WEBVTT

1
00:00.000 --> 00:02.220 align:middle line:84%


2
00:02.220 --> 00:03.710 align:middle line:90%
With software-defined
networking,

3
00:03.710 --> 00:06.085 align:middle line:90%
it would be awesome to just
to hit a button and say, yes,

4
00:06.085 --> 00:07.920 align:middle line:90%
I want to do 802.1X
authentication.

5
00:07.920 --> 00:09.270 align:middle line:84%
Make it happen.

6
00:09.270 --> 00:12.420 align:middle line:90%
However, until that's in place,
what I'd like to do is walk you

7
00:12.420 --> 00:15.120 align:middle line:90%
through some of the commands
from a AAA perspective

8
00:15.120 --> 00:18.510 align:middle line:90%
and dot1x perspective in global
config that we want to put

9
00:18.510 --> 00:21.780 align:middle line:90%
on a switch to go ahead and
have it be able to do 802.1X

10
00:21.780 --> 00:24.510 align:middle line:90%
authentication in coordination
with a AAA server.

11
00:24.510 --> 00:27.360 align:middle line:90%
In our case, that AAA server
is going to be running RADIUS,

12
00:27.360 --> 00:29.453 align:middle line:90%
and it's the Identity
Services Engine.

13
00:29.453 --> 00:30.870 align:middle line:90%
Let's take a look
at our topology.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.453 --> 00:30.870 align:middle line:90%
Let's take a look
at our topology.

14
00:30.870 --> 00:32.820 align:middle line:90%
And I'll walk you through
several of the commands

15
00:32.820 --> 00:34.350 align:middle line:90%
that we're going to
need to implement.

16
00:34.350 --> 00:36.600 align:middle line:90%
And to put this in perspective,
what we're configuring

17
00:36.600 --> 00:38.070 align:middle line:84%
is this bad boy right here.

18
00:38.070 --> 00:40.440 align:middle line:90%
We have the Identity Services
Engine already configured

19
00:40.440 --> 00:41.430 align:middle line:84%
for 802.1X.

20
00:41.430 --> 00:43.557 align:middle line:90%
We did that in a
previous set of videos.

21
00:43.557 --> 00:45.640 align:middle line:90%
And now we're going to be
focusing on this switch.

22
00:45.640 --> 00:48.720 align:middle line:90%
Now, at the moment, this switch
is a little eight-port switch,

23
00:48.720 --> 00:50.280 align:middle line:84%
nothing too fancy.

24
00:50.280 --> 00:52.855 align:middle line:90%
And as we progress and
do additional features,

25
00:52.855 --> 00:55.230 align:middle line:90%
we just want to make sure that
any feature we want to use

26
00:55.230 --> 00:59.240 align:middle line:90%
on the switch, like 802.1X
or if we want to use TrustSec

27
00:59.240 --> 01:01.620 align:middle line:90%
or MACsec, you'd want to make
sure that the actual switch
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.240 --> 01:01.620 align:middle line:90%
or MACsec, you'd want to make
sure that the actual switch

28
01:01.620 --> 01:04.920 align:middle line:90%
hardware and software supports
those features before we try

29
01:04.920 --> 01:05.793 align:middle line:84%
to implement them.

30
01:05.793 --> 01:06.960 align:middle line:84%
Well, I've done the testing.

31
01:06.960 --> 01:09.650 align:middle line:90%
This switch does support
802.1X authentication.

32
01:09.650 --> 01:11.400 align:middle line:90%
Let's take a look at
a few of the commands

33
01:11.400 --> 01:12.775 align:middle line:90%
that we need to
implement to make

34
01:12.775 --> 01:16.018 align:middle line:90%
that happen in conjunction with
our Identity Services Engine.

35
01:16.018 --> 01:17.560 align:middle line:90%
And to help us along
in this process,

36
01:17.560 --> 01:19.143 align:middle line:90%
I've got a console
here to our switch.

37
01:19.143 --> 01:20.700 align:middle line:84%
Let's do a show version.

38
01:20.700 --> 01:23.340 align:middle line:84%
And it's a 3560 switch.

39
01:23.340 --> 01:25.290 align:middle line:90%
And it supports the
features that we need.

40
01:25.290 --> 01:27.750 align:middle line:90%
Also, let's do a
show users and just

41
01:27.750 --> 01:30.960 align:middle line:90%
verify that I am
connected as admin.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:27.750 --> 01:30.960 align:middle line:90%
verify that I am
connected as admin.

