WEBVTT

1
00:00.000 --> 00:01.158 align:middle line:84%


2
00:01.158 --> 00:03.700 align:middle line:90%
In this video, I'd like to share
with you a few details about

3
00:03.700 --> 00:07.180 align:middle line:90%
this protocol called 802.1x,
explain why it matters,

4
00:07.180 --> 00:09.997 align:middle line:90%
and a big picture
of how it works.

5
00:09.997 --> 00:11.080 align:middle line:84%
So let's use this drawing.

6
00:11.080 --> 00:12.760 align:middle line:90%
And let's start with
a user like Bob.

7
00:12.760 --> 00:15.700 align:middle line:90%
Now, think about for a moment,
how does a user normally

8
00:15.700 --> 00:17.590 align:middle line:84%
get access into the network?

9
00:17.590 --> 00:19.190 align:middle line:84%
There basically is two options.

10
00:19.190 --> 00:21.520 align:middle line:90%
One is they have a
networking device that

11
00:21.520 --> 00:24.910 align:middle line:90%
is wired into a device,
such as a switch,

12
00:24.910 --> 00:27.790 align:middle line:90%
or they are connected
with a wireless adapter

13
00:27.790 --> 00:30.460 align:middle line:90%
through an access point, which
in a corporate environment,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.790 --> 00:30.460 align:middle line:90%
through an access point, which
in a corporate environment,

14
00:30.460 --> 00:33.300 align:middle line:90%
that's the radio frequencies
for the Wi-Fi network.

15
00:33.300 --> 00:34.810 align:middle line:90%
And that access
point is connected

16
00:34.810 --> 00:38.200 align:middle line:90%
into a switch, which then leads
to a wireless LAN controller.

17
00:38.200 --> 00:40.383 align:middle line:90%
And that's where they get
access into the network.

18
00:40.383 --> 00:41.800 align:middle line:90%
So our goal would
be, whether it's

19
00:41.800 --> 00:43.390 align:middle line:90%
a wired connection
or wireless, it

20
00:43.390 --> 00:45.880 align:middle line:90%
would be ideal if we could
identify and authenticate

21
00:45.880 --> 00:49.450 align:middle line:90%
the user Bob before he just
goes crazy on the network

22
00:49.450 --> 00:51.280 align:middle line:90%
and starts doing
attacks on the network.

23
00:51.280 --> 00:53.770 align:middle line:90%
We want to identify who he is,
and then control his access

24
00:53.770 --> 00:55.853 align:middle line:84%
once we find out who he is.

25
00:55.853 --> 00:57.520 align:middle line:90%
And there is a standard
set of protocols

26
00:57.520 --> 00:58.645 align:middle line:84%
that we can use to do that.

27
00:58.645 --> 01:02.980 align:middle line:90%
And it's referred to
as 802.1x, as in X-ray.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.645 --> 01:02.980 align:middle line:90%
And it's referred to
as 802.1x, as in X-ray.

28
01:02.980 --> 01:06.400 align:middle line:90%
So by using 802.1x we have
the ability to identify who

29
01:06.400 --> 01:09.560 align:middle line:90%
the user is before we give
them access onto the network.

30
01:09.560 --> 01:11.860 align:middle line:90%
And let me explain the basic
pieces that are involved

31
01:11.860 --> 01:15.370 align:middle line:90%
in this network authentication
authorization with 802.1x.

32
01:15.370 --> 01:18.070 align:middle line:90%
One element is we're going
to have the device that's

33
01:18.070 --> 01:20.390 align:middle line:90%
going to be used for individuals
to get on the network.

34
01:20.390 --> 01:22.460 align:middle line:90%
So in this example,
it's a switch.

35
01:22.460 --> 01:26.530 align:middle line:90%
Now, that could be a multilayer
switch, S-W-I-T-C-H. Great.

36
01:26.530 --> 01:28.870 align:middle line:90%
It could be a multilayer
switch or a layer 2 switch.

37
01:28.870 --> 01:32.360 align:middle line:90%
But this is where the user is
connecting into the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.870 --> 01:32.360 align:middle line:90%
But this is where the user is
connecting into the network.

