WEBVTT

1
00:00.000 --> 00:02.307 align:middle line:84%


2
00:02.307 --> 00:04.890 align:middle line:90%
All right, so we're halfway done
with the switch configuration

3
00:04.890 --> 00:06.390 align:middle line:84%
for 802.1x.

4
00:06.390 --> 00:08.520 align:middle line:90%
Our next step is on
that same switch.

5
00:08.520 --> 00:10.440 align:middle line:90%
We'll take a look at
the interface or port

6
00:10.440 --> 00:12.730 align:middle line:90%
configurations that
allow the authentication

7
00:12.730 --> 00:15.760 align:middle line:90%
and authorization to
happen on the switch.

8
00:15.760 --> 00:17.370 align:middle line:90%
And so here are
those commands we're

9
00:17.370 --> 00:18.630 align:middle line:84%
going into configuration mode.

10
00:18.630 --> 00:20.588 align:middle line:90%
And I just want to make
sure that on the switch

11
00:20.588 --> 00:22.740 align:middle line:90%
I've got these VLAN
that they exist

12
00:22.740 --> 00:26.640 align:middle line:90%
and we can use VLAN 999 as a
dead end, where we can just

13
00:26.640 --> 00:28.550 align:middle line:84%
put all unused ports there.

14
00:28.550 --> 00:31.050 align:middle line:90%
And then when we bring up other
ports we get them authorized
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.550 --> 00:31.050 align:middle line:90%
And then when we bring up other
ports we get them authorized

15
00:31.050 --> 00:32.549 align:middle line:84%
with 802.1x.

16
00:32.549 --> 00:35.640 align:middle line:90%
We can have the 802.1x
authorization placed them

17
00:35.640 --> 00:38.520 align:middle line:90%
in the VLAN of our choice based
on the authorization profile

18
00:38.520 --> 00:39.380 align:middle line:84%
being used.

19
00:39.380 --> 00:42.480 align:middle line:90%
So on this switch I've got fa
0/1-8 then we are all going

20
00:42.480 --> 00:45.220 align:middle line:90%
to configure the
same as access ports.

21
00:45.220 --> 00:47.640 align:middle line:90%
We can do that with this
command, switchport host.

22
00:47.640 --> 00:49.810 align:middle line:90%
That does a few things
for us, including

23
00:49.810 --> 00:51.580 align:middle line:84%
that's why it's an access port.

24
00:51.580 --> 00:54.350 align:middle line:90%
And it also enables port
fast at the same times.

25
00:54.350 --> 00:56.370 align:middle line:90%
So it's a little shortcut
there, and then we'll

26
00:56.370 --> 00:59.750 align:middle line:90%
assign all those
ports to VLAN 999.

27
00:59.750 --> 01:02.810 align:middle line:90%
So basically, unused ports
even if they're up they're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.750 --> 01:02.810 align:middle line:90%
So basically, unused ports
even if they're up they're

28
01:02.810 --> 01:04.620 align:middle line:84%
going to go basically nowhere.

29
01:04.620 --> 01:06.480 align:middle line:90%
Then we're going
to specify lines 51

30
01:06.480 --> 01:08.910 align:middle line:90%
and 52 the
authentication priority

31
01:08.910 --> 01:10.650 align:middle line:84%
and the authentication order.

32
01:10.650 --> 01:12.430 align:middle line:90%
We're going to use
.1x to begin with.

33
01:12.430 --> 01:16.740 align:middle line:90%
But if .1x fails, we want to
fall over to mac authentication

34
01:16.740 --> 01:20.160 align:middle line:90%
bypass that'll be for devices
like printers, or cameras,

35
01:20.160 --> 01:22.620 align:middle line:90%
or other devices that
don't have a supplicant,

36
01:22.620 --> 01:25.380 align:middle line:90%
but we still want to get their
mac address in the system

37
01:25.380 --> 01:28.140 align:middle line:90%
and then authenticate them
based on a specific mac address,

38
01:28.140 --> 01:31.800 align:middle line:90%
but we want to try .1x first and
in the event of a failure like
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.140 --> 01:31.800 align:middle line:90%
but we want to try .1x first and
in the event of a failure like

39
01:31.800 --> 01:32.760 align:middle line:84%
of .1x.

40
01:32.760 --> 01:36.025 align:middle line:90%
We want the action to be
next method so it'll do .1x.

41
01:36.025 --> 01:38.400 align:middle line:90%
If the client doesn't have a
supplicant and can't perform

42
01:38.400 --> 01:42.030 align:middle line:90%
.1x, it'll time out and then
the next authentication method

43
01:42.030 --> 01:45.090 align:middle line:90%
would be to try Mac
authentication bypass.

44
01:45.090 --> 01:47.100 align:middle line:90%
Row 54 says, well,
if the server's

45
01:47.100 --> 01:50.130 align:middle line:90%
dead we can't reach a radius
server what do you want to do?