42
01:30.960 --> 01:33.360 align:middle line:90%
And I'm connected
logically on line vty 0.

43
01:33.360 --> 01:35.100 align:middle line:84%
Do a show ssh.

44
01:35.100 --> 01:35.640 align:middle line:84%
Press Enter.

45
01:35.640 --> 01:38.275 align:middle line:90%
I'm currently using SSH
for this remote access.

46
01:38.275 --> 01:40.650 align:middle line:90%
So let's keep that in mind as
we implement these commands

47
01:40.650 --> 01:43.290 align:middle line:84%
for AAA and 802.1X.

48
01:43.290 --> 01:45.048 align:middle line:90%
Let's start off with
global configuration.

49
01:45.048 --> 01:46.590 align:middle line:90%
We're all familiar
with this bad boy.

50
01:46.590 --> 01:47.298 align:middle line:84%
This is config t.

51
01:47.298 --> 01:50.490 align:middle line:90%
And I'm using Visual
Studio Code or VS

52
01:50.490 --> 01:53.220 align:middle line:90%
Code as a nice holding tank
for some of these commands.

53
01:53.220 --> 01:54.430 align:middle line:84%
But you could use notepad.

54
01:54.430 --> 01:57.510 align:middle line:90%
And what I did was I just went
out to Cisco's documentation

55
01:57.510 --> 01:59.760 align:middle line:90%
for 802.1X, went
through the commands.

56
01:59.760 --> 02:00.810 align:middle line:84%
There's a lot of them.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:59.760 --> 02:00.810 align:middle line:84%
There's a lot of them.

57
02:00.810 --> 02:02.190 align:middle line:90%
And I just pulled a
few in that I thought

58
02:02.190 --> 02:04.320 align:middle line:90%
would be relevant for
discussing and also a few

59
02:04.320 --> 02:06.390 align:middle line:90%
that are required to
make this all work.

60
02:06.390 --> 02:07.230 align:middle line:84%
So config t.

61
02:07.230 --> 02:09.000 align:middle line:90%
We're going into
configuration mode.

62
02:09.000 --> 02:10.590 align:middle line:90%
The first thing,
right off the bat,

63
02:10.590 --> 02:13.590 align:middle line:90%
we want to create a user
account that has King Kong

64
02:13.590 --> 02:15.750 align:middle line:84%
rights locally on this box.

65
02:15.750 --> 02:18.490 align:middle line:90%
That way, if we need to log
in with a local account,

66
02:18.490 --> 02:20.280 align:middle line:90%
we've got a user
with privilege level

67
02:20.280 --> 02:22.260 align:middle line:90%
15 access that we
can go in with.

68
02:22.260 --> 02:25.097 align:middle line:90%
Next, we're enabling aaa new
model if it isn't already.

69
02:25.097 --> 02:26.430 align:middle line:84%
We're going to enable new model.

70
02:26.430 --> 02:29.220 align:middle line:90%
And that allows us our
additional AAA commands,

71
02:29.220 --> 02:30.840 align:middle line:84%
including this guy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:29.220 --> 02:30.840 align:middle line:84%
including this guy.

72
02:30.840 --> 02:32.640 align:middle line:90%
Now, this one right
here doesn't really

73
02:32.640 --> 02:35.250 align:middle line:84%
apply to dot1x authentication.

74
02:35.250 --> 02:38.560 align:middle line:90%
But it does apply if we want to
remotely connect to this box.

75
02:38.560 --> 02:41.660 align:middle line:90%
So I'm creating a default
method list for logins.

76
02:41.660 --> 02:45.090 align:middle line:90%
This says aaa authentication
for any login--

77
02:45.090 --> 02:49.080 align:middle line:90%
like, for example, on the vty
lines, through Telnet, or SSH.

78
02:49.080 --> 02:51.975 align:middle line:90%
We want the default method
to be the local database.

79
02:51.975 --> 02:52.850 align:middle line:84%
That's what this say.

80
02:52.850 --> 02:54.978 align:middle line:90%
And the local database
has this one user account,

81
02:54.978 --> 02:56.520 align:middle line:90%
at least, because
we just created it.

82
02:56.520 --> 02:58.830 align:middle line:90%
Or we will when we
apply these configs.

83
02:58.830 --> 03:01.860 align:middle line:90%
So that basically says that when
we connect via the vty lines,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:58.830 --> 03:01.860 align:middle line:90%
So that basically says that when
we connect via the vty lines,

84
03:01.860 --> 03:05.130 align:middle line:90%
we can log in as user admin,
and we'll have King Kong rights,

85
03:05.130 --> 03:06.520 align:middle line:84%
assuming we know the password.