38
01:32.360 --> 01:34.090 align:middle line:90%
And by default, switches
just have ports.

39
01:34.090 --> 01:36.130 align:middle line:90%
They're normally
assigned as access ports

40
01:36.130 --> 01:37.080 align:middle line:84%
in a specific VLAN.

41
01:37.080 --> 01:37.650 align:middle line:84%
These are connected.

42
01:37.650 --> 01:38.150 align:middle line:84%
And boom!

43
01:38.150 --> 01:39.110 align:middle line:84%
They're on the network.

44
01:39.110 --> 01:40.810 align:middle line:90%
However, what we
can do is we can

45
01:40.810 --> 01:43.930 align:middle line:90%
use the role of an
authenticator on that switch.

46
01:43.930 --> 01:46.540 align:middle line:90%
Now, an authenticator
is simply a fancy way

47
01:46.540 --> 01:49.450 align:middle line:90%
of saying the device who's
going to ask the person who's

48
01:49.450 --> 01:51.680 align:middle line:84%
connecting for credentials.

49
01:51.680 --> 01:53.650 align:middle line:90%
So this authenticator
running software

50
01:53.650 --> 01:56.582 align:middle line:90%
or being configured to
support it when Bob connects,

51
01:56.582 --> 01:58.540 align:middle line:90%
the authenticator would
start asking questions,

52
01:58.540 --> 02:01.030 align:middle line:90%
like, hey, I think I
need to know who you are,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.540 --> 02:01.030 align:middle line:90%
like, hey, I think I
need to know who you are,

53
02:01.030 --> 02:02.690 align:middle line:84%
and some information about you.

54
02:02.690 --> 02:04.600 align:middle line:84%
That's the authenticator's role.

55
02:04.600 --> 02:07.270 align:middle line:90%
In this example, it's the switch
acting as the authenticator.

56
02:07.270 --> 02:10.300 align:middle line:90%
Now, Bob, the user,
doesn't probably

57
02:10.300 --> 02:14.073 align:middle line:90%
know a lot about the
details behind the scene

58
02:14.073 --> 02:15.490 align:middle line:90%
when the authenticator,
the switch

59
02:15.490 --> 02:16.870 align:middle line:84%
is asking about who he is.

60
02:16.870 --> 02:20.033 align:middle line:90%
But his computer, if it's
running some software--

61
02:20.033 --> 02:21.200 align:middle line:84%
there's a fancy name for it.

62
02:21.200 --> 02:23.190 align:middle line:84%
They call it a supplicant.

63
02:23.190 --> 02:25.400 align:middle line:90%
That software, when
it gets these requests

64
02:25.400 --> 02:26.290 align:middle line:84%
from the switch--

65
02:26.290 --> 02:28.982 align:middle line:90%
and sometimes a supplicant
can be third-party software

66
02:28.982 --> 02:30.440 align:middle line:90%
or it can be built
in the operating
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.982 --> 02:30.440 align:middle line:90%
or it can be built
in the operating

67
02:30.440 --> 02:31.910 align:middle line:84%
system for the network adapter.

68
02:31.910 --> 02:34.520 align:middle line:90%
In either case, the supplicant
running on Bob's computer

69
02:34.520 --> 02:36.380 align:middle line:90%
is going to go ahead
and interact and work

70
02:36.380 --> 02:38.570 align:middle line:84%
back and forth with the switch.

71
02:38.570 --> 02:40.310 align:middle line:90%
So in this supplicant,
it may prompt

72
02:40.310 --> 02:43.040 align:middle line:90%
the user for their identity,
their username and password,

73
02:43.040 --> 02:45.560 align:middle line:90%
for example, or it
may be pre-configured

74
02:45.560 --> 02:48.050 align:middle line:90%
with information about
Bob, or about this device.

75
02:48.050 --> 02:50.930 align:middle line:90%
So as part of 802.1x we
have the authenticator,

76
02:50.930 --> 02:54.320 align:middle line:90%
who is asking questions
through the 802.1x protocol,

77
02:54.320 --> 02:57.010 align:middle line:90%
to the supplicant, who's
answering those questions.