46
01:50.130 --> 01:53.640 align:middle line:90%
And the action is authorized
VLAN 10 if the server cannot be

47
01:53.640 --> 01:54.280 align:middle line:84%
reached.

48
01:54.280 --> 01:56.790 align:middle line:90%
Though based on our environment
we may want that be VLAN 10

49
01:56.790 --> 02:00.420 align:middle line:90%
or maybe we leave it in VLAN
999 it just depends on what you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:56.790 --> 02:00.420 align:middle line:90%
or maybe we leave it in VLAN
999 it just depends on what you

50
02:00.420 --> 02:03.660 align:middle line:90%
want to have happen if the
AAA server cannot be reached.

51
02:03.660 --> 02:05.585 align:middle line:90%
And if the triple-a
server has gone away,

52
02:05.585 --> 02:07.710 align:middle line:90%
unreachable for a while,
and it comes back now it's

53
02:07.710 --> 02:09.330 align:middle line:90%
reachable, what
do you want to do?

54
02:09.330 --> 02:12.577 align:middle line:90%
Line 55 says, we want to
go ahead and re initialize.

55
02:12.577 --> 02:14.160 align:middle line:90%
So now that the
server is back on line

56
02:14.160 --> 02:16.285 align:middle line:90%
we're going to go through
the authorization process

57
02:16.285 --> 02:18.720 align:middle line:90%
formally with that
AAA server to verify

58
02:18.720 --> 02:20.685 align:middle line:90%
we have the correct
people online

59
02:20.685 --> 02:23.310 align:middle line:90%
as far as the authentication and
also the correct authorization

60
02:23.310 --> 02:24.990 align:middle line:84%
profiles are applied.

61
02:24.990 --> 02:27.480 align:middle line:90%
And row 56
authentication host-mode

62
02:27.480 --> 02:29.880 align:middle line:90%
depends on how you
want it to behave.

63
02:29.880 --> 02:32.790 align:middle line:90%
Currently I have a set
for a multi-domain.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:29.880 --> 02:32.790 align:middle line:90%
Currently I have a set
for a multi-domain.

64
02:32.790 --> 02:34.180 align:middle line:84%
Here's what that means.

65
02:34.180 --> 02:36.870 align:middle line:90%
It means, that if we have a
voice VLAN and a data VLAN.

66
02:36.870 --> 02:38.910 align:middle line:90%
The devices on
each of those VLANs

67
02:38.910 --> 02:41.520 align:middle line:90%
have to authenticate and be
authorized before they're going

68
02:41.520 --> 02:43.020 align:middle line:84%
to get access to the network.

69
02:43.020 --> 02:45.850 align:middle line:90%
Then think of multi-domain
like a voice domain, or a voice

70
02:45.850 --> 02:48.390 align:middle line:90%
VLAN, and a
traditional data VLAN.

71
02:48.390 --> 02:50.640 align:middle line:90%
Other options would
be single host,

72
02:50.640 --> 02:53.130 align:middle line:90%
which would mean just one
device can get authorized.

73
02:53.130 --> 02:55.680 align:middle line:90%
We also have an option
for multi hosts, which

74
02:55.680 --> 02:57.730 align:middle line:90%
means after one device
authenticates and gets

75
02:57.730 --> 03:01.050 align:middle line:90%
authorized everybody else is
like a free ride getting in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:57.730 --> 03:01.050 align:middle line:90%
authorized everybody else is
like a free ride getting in

76
03:01.050 --> 03:02.130 align:middle line:84%
through that port.

77
03:02.130 --> 03:05.040 align:middle line:90%
And there's also an
option called multi-off,

78
03:05.040 --> 03:06.670 align:middle line:90%
which allows
everybody to get on,

79
03:06.670 --> 03:08.195 align:middle line:90%
but everybody has
to be authorized.

80
03:08.195 --> 03:09.820 align:middle line:90%
And that would include
your voice VLANs

81
03:09.820 --> 03:11.910 align:middle line:90%
and your data VLANs,
but every device

82
03:11.910 --> 03:13.690 align:middle line:84%
is going to be authenticated.

83
03:13.690 --> 03:15.870 align:middle line:90%
So our current setting
here multi-domain.

84
03:15.870 --> 03:17.230 align:middle line:84%
We can have voice and data.

85
03:17.230 --> 03:19.890 align:middle line:90%
There's just one
device per domain.

86
03:19.890 --> 03:22.860 align:middle line:90%
And if we have violations, what
do you want to switch to do?

87
03:22.860 --> 03:25.350 align:middle line:90%
And restrict simply
says send a log message

88
03:25.350 --> 03:28.890 align:middle line:90%
that we had some tried to get
in and block that additional mac

89
03:28.890 --> 03:31.020 align:middle line:90%
address from being
able to forward traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:28.890 --> 03:31.020 align:middle line:90%
address from being
able to forward traffic

90
03:31.020 --> 03:32.280 align:middle line:84%
into the switch.

