WEBVTT

1
00:00.000 --> 00:01.170 align:middle line:84%


2
00:01.170 --> 00:04.560 align:middle line:90%
The heart and soul of getting
802.1x to work is having

3
00:04.560 --> 00:07.440 align:middle line:90%
a supplicant on the end
device that can interact with

4
00:07.440 --> 00:10.682 align:middle line:90%
our switch or device acting as
the authenticator so we can get

5
00:10.682 --> 00:11.390 align:middle line:84%
the ball rolling.

6
00:11.390 --> 00:13.890 align:middle line:90%
And we ship off that information
to our identity server,

7
00:13.890 --> 00:16.650 align:middle line:90%
who then says thumbs up
or thumbs down, and allows

8
00:16.650 --> 00:18.670 align:middle line:90%
us to authorize that
user on the network.

9
00:18.670 --> 00:20.940 align:middle line:90%
Now, when we're
setting up 802.1x,

10
00:20.940 --> 00:25.260 align:middle line:90%
there is a suite of protocols
in the family of EAP.

11
00:25.260 --> 00:29.063 align:middle line:90%
And it stands for the Extensible
Authentication Protocol.

12
00:29.063 --> 00:30.480 align:middle line:90%
And the point I
want to drive here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.063 --> 00:30.480 align:middle line:90%
And the point I
want to drive here

13
00:30.480 --> 00:32.605 align:middle line:90%
is that if you have a
supplicant that only supports

14
00:32.605 --> 00:35.040 align:middle line:90%
two or three options, you'd
want to use those two or three

15
00:35.040 --> 00:35.760 align:middle line:84%
options.

16
00:35.760 --> 00:37.980 align:middle line:90%
However, at the identity
services engine,

17
00:37.980 --> 00:40.500 align:middle line:90%
who's getting all these
requests from the authenticator,

18
00:40.500 --> 00:43.260 align:middle line:90%
we also want to make sure we're
supporting the options that

19
00:43.260 --> 00:44.503 align:middle line:84%
are needed for those clients.

20
00:44.503 --> 00:46.170 align:middle line:90%
So what I'd like to
do is share with you

21
00:46.170 --> 00:49.680 align:middle line:90%
a few of the
popular EAP options,

22
00:49.680 --> 00:51.480 align:middle line:90%
the extensible
authentication protocol,

23
00:51.480 --> 00:54.850 align:middle line:90%
and also give you a
sneak peak into a client,

24
00:54.850 --> 00:56.520 align:middle line:90%
and also on the
identity services engine

25
00:56.520 --> 00:58.480 align:middle line:84%
to show you what they look like.

26
00:58.480 --> 01:00.010 align:middle line:84%
So this is Bob's computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.480 --> 01:00.010 align:middle line:84%
So this is Bob's computer.

27
01:00.010 --> 01:02.220 align:middle line:90%
And I've got control
panel open so we

28
01:02.220 --> 01:03.995 align:middle line:84%
can take a look at the details.

29
01:03.995 --> 01:05.370 align:middle line:90%
So this is the
interface I'd like

30
01:05.370 --> 01:06.880 align:middle line:84%
to focus on here for a moment.

31
01:06.880 --> 01:10.530 align:middle line:90%
So this Windows machine is
configured to support 802.1x.

32
01:10.530 --> 01:13.170 align:middle line:90%
And if we want to modify the
parameters on the supplicant,

33
01:13.170 --> 01:17.160 align:middle line:90%
we can right-click on that
interface and go to properties.

34
01:17.160 --> 01:19.170 align:middle line:90%
And if 802.1x is
currently set up,

35
01:19.170 --> 01:21.950 align:middle line:90%
it's going to have this option
right here for authentication.

36
01:21.950 --> 01:24.533 align:middle line:90%
And then, you just simply check
the check box that says Enable

37
01:24.533 --> 01:26.670 align:middle line:84%
IEEE 802.1x Authentication.

38
01:26.670 --> 01:30.130 align:middle line:90%
And then we can select the
method that we want to use.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:26.670 --> 01:30.130 align:middle line:90%
And then we can select the
method that we want to use.

39
01:30.130 --> 01:30.630 align:middle line:84%
Wow.

40
01:30.630 --> 01:32.820 align:middle line:90%
So based on a
Microsoft client, we're

41
01:32.820 --> 01:35.490 align:middle line:90%
going to have a
certain set of options

42
01:35.490 --> 01:38.280 align:middle line:90%
or extensible
authentication protocol.