78
02:57.010 --> 02:58.670 align:middle line:90%
And effectively, if
it's the user Bob,

79
02:58.670 --> 03:01.730 align:middle line:90%
that information is communicated
over to the authenticator
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.670 --> 03:01.730 align:middle line:90%
that information is communicated
over to the authenticator

80
03:01.730 --> 03:03.140 align:middle line:84%
along with the password for Bob.

81
03:03.140 --> 03:05.090 align:middle line:90%
Now, one of the
problems is that Bob

82
03:05.090 --> 03:06.920 align:middle line:90%
could be connecting to
this switch one day,

83
03:06.920 --> 03:09.770 align:middle line:90%
and another switch another
day, and how do we centrally

84
03:09.770 --> 03:10.700 align:middle line:84%
manage all that?

85
03:10.700 --> 03:14.990 align:middle line:90%
Well, the third part of the
802.1x is this bad boy right

86
03:14.990 --> 03:17.512 align:middle line:84%
here, the authentication server.

87
03:17.512 --> 03:19.970 align:middle line:90%
So here's what happens as the
supplicant on Bob's computer,

88
03:19.970 --> 03:22.097 align:middle line:90%
the software, supplies
the information

89
03:22.097 --> 03:24.680 align:middle line:90%
that the authenticator is asking
for, once that information is

90
03:24.680 --> 03:26.870 align:middle line:90%
retrieved, the
authenticator is then

91
03:26.870 --> 03:29.460 align:middle line:90%
going to go ahead and forward
that over to an identity

92
03:29.460 --> 03:29.960 align:middle line:84%
server.

93
03:29.960 --> 03:32.660 align:middle line:90%
Now, in this example, it's
going to be ISE, the Identity
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:29.960 --> 03:32.660 align:middle line:90%
Now, in this example, it's
going to be ISE, the Identity

94
03:32.660 --> 03:33.950 align:middle line:84%
Services Engine.

95
03:33.950 --> 03:37.650 align:middle line:90%
And the protocol used right
here is going to be RADIUS.

96
03:37.650 --> 03:40.680 align:middle line:90%
So effectively, think of it
like the authenticator who says,

97
03:40.680 --> 03:42.200 align:middle line:84%
well, I know Bob's username.

98
03:42.200 --> 03:43.350 align:middle line:84%
Bob sent me his password.

99
03:43.350 --> 03:45.900 align:middle line:90%
Now I'm going to check
with the server, which

100
03:45.900 --> 03:49.650 align:middle line:90%
also could be referred to as
a AAA server, a RADIUS server.

101
03:49.650 --> 03:52.620 align:middle line:90%
ISE is an example of a RADIUS
server and a AAA server.

102
03:52.620 --> 03:54.120 align:middle line:90%
And then the RADIUS
server, after it

103
03:54.120 --> 03:56.160 align:middle line:90%
checks the credentials, it
can go ahead and send back

104
03:56.160 --> 03:58.410 align:middle line:90%
a message to the authenticator
and say, you know what?

105
03:58.410 --> 03:59.430 align:middle line:84%
Bob checks out.

106
03:59.430 --> 04:02.220 align:middle line:90%
Go ahead and give him access
on this port right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:59.430 --> 04:02.220 align:middle line:90%
Go ahead and give him access
on this port right here.

107
04:02.220 --> 04:06.000 align:middle line:90%
And in addition, besides just
the authentication of Bob,

108
04:06.000 --> 04:09.460 align:middle line:90%
we could also push down rules
regarding authorization as well

109
04:09.460 --> 04:11.070 align:middle line:90%
that state things
like, oh, yeah,

110
04:11.070 --> 04:14.160 align:middle line:90%
Bob's got this downloadable
ACL applied to him,

111
04:14.160 --> 04:17.100 align:middle line:90%
or Bob's supposed
to be in VLAN 30,

112
04:17.100 --> 04:19.589 align:middle line:90%
or VLAN 80, or
whatever VLAN we want

113
04:19.589 --> 04:22.380 align:middle line:90%
to assign for that
port dynamically based

114
04:22.380 --> 04:24.897 align:middle line:90%
on the authorization for Bob,
who's coming in on that port.