86
03:06.520 --> 03:09.170 align:middle line:90%
Next, let's take a look
at the default method

87
03:09.170 --> 03:12.540 align:middle line:90%
list we're going to use
for dot1x authentication.

88
03:12.540 --> 03:14.520 align:middle line:90%
So at some point coming
up in the next video,

89
03:14.520 --> 03:18.840 align:middle line:90%
we'll apply dot1x authentication
and enforce it on the ports,

90
03:18.840 --> 03:21.640 align:middle line:90%
like Fast Ethernet 0/1
and 2 and so forth.

91
03:21.640 --> 03:23.940 align:middle line:90%
And what line 7 says is
that the default method

92
03:23.940 --> 03:28.140 align:middle line:90%
for dot1x authentication is
to use a RADIUS server or one

93
03:28.140 --> 03:29.790 align:middle line:84%
from a group of RADIUS servers.

94
03:29.790 --> 03:32.970 align:middle line:90%
If you just have one, it's still
going to be the same syntax.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.790 --> 03:32.970 align:middle line:90%
If you just have one, it's still
going to be the same syntax.

95
03:32.970 --> 03:35.970 align:middle line:90%
This says that the authorization
for network access, the default

96
03:35.970 --> 03:39.660 align:middle line:90%
method, is going to be using
a RADIUS server once again.

97
03:39.660 --> 03:43.190 align:middle line:90%
And our RADIUS server is the
Identity Services Engine.

98
03:43.190 --> 03:44.760 align:middle line:90%
And we've also
enabled accounting

99
03:44.760 --> 03:46.690 align:middle line:84%
using that same RADIUS server.

100
03:46.690 --> 03:47.190 align:middle line:84%
All right.

101
03:47.190 --> 03:49.650 align:middle line:90%
So the next problem is if we're
telling these method lists,

102
03:49.650 --> 03:52.260 align:middle line:90%
these default method
lists, to use a AAA server,

103
03:52.260 --> 03:55.110 align:middle line:90%
we should create at least
one AAA server, which

104
03:55.110 --> 03:56.550 align:middle line:84%
is going to be our ISE server.

105
03:56.550 --> 03:57.540 align:middle line:84%
Let's do that next.

106
03:57.540 --> 04:00.080 align:middle line:90%
So that looks like this from
the configuration perspective.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:57.540 --> 04:00.080 align:middle line:90%
So that looks like this from
the configuration perspective.

107
04:00.080 --> 04:03.240 align:middle line:90%
So here is radius server
Our-ISE, just a name.

108
04:03.240 --> 04:04.800 align:middle line:90%
And then we'd
specify the address

109
04:04.800 --> 04:07.860 align:middle line:90%
for that server, which
is 192.168.1.105.

110
04:07.860 --> 04:10.290 align:middle line:90%
And if you don't want
to use the default ports

111
04:10.290 --> 04:12.840 align:middle line:90%
or you want to be sure what the
ports are for authentication

112
04:12.840 --> 04:15.480 align:middle line:90%
and accounting, you can go ahead
and specify them right here.

113
04:15.480 --> 04:18.060 align:middle line:84%
So I specified 1812 and 1813.

114
04:18.060 --> 04:19.410 align:middle line:84%
And then we specify the key.

115
04:19.410 --> 04:21.720 align:middle line:90%
I'm using this key
for the RADIUS key.

116
04:21.720 --> 04:24.180 align:middle line:90%
And I'm also specifying
an automate-tester.

117
04:24.180 --> 04:26.940 align:middle line:90%
Now, this username doesn't
have to really exist.

118
04:26.940 --> 04:29.910 align:middle line:90%
But this allows this
device, the switch,

119
04:29.910 --> 04:34.020 align:middle line:90%
as a network access device, to
go ahead and probe periodically
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:29.910 --> 04:34.020 align:middle line:90%
as a network access device, to
go ahead and probe periodically

120
04:34.020 --> 04:37.210 align:middle line:90%
to the server just to verify
the server is alive, awake,

121
04:37.210 --> 04:37.710 align:middle line:84%
and well.

122
04:37.710 --> 04:39.570 align:middle line:90%
Now, even if that
user doesn't exist,

123
04:39.570 --> 04:41.250 align:middle line:90%
we can still get a
negative message back

124
04:41.250 --> 04:44.290 align:middle line:90%
from that server, which implies
that ISE is still up, alive,

125
04:44.290 --> 04:44.790 align:middle line:84%
and well.