43
01:38.280 --> 01:39.750 align:middle line:84%
And let me point out a couple.

44
01:39.750 --> 01:42.210 align:middle line:90%
This right here
is EEP TTLS, Which

45
01:42.210 --> 01:44.580 align:middle line:90%
stands for Extensible
Authentication Protocol

46
01:44.580 --> 01:49.200 align:middle line:90%
Tunneled TLS, which TLS
implies some security

47
01:49.200 --> 01:50.550 align:middle line:84%
in a encrypted tunnel.

48
01:50.550 --> 01:54.690 align:middle line:90%
Another one right here is
the Microsoft Protected EAP.

49
01:54.690 --> 01:57.090 align:middle line:90%
Also known as PEAP,
for Protected EAP.

50
01:57.090 --> 02:00.900 align:middle line:90%
And this was developed by
Cisco, Microsoft, and also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:57.090 --> 02:00.900 align:middle line:90%
And this was developed by
Cisco, Microsoft, and also

51
02:00.900 --> 02:01.617 align:middle line:84%
[INAUDIBLE].

52
02:01.617 --> 02:02.700 align:middle line:84%
And it was a joint effort.

53
02:02.700 --> 02:05.290 align:middle line:90%
And that's why we have it
here on the Microsoft client.

54
02:05.290 --> 02:08.190 align:middle line:90%
So let's imagine that
we select Protected EAP

55
02:08.190 --> 02:11.280 align:middle line:90%
for the authentication type that
we're going to use for 802.1x.

56
02:11.280 --> 02:13.650 align:middle line:90%
If we click on Settings,
check this out--

57
02:13.650 --> 02:15.600 align:middle line:90%
within Settings, we
can also then verify

58
02:15.600 --> 02:19.380 align:middle line:90%
the authentication method
within that EAP, in our case

59
02:19.380 --> 02:20.483 align:middle line:84%
Protected ERP.

60
02:20.483 --> 02:21.900 align:middle line:90%
And so these are
the ones that are

61
02:21.900 --> 02:25.200 align:middle line:90%
built in that are supported
under Protected EAP, which

62
02:25.200 --> 02:28.770 align:middle line:90%
is a secured password
using EAP MSCHAP version 2

63
02:28.770 --> 02:31.290 align:middle line:90%
or a smart card or
other certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:28.770 --> 02:31.290 align:middle line:90%
or a smart card or
other certificate.

64
02:31.290 --> 02:33.073 align:middle line:90%
And if we want to
specify the password,

65
02:33.073 --> 02:34.490 align:middle line:90%
I'll go ahead and
click on Cancel.

66
02:34.490 --> 02:35.820 align:middle line:84%
I didn't make any changes there.

67
02:35.820 --> 02:37.737 align:middle line:90%
If we want to configure
the password for this,

68
02:37.737 --> 02:39.330 align:middle line:90%
we can click on
Additional Settings.

69
02:39.330 --> 02:41.820 align:middle line:90%
And then here under
User Authentication,

70
02:41.820 --> 02:43.530 align:middle line:84%
click on Replace Credentials.

71
02:43.530 --> 02:45.900 align:middle line:90%
Then we could put Lewis, or
Bob, or whoever's connection

72
02:45.900 --> 02:46.400 align:middle line:84%
this is.

73
02:46.400 --> 02:47.410 align:middle line:84%
I think this is Bob.

74
02:47.410 --> 02:50.340 align:middle line:84%
So we'll put in Bob.

75
02:50.340 --> 02:53.280 align:middle line:90%
Put in his password,
click on OK.

76
02:53.280 --> 02:55.352 align:middle line:90%
And then to verify
it, we could go ahead.

77
02:55.352 --> 02:57.310 align:middle line:90%
Right there it says
attempting to authenticate.

78
02:57.310 --> 03:00.320 align:middle line:90%
So we could disable it for
a moment, bring it back up,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:57.310 --> 03:00.320 align:middle line:90%
So we could disable it for
a moment, bring it back up,

79
03:00.320 --> 03:02.670 align:middle line:90%
and in the background, if
the authenticator is set up,

80
03:02.670 --> 03:04.590 align:middle line:90%
which is the switch
port we're connected to,

81
03:04.590 --> 03:06.690 align:middle line:90%
and the AAA server, the
authentication server,

82
03:06.690 --> 03:09.960 align:middle line:90%
is all set up, we be able to
successfully authenticate Bob.