115
04:24.897 --> 04:26.730 align:middle line:90%
Or if we're using a
feature called TrustSec,

116
04:26.730 --> 04:29.040 align:middle line:90%
we could also push
down to the switch

117
04:29.040 --> 04:32.150 align:middle line:90%
the security groups that
Bob is associated with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:29.040 --> 04:32.150 align:middle line:90%
the security groups that
Bob is associated with

118
04:32.150 --> 04:34.398 align:middle line:84%
to further enforce policy.

119
04:34.398 --> 04:35.190 align:middle line:84%
So let's summarize.

120
04:35.190 --> 04:38.730 align:middle line:90%
The three basic parts of 802.1x
authentication for this network

121
04:38.730 --> 04:42.000 align:middle line:90%
authentication and authorization
is some type of software

122
04:42.000 --> 04:44.310 align:middle line:90%
that's running at the client
acting as a supplicant.

123
04:44.310 --> 04:47.250 align:middle line:90%
Think of a supplicant like
supplying the username,

124
04:47.250 --> 04:48.760 align:middle line:84%
and password, and credentials.

125
04:48.760 --> 04:50.610 align:middle line:90%
The switch in this
example is acting

126
04:50.610 --> 04:53.450 align:middle line:90%
as the authenticator who's
asking for that information.

127
04:53.450 --> 04:54.960 align:middle line:90%
And then the ISE
server is acting

128
04:54.960 --> 04:57.748 align:middle line:90%
as the authentication server,
where the switch takes

129
04:57.748 --> 05:00.290 align:middle line:90%
that information, ships it over
to the authentication server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:57.748 --> 05:00.290 align:middle line:90%
that information, ships it over
to the authentication server,

130
05:00.290 --> 05:02.260 align:middle line:90%
and says, hey, are these
credentials all good?

131
05:02.260 --> 05:04.170 align:middle line:90%
And if so, what type
of authorization

132
05:04.170 --> 05:06.130 align:middle line:90%
should I allow for
this port that the user

133
05:06.130 --> 05:07.130 align:middle line:84%
is trying to connect on?

134
05:07.130 --> 05:09.300 align:middle line:84%
That's the basics of 802.1x.

135
05:09.300 --> 05:11.640 align:middle line:84%
Now, check this out.

136
05:11.640 --> 05:14.160 align:middle line:90%
Not every device that's
connecting to our network

137
05:14.160 --> 05:16.242 align:middle line:90%
is going to support
a supplicant.

138
05:16.242 --> 05:17.700 align:middle line:90%
Maybe it's an
operating system that

139
05:17.700 --> 05:19.650 align:middle line:90%
doesn't have a
built-in supplicant,

140
05:19.650 --> 05:21.270 align:middle line:90%
or maybe it's a
device that can't

141
05:21.270 --> 05:23.430 align:middle line:90%
run a supplicant, like
a printer, or an IP

142
05:23.430 --> 05:24.610 align:middle line:84%
camera, or something else.

143
05:24.610 --> 05:25.680 align:middle line:84%
What do we do for that?

144
05:25.680 --> 05:29.643 align:middle line:90%
Well, we can also set up
our switches to try 802.1x,

145
05:29.643 --> 05:30.810 align:middle line:84%
and say, hey, are you there?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:29.643 --> 05:30.810 align:middle line:84%
and say, hey, are you there?

146
05:30.810 --> 05:31.630 align:middle line:84%
Are you there?

147
05:31.630 --> 05:34.950 align:middle line:90%
And if they don't respond
using the 802.1x protocols,

148
05:34.950 --> 05:35.700 align:middle line:84%
we can then--

149
05:35.700 --> 05:38.432 align:middle line:90%
after a short timeout, we
can then say, you know what?

150
05:38.432 --> 05:40.140 align:middle line:90%
Let's go ahead and
check out your layer 2

151
05:40.140 --> 05:41.400 align:middle line:84%
address, your MAC address.

152
05:41.400 --> 05:45.060 align:middle line:90%
And we can do authentication
based on a MAC address that's

153
05:45.060 --> 05:45.870 align:middle line:84%
expected.

154
05:45.870 --> 05:47.010 align:middle line:84%
Think of it like this.

155
05:47.010 --> 05:50.190 align:middle line:90%
Think of a security gate
with a car coming up.

