controller, what other 292 13:06.120 --> 13:08.880 configuration must be provided? 293 13:08.880 --> 13:15.080 Well, at this point, enterprise we should know does not use a pre shared key. 294 13:15.080 --> 13:16.840 The question is what does it use? 295 13:16.840 --> 13:24.100 Well, enterprise is going to require the use of that 802.1x architecture, which 296 13:24.100 --> 13:24.680 involves 297 13:24.680 --> 13:28.220 not only the supplicant and the authenticator, maybe the wireless LAN 298 13:28.220 --> 13:29.240 controller in this 299 13:29.240 --> 13:32.880 case, but also this server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 299 13:29.240 --> 13:32.880 case, but also this server. 300 13:32.880 --> 13:37.280 The server is either running radius or tack X plus, but either way, we 301 13:37.280 --> 13:38.400 typically refer 302 13:38.400 --> 13:42.160 to this as a triple A server, or at least we can. 303 13:42.160 --> 13:43.320 So D here is the answer. 304 13:43.320 --> 13:47.100 It's going to require us configuring a radius server or configuring a tack X 305 13:47.100 --> 13:47.720 plus server 306 13:47.720 --> 13:52.870 and making sure that we are our authenticator, the wireless LAN controller 307 13:52.870 --> 13:54.080 probably is able 308 13:54.080 --> 13:58.320 to check in with it to find out, hey, is this user allowed on the network? 309 13:58.320 --> 14:01.720 The radius and tack X server will store all of that information. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 309 13:58.320 --> 14:01.720 The radius and tack X server will store all of that information. 310 14:01.720 --> 14:05.640 So this was a review over the security of the wireless. 311 14:05.640 --> 14:08.770 It would only really cover a couple of skills, but there was a lot of 312 14:08.770 --> 14:09.880 information in those 313 14:09.880 --> 14:10.880 skills. 314 14:10.880 --> 14:14.270 So if you have these questions, trip the alarm, say, oh, I better go review 315 14:14.270 --> 14:15.080 that, then again, 316 14:15.080 --> 14:18.290 the source is at the bottom of every single question, be sure to go back and 317 14:18.290 --> 14:19.240 review that. 318 14:19.240 --> 14:22.060 And from here, what we're going to do is jump into the lab and make sure that 319 14:22.060 --> 14:22.640 we remember 320 14:22.640 --> 14:24.440 how to configure everything wireless.