83
03:09.960 --> 03:12.580 align:middle line:90%
So we could look at the
authenticator and verify that.

84
03:12.580 --> 03:15.300 align:middle line:90%
And we could also look at the
authentication server, which,

85
03:15.300 --> 03:16.770 align:middle line:90%
in our case, is
ISE, to verify it.

86
03:16.770 --> 03:19.062 align:middle line:90%
In fact, let me give you a
sneak peek at both of those.

87
03:19.062 --> 03:20.870 align:middle line:90%
Let's take a peek at
the authenticator.

88
03:20.870 --> 03:22.950 align:middle line:90%
So this is the switch
that Bob is using

89
03:22.950 --> 03:24.330 align:middle line:84%
to get access into the network.

90
03:24.330 --> 03:26.880 align:middle line:90%
So the switch is configured
as an authenticator.

91
03:26.880 --> 03:30.420 align:middle line:90%
And if we do a show
authentication sessions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:26.880 --> 03:30.420 align:middle line:90%
And if we do a show
authentication sessions

92
03:30.420 --> 03:33.150 align:middle line:90%
and press Enter, it's going
to give us details that hey,

93
03:33.150 --> 03:36.390 align:middle line:90%
here we have an authentication
on G12/0/2, which

94
03:36.390 --> 03:37.680 align:middle line:84%
is where Bob is connected.

95
03:37.680 --> 03:40.650 align:middle line:90%
And if we did a show
authentication sessions,

96
03:40.650 --> 03:42.030 align:middle line:84%
and we'll type in mac.

97
03:42.030 --> 03:43.800 align:middle line:90%
And then we'll supply
Bob's mac address,

98
03:43.800 --> 03:44.900 align:middle line:84%
which we just saw here.

99
03:44.900 --> 03:46.580 align:middle line:84%
I'll copy-paste that.

100
03:46.580 --> 03:48.990 align:middle line:90%
And then we tack on
the keyword of details,

101
03:48.990 --> 03:51.720 align:middle line:90%
it's going to show us
all the details regarding

102
03:51.720 --> 03:52.830 align:middle line:84%
his authentication.

103
03:52.830 --> 03:54.270 align:middle line:84%
So we know it's Bob.

104
03:54.270 --> 03:54.990 align:middle line:84%
Fantastic.

105
03:54.990 --> 03:56.410 align:middle line:84%
There's his mac address.

106
03:56.410 --> 03:58.860 align:middle line:90%
The port is authorized, meaning
the AAA server said, yep,

107
03:58.860 --> 04:01.470 align:middle line:90%
he's authenticated, and then
assigning him some rights
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:58.860 --> 04:01.470 align:middle line:90%
he's authenticated, and then
assigning him some rights

108
04:01.470 --> 04:03.570 align:middle line:90%
and permissions,
including pushing down

109
04:03.570 --> 04:05.670 align:middle line:90%
parameters such as what
VLAN Bob should belong

110
04:05.670 --> 04:08.815 align:middle line:90%
to, and also a security
group tag, if we

111
04:08.815 --> 04:09.690 align:middle line:84%
have that configured.

112
04:09.690 --> 04:11.760 align:middle line:90%
So security group tags
are used for TRUSSEC,

113
04:11.760 --> 04:13.080 align:middle line:84%
which we'll cover as well.

114
04:13.080 --> 04:15.360 align:middle line:90%
It also states down here
the method that was used

115
04:15.360 --> 04:16.990 align:middle line:90%
for authentication,
which was .dot1x.

116
04:16.990 --> 04:17.890 align:middle line:84%


117
04:17.890 --> 04:19.890 align:middle line:90%
We take a look at the
Identity Services Engine--

118
04:19.890 --> 04:22.348 align:middle line:90%
and we'll have separate videos
on how to configure and work

119
04:22.348 --> 04:23.080 align:middle line:84%
with this.

120
04:23.080 --> 04:24.720 align:middle line:90%
We can also look at
the log files here,

121
04:24.720 --> 04:28.020 align:middle line:90%
just to verify what happened and
also see that Bob successfully

122
04:28.020 --> 04:29.400 align:middle line:84%
authenticated.

123
04:29.400 --> 04:32.860 align:middle line:90%
So I'm going to log in to ISE,
the Identity Services Engine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:29.400 --> 04:32.860 align:middle line:90%
So I'm going to log in to ISE,
the Identity Services Engine.