156
05:50.190 --> 05:52.603 align:middle line:90%
And the guard is looking
at the driver and saying,

157
05:52.603 --> 05:53.770 align:middle line:84%
I need all your information.

158
05:53.770 --> 05:54.810 align:middle line:84%
Who are you?

159
05:54.810 --> 05:56.880 align:middle line:90%
The user says, the
driver says, I'm Bob.

160
05:56.880 --> 05:59.130 align:middle line:90%
And the security guard
looks it up and says, great.

161
05:59.130 --> 06:00.550 align:middle line:84%
Yep, you're good to go.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
05:59.130 --> 06:00.550 align:middle line:84%
Yep, you're good to go.

162
06:00.550 --> 06:02.370 align:middle line:90%
Now, that would be
an example of 802.1x.

163
06:02.370 --> 06:06.570 align:middle line:90%
However, if we'd had a device
that didn't support 802.1x,

164
06:06.570 --> 06:09.210 align:middle line:90%
it'd be sort of like a car
driving up to the security

165
06:09.210 --> 06:12.060 align:middle line:90%
gate, and the security guard not
paying attention to the driver,

166
06:12.060 --> 06:14.820 align:middle line:90%
just looking at the license
plate, and saying, yep,

167
06:14.820 --> 06:16.170 align:middle line:84%
that license plate checks out.

168
06:16.170 --> 06:17.310 align:middle line:84%
Come on in.

169
06:17.310 --> 06:20.490 align:middle line:90%
And that is referred to
as MAC, as in MAC address,

170
06:20.490 --> 06:23.178 align:middle line:84%
MAC authentication bypass.

171
06:23.178 --> 06:25.720 align:middle line:90%
We're just going to authenticate
it based on the MAC address.

172
06:25.720 --> 06:29.640 align:middle line:90%
It's not as secure as 802.1x,
but it's an important feature

173
06:29.640 --> 06:33.220 align:middle line:90%
to be aware of and have for all
those devices on our networks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:29.640 --> 06:33.220 align:middle line:90%
to be aware of and have for all
those devices on our networks

174
06:33.220 --> 06:36.450 align:middle line:90%
that just cannot run a
supplicant and participate

175
06:36.450 --> 06:37.680 align:middle line:84%
in 802.1x.

176
06:37.680 --> 06:40.110 align:middle line:90%
So that's what I wanted to
drive home in this video was

177
06:40.110 --> 06:42.852 align:middle line:90%
the concept of 802.1x, finding
out who the individual is

178
06:42.852 --> 06:44.310 align:middle line:90%
before letting them
on the network,

179
06:44.310 --> 06:47.610 align:middle line:90%
and also in the
absence of to 802.1x,

180
06:47.610 --> 06:49.680 align:middle line:90%
using a feature called
MAC authentication bypass.

181
06:49.680 --> 06:51.527 align:middle line:84%
Now, one other aspect is this.

182
06:51.527 --> 06:53.610 align:middle line:90%
If we do have a client,
like Bob and his computer,

183
06:53.610 --> 06:57.360 align:middle line:90%
and there is a supplicant there,
there are a lot of options

184
06:57.360 --> 07:01.680 align:middle line:90%
regarding 802.1x that we can
choose to use as we talk back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:57.360 --> 07:01.680 align:middle line:90%
regarding 802.1x that we can
choose to use as we talk back

185
07:01.680 --> 07:03.960 align:middle line:90%
and forth between the
authenticator, the switch,

186
07:03.960 --> 07:06.420 align:middle line:90%
supplicant, which is running
on the client's computer,

187
07:06.420 --> 07:07.270 align:middle line:84%
and the AAA server.

188
07:07.270 --> 07:09.270 align:middle line:90%
And we're going to take
a look at those options,

189
07:09.270 --> 07:11.370 align:middle line:90%
including extensible
authentication

190
07:11.370 --> 07:13.160 align:middle line:84%
protocol in the next video.

191
07:13.160 --> 07:14.760 align:middle line:84%
I'll see there in just a moment.

192
07:14.760 --> 07:17.310 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

193
07:17.310 --> 07:20.480 align:middle line:90%
And I'd like to thank
you for viewing.