126
04:44.790 --> 04:47.940 align:middle line:90%
So this is an example of
creating one RADIUS server.

127
04:47.940 --> 04:49.770 align:middle line:90%
And if you add multiple
RADIUS servers,

128
04:49.770 --> 04:51.570 align:middle line:90%
you could tuck them
all into a group.

129
04:51.570 --> 04:53.112 align:middle line:90%
And that's what I've
done right here,

130
04:53.112 --> 04:55.860 align:middle line:90%
aaa group server radius, and
gave it the name of Our-Group.

131
04:55.860 --> 04:58.500 align:middle line:90%
And then I tucked inside
of it this RADIUS server

132
04:58.500 --> 05:02.690 align:middle line:90%
called Our-ISE as a nested
element inside this group.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
04:58.500 --> 05:02.690 align:middle line:90%
called Our-ISE as a nested
element inside this group.

133
05:02.690 --> 05:05.200 align:middle line:90%
Now, one of the challenges is
that if the RADIUS server is

134
05:05.200 --> 05:07.930 align:middle line:90%
no longer online, it's not
reachable for some reason,

135
05:07.930 --> 05:09.230 align:middle line:84%
we want to be aware of that.

136
05:09.230 --> 05:12.130 align:middle line:90%
And so we can set the timers
for how often should it check

137
05:12.130 --> 05:14.800 align:middle line:90%
and how many times should
it check before it gives up

138
05:14.800 --> 05:15.490 align:middle line:84%
on that server.

139
05:15.490 --> 05:18.680 align:middle line:90%
And that's what rows 21
and 22 are all about.

140
05:18.680 --> 05:22.300 align:middle line:90%
Row 23 is aaa server
radius dynamic-author.

141
05:22.300 --> 05:26.537 align:middle line:90%
And what this is about is
change of authorization.

142
05:26.537 --> 05:28.120 align:middle line:90%
If there's a change
that happens later

143
05:28.120 --> 05:30.060 align:middle line:90%
on regarding the user
or some other account,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:28.120 --> 05:30.060 align:middle line:90%
on regarding the user
or some other account,

144
05:30.060 --> 05:33.270 align:middle line:90%
line 23 allows the switch
to implement that COA,

145
05:33.270 --> 05:36.340 align:middle line:90%
the Change Of Authorization,
should the need arise.

146
05:36.340 --> 05:38.530 align:middle line:90%
And as part of that,
we specify the client--

147
05:38.530 --> 05:40.660 align:middle line:90%
this is the actual
switch's IP address--

148
05:40.660 --> 05:42.990 align:middle line:90%
and the server key
as part of the COA

149
05:42.990 --> 05:45.380 align:middle line:90%
or the dynamic authorization
that we've just set up.

150
05:45.380 --> 05:45.880 align:middle line:84%
All right.

151
05:45.880 --> 05:49.900 align:middle line:90%
Now, this command right here,
ip radius source-interface,

152
05:49.900 --> 05:51.010 align:middle line:84%
not required.

153
05:51.010 --> 05:53.380 align:middle line:90%
And here's why the ip radius
source-interface option is

154
05:53.380 --> 05:54.320 align:middle line:84%
helpful.

155
05:54.320 --> 05:57.600 align:middle line:90%
We may want to source this
traffic, these RADIUS requests,

156
05:57.600 --> 05:59.020 align:middle line:84%
from a loopback address.

157
05:59.020 --> 06:01.580 align:middle line:90%
And that way, if we lose
a single physical address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
05:59.020 --> 06:01.580 align:middle line:90%
And that way, if we lose
a single physical address

158
06:01.580 --> 06:04.708 align:middle line:90%
but we still have path between
ourselves and the ISE server,

159
06:04.708 --> 06:05.750 align:middle line:84%
we can still communicate.

160
06:05.750 --> 06:08.050 align:middle line:90%
But we don't want the
IP address that we're

161
06:08.050 --> 06:11.750 align:middle line:90%
sending from to change based on
an interface going up or down.

162
06:11.750 --> 06:14.860 align:middle line:90%
So whatever IP address we
used on the ISE server,

163
06:14.860 --> 06:17.440 align:middle line:90%
we'd want to specify that
interface with that IP address

164
06:17.440 --> 06:20.140 align:middle line:90%
as the source interface
for the RADIUS requests.