124
04:32.860 --> 04:35.250 align:middle line:90%
And from here, if we
hover over operations

125
04:35.250 --> 04:37.170 align:middle line:90%
and we go to the
radius live logs,

126
04:37.170 --> 04:39.630 align:middle line:90%
because the language of love
between the authenticator,

127
04:39.630 --> 04:42.375 align:middle line:90%
the switch, and this
ISE server is radius.

128
04:42.375 --> 04:44.417 align:middle line:90%
So if you go to
the live logs here,

129
04:44.417 --> 04:46.500 align:middle line:90%
this icon right there
indicates a current session.

130
04:46.500 --> 04:47.542 align:middle line:84%
So Bob has authenticated.

131
04:47.542 --> 04:49.208 align:middle line:90%
If you want to see
the details for that,

132
04:49.208 --> 04:51.780 align:middle line:90%
we can click on this icon right
here for the authentication

133
04:51.780 --> 04:52.660 align:middle line:84%
detail report.

134
04:52.660 --> 04:54.570 align:middle line:84%
It will open up in a new window.

135
04:54.570 --> 04:56.390 align:middle line:84%
And sure enough, there is Bob.

136
04:56.390 --> 04:58.680 align:middle line:90%
There are some authentication
authorization policy

137
04:58.680 --> 05:01.530 align:middle line:90%
sets that he was able to
pass and get access through.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:58.680 --> 05:01.530 align:middle line:90%
sets that he was able to
pass and get access through.

138
05:01.530 --> 05:03.570 align:middle line:90%
And over here on the
right, check this out.

139
05:03.570 --> 05:05.760 align:middle line:90%
Here it says extracted
EAP identity.

140
05:05.760 --> 05:08.430 align:middle line:90%
There was a proposal
for EAP TLS.

141
05:08.430 --> 05:11.830 align:middle line:90%
And if we scroll down, it said,
nah, don't want to do that.

142
05:11.830 --> 05:14.130 align:middle line:90%
So it said, OK, let's
do a proposal for PEAP,

143
05:14.130 --> 05:15.780 align:middle line:84%
protected EAP.

144
05:15.780 --> 05:18.300 align:middle line:90%
And then within that, if
we scroll down further,

145
05:18.300 --> 05:21.360 align:middle line:90%
it'll use protected EAP to
protect the conversation.

146
05:21.360 --> 05:24.060 align:middle line:90%
And then it used MS CHAP
to protect the password

147
05:24.060 --> 05:26.370 align:middle line:90%
and credentials within
that communication.

148
05:26.370 --> 05:28.982 align:middle line:90%
And also, one more little sneak
peek into the world of ISE.

149
05:28.982 --> 05:31.440 align:middle line:90%
Let me share with you some of
the defaults and options that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:28.982 --> 05:31.440 align:middle line:90%
Let me share with you some of
the defaults and options that

150
05:31.440 --> 05:34.920 align:middle line:90%
we have regarding to 802.1x,
because the Identity Services

151
05:34.920 --> 05:37.373 align:middle line:90%
Engine has a
plethora of options.

152
05:37.373 --> 05:38.790 align:middle line:90%
And normally our
choices are going

153
05:38.790 --> 05:40.560 align:middle line:90%
to be limited by
what is supported

154
05:40.560 --> 05:42.613 align:middle line:90%
by the supplicant of the
client that it can use.

155
05:42.613 --> 05:44.280 align:middle line:90%
But we definitely
want to make sure it's

156
05:44.280 --> 05:47.140 align:middle line:90%
supported on the Identity
Services Engine as well.

157
05:47.140 --> 05:49.440 align:middle line:90%
And this is a list of the
default network access,

158
05:49.440 --> 05:51.990 align:middle line:90%
or the default protocols,
that ISE right out of the gate

159
05:51.990 --> 05:53.380 align:middle line:84%
is willing to accept.

160
05:53.380 --> 05:55.970 align:middle line:84%
So if we expand that--

161
05:55.970 --> 05:58.070 align:middle line:90%
my goal isn't here for
you to memorize all these,

162
05:58.070 --> 05:59.528 align:middle line:90%
but simply to be
aware that there's

163
05:59.528 --> 06:01.760 align:middle line:90%
lots of different options
that the Identity Service
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
05:59.528 --> 06:01.760 align:middle line:90%
lots of different options
that the Identity Service

164
06:01.760 --> 06:02.990 align:middle line:84%
Engine supports.

165
06:02.990 --> 06:05.100 align:middle line:90%
So if we go down, here's
allowed protocols.

166
06:05.100 --> 06:10.550 align:middle line:90%
There is EAP TLS, there's
PEAP, there's also

167
06:10.550 --> 06:13.130 align:middle line:90%
LEAP, which was a Cisco
proprietary method

168
06:13.130 --> 06:15.710 align:middle line:90%
for extensible
authentication protocol.

169
06:15.710 --> 06:17.573 align:middle line:84%
The L is for lightweight.

170
06:17.573 --> 06:18.990 align:middle line:90%
So for the
authentication for Bob,

171
06:18.990 --> 06:22.650 align:middle line:90%
we used PEAP and we also used
the MS CHAP version 2, which

172
06:22.650 --> 06:25.050 align:middle line:84%
are both supported here by ISE.

173
06:25.050 --> 06:28.350 align:middle line:90%
And if we scroll down,
there's EAP FAST.

174
06:28.350 --> 06:31.020 align:middle line:90%
And EAP FAST is
another Cisco creation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
06:28.350 --> 06:31.020 align:middle line:90%
And EAP FAST is
another Cisco creation.

175
06:31.020 --> 06:34.350 align:middle line:90%
And it stands for the
Flexible Authentication

176
06:34.350 --> 06:35.760 align:middle line:84%
via Secure Tunneling.

177
06:35.760 --> 06:38.280 align:middle line:90%
It was meant to replace
Cisco's lightweight EAP, which

178
06:38.280 --> 06:39.240 align:middle line:84%
was LEAP.

179
06:39.240 --> 06:40.830 align:middle line:90%
And so with the
EAP FAST, it's also

180
06:40.830 --> 06:43.020 align:middle line:90%
supporting the inter
methods of MS CHAP 2

181
06:43.020 --> 06:44.950 align:middle line:84%
and some other options as well.

182
06:44.950 --> 06:47.940 align:middle line:90%
And if we scroll down,
here is EAP TTLS,

183
06:47.940 --> 06:49.650 align:middle line:84%
which is the Tunnel TLS.

184
06:49.650 --> 06:52.440 align:middle line:90%
So the key is here there's lots
of options when we're using

185
06:52.440 --> 06:54.810 align:middle line:90%
Extensible Authentication
Protocol, or EAP,

186
06:54.810 --> 06:56.340 align:middle line:84%
in conjunction with 802.1x.

187
06:56.340 --> 06:58.410 align:middle line:90%
And most of those are
going to be limited

188
06:58.410 --> 07:01.530 align:middle line:90%
by what the supplicant,
whether it's a Microsoft
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
06:58.410 --> 07:01.530 align:middle line:90%
by what the supplicant,
whether it's a Microsoft

189
07:01.530 --> 07:04.230 align:middle line:90%
device or an Apple device
or a third-party product,

190
07:04.230 --> 07:05.580 align:middle line:84%
based on what it can do.

191
07:05.580 --> 07:07.890 align:middle line:90%
And we want to ensure
that ISE on the back end

192
07:07.890 --> 07:08.952 align:middle line:84%
also supports that.

193
07:08.952 --> 07:10.410 align:middle line:90%
And if we have
policies that agree,

194
07:10.410 --> 07:12.060 align:middle line:90%
we can get that ball
rolling and start

195
07:12.060 --> 07:14.335 align:middle line:90%
to do the authentication
of Bob, which is important.

196
07:14.335 --> 07:16.710 align:middle line:90%
So the next question might
be, well, Keith, what exactly,

197
07:16.710 --> 07:18.210 align:middle line:90%
based on authentication,
what kind

198
07:18.210 --> 07:20.400 align:middle line:90%
of access rights, or
permissions, or controls

199
07:20.400 --> 07:22.440 align:middle line:90%
can we implement if
we've authenticated Bob?

200
07:22.440 --> 07:23.440 align:middle line:84%
That's a great question.

201
07:23.440 --> 07:25.020 align:middle line:90%
We're going to talk about
that in the next video.

202
07:25.020 --> 07:27.570 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

203
07:27.570 --> 07:30.830 align:middle line:90%
And I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

203
07:27.570 --> 07:30.830 align:middle line:90%
And I'd like to thank
you for viewing.