165
06:20.140 --> 06:22.870 align:middle line:90%
Lines 30 and 31 allow
us to send and receive

166
06:22.870 --> 06:26.050 align:middle line:90%
vendor-specific attributes
between the ISE server

167
06:26.050 --> 06:28.540 align:middle line:90%
and this network access
device, this switch.

168
06:28.540 --> 06:32.530 align:middle line:90%
And this global config command
of dot1x system-auth-control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:28.540 --> 06:32.530 align:middle line:90%
And this global config command
of dot1x system-auth-control

169
06:32.530 --> 06:37.390 align:middle line:90%
allows the switch to be able
to do 802.1X authentication

170
06:37.390 --> 06:40.480 align:middle line:90%
assuming the details for the
authentication are implemented

171
06:40.480 --> 06:42.250 align:middle line:84%
at the interface, as well.

172
06:42.250 --> 06:44.470 align:middle line:90%
And row 34 here,
ip device tracking,

173
06:44.470 --> 06:47.450 align:middle line:90%
that tells the switch, go ahead
and track the MAC address.

174
06:47.450 --> 06:51.250 align:middle line:90%
For example, let's say somebody
authenticated on port fa0/1.

175
06:51.250 --> 06:52.430 align:middle line:84%
Life is good.

176
06:52.430 --> 06:55.390 align:middle line:90%
And there's a downloadable ACL
associated with that device.

177
06:55.390 --> 06:58.870 align:middle line:90%
IP device tracking periodically
will use ARC messages just

178
06:58.870 --> 07:02.650 align:middle line:90%
to verify that that address
that is in use by that device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
06:58.870 --> 07:02.650 align:middle line:90%
to verify that that address
that is in use by that device

179
07:02.650 --> 07:05.770 align:middle line:90%
is still present and
responding and is still there.

180
07:05.770 --> 07:09.390 align:middle line:90%
And that is the configuration
or global config.

181
07:09.390 --> 07:12.970 align:middle line:90%
So just to verify all of
that, if I took all of that

182
07:12.970 --> 07:15.550 align:middle line:90%
up to that point and
just right clicked--

183
07:15.550 --> 07:18.750 align:middle line:90%
go ahead and copy, and
let's go paste that in.

184
07:18.750 --> 07:20.195 align:middle line:84%
So we'll right click.

185
07:20.195 --> 07:21.070 align:middle line:84%
We'll click on Paste.

186
07:21.070 --> 07:22.810 align:middle line:90%
I'll verify I have
a config t there.

187
07:22.810 --> 07:23.500 align:middle line:84%
Fantastic.

188
07:23.500 --> 07:25.810 align:middle line:84%
And here we go.

189
07:25.810 --> 07:28.330 align:middle line:90%
Now, in addition to the
global configuration commands

190
07:28.330 --> 07:31.540 align:middle line:90%
regarding AAA and dot1x, we
also need to do some special
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
07:28.330 --> 07:31.540 align:middle line:90%
regarding AAA and dot1x, we
also need to do some special

191
07:31.540 --> 07:34.630 align:middle line:90%
commands for the interfaces
where we want 802.1x

192
07:34.630 --> 07:36.070 align:middle line:84%
authentication to happen.

193
07:36.070 --> 07:38.653 align:middle line:90%
So to do that, we'll take a look
at those commands in the very

194
07:38.653 --> 07:41.350 align:middle line:90%
next video followed
up by verification

195
07:41.350 --> 07:43.720 align:middle line:90%
that the global configs,
the interface configs,

196
07:43.720 --> 07:45.230 align:middle line:84%
are all working as a whole.

197
07:45.230 --> 07:47.488 align:middle line:90%
And we'll look at that
at the CLI of the switch.

198
07:47.488 --> 07:49.030 align:middle line:90%
We'll look at it
from the perspective

199
07:49.030 --> 07:50.740 align:middle line:84%
of the client, the supplicant.

200
07:50.740 --> 07:52.990 align:middle line:90%
And we'll say take a look
at it from the perspective

201
07:52.990 --> 07:55.480 align:middle line:90%
of the authentication server,
the ISE device itself.

202
07:55.480 --> 07:56.890 align:middle line:90%
So we'll continue
this discussion

203
07:56.890 --> 07:59.140 align:middle line:90%
about the interface
configs in the next video.

204
07:59.140 --> 08:01.780 align:middle line:90%
Meanwhile, I hope this has
been informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
07:59.140 --> 08:01.780 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

205
08:01.780 --> 08:04.970 align:middle line:90%
And I'd like to thank
you for viewing.