91
03:32.280 --> 03:34.680 align:middle line:90%
And this command right
here, authentication open,

92
03:34.680 --> 03:37.170 align:middle line:90%
it could be a lifesaver and
it could also be devastating.

93
03:37.170 --> 03:40.470 align:middle line:90%
Basically, what this says is, if
someone gain access to the port

94
03:40.470 --> 03:43.770 align:middle line:90%
and they do not
have a supplicant,

95
03:43.770 --> 03:48.100 align:middle line:90%
so they can't do 802.1x
what do you want to do?

96
03:48.100 --> 03:50.880 align:middle line:90%
And the answer is once the
switch times out with its

97
03:50.880 --> 03:54.150 align:middle line:90%
802.1x and its mab
authentication it would then

98
03:54.150 --> 03:56.100 align:middle line:90%
say, well I guess I'll
just let it through.

99
03:56.100 --> 03:58.230 align:middle line:90%
Now the reason in
a lab environment

100
03:58.230 --> 04:00.180 align:middle line:90%
this could be very,
very helpful is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:58.230 --> 04:00.180 align:middle line:90%
this could be very,
very helpful is

101
04:00.180 --> 04:02.550 align:middle line:90%
that if you're rolling
out or doing some testing

102
04:02.550 --> 04:04.755 align:middle line:90%
you can have this as a
fallback in your config.

103
04:04.755 --> 04:07.380 align:middle line:90%
Make sure things is working and
once everything's dialed in you

104
04:07.380 --> 04:10.050 align:middle line:90%
could remove this and the
interface configs and then

105
04:10.050 --> 04:13.930 align:middle line:90%
require 802.1x authentication
before any access is given.

106
04:13.930 --> 04:16.110 align:middle line:90%
So this is just a great
one for allowing it up

107
04:16.110 --> 04:17.980 align:middle line:84%
and doing tests and practicing.

108
04:17.980 --> 04:19.680 align:middle line:90%
And then when you're
ready, take it out.

109
04:19.680 --> 04:22.440 align:middle line:90%
And the next command mab,
mac authentication bypass

110
04:22.440 --> 04:25.410 align:middle line:90%
is for those devices, which
don't have a supplicant

111
04:25.410 --> 04:27.210 align:middle line:90%
and yet we still want
to authenticate them

112
04:27.210 --> 04:28.560 align:middle line:84%
with mac authentication bypass.

113
04:28.560 --> 04:30.480 align:middle line:90%
So as part of our
identity story we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:28.560 --> 04:30.480 align:middle line:90%
So as part of our
identity story we

114
04:30.480 --> 04:34.170 align:middle line:90%
would include the mac address
of the devices like cameras,

115
04:34.170 --> 04:36.990 align:middle line:90%
and internet things devices
that we want to authenticate,

116
04:36.990 --> 04:39.480 align:middle line:90%
but they don't
support a supplicant.

117
04:39.480 --> 04:41.520 align:middle line:90%
Also in our policy
for authentication

118
04:41.520 --> 04:43.080 align:middle line:90%
and authorization,
we'd also want

119
04:43.080 --> 04:46.170 align:middle line:90%
to make sure that we're using
or trying mac authentication

120
04:46.170 --> 04:48.870 align:middle line:90%
bypass or one of our
authentication methods

121
04:48.870 --> 04:50.480 align:middle line:84%
if we want it to work as well.

122
04:50.480 --> 04:53.490 align:middle line:90%
And then line 60 simply
tells a switch on this port

123
04:53.490 --> 04:55.430 align:middle line:90%
that it should be
the authenticator.

124
04:55.430 --> 04:58.320 align:middle line:90%
So there's three
basic parts to 802.1x.

125
04:58.320 --> 05:00.660 align:middle line:90%
We have the client,
who is the supplicant.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:58.320 --> 05:00.660 align:middle line:90%
We have the client,
who is the supplicant.

126
05:00.660 --> 05:02.670 align:middle line:90%
We have the switch, the
network access device

127
05:02.670 --> 05:04.480 align:middle line:84%
acting as the authenticator.

128
05:04.480 --> 05:06.810 align:middle line:90%
And then we have the
authentication server,

129
05:06.810 --> 05:09.550 align:middle line:90%
which in our case is the
identity services engine.

130
05:09.550 --> 05:11.340 align:middle line:90%
I've also specified
a time out period

131
05:11.340 --> 05:13.830 align:middle line:90%
and you may want to
increase or decrease this

132
05:13.830 --> 05:17.370 align:middle line:90%
depending on how long you want
this device to wait before it

133
05:17.370 --> 05:21.750 align:middle line:90%
gives up on a client responding
to the authentication requests.

134
05:21.750 --> 05:24.870 align:middle line:90%
And the benefit of tweaking
this a little bit is if we use

135
05:24.870 --> 05:29.140 align:middle line:90%
the defaults it could take a
long time before .1x fails with

136
05:29.140 --> 05:32.520 align:middle line:90%
the default timers before it
ever tried mac authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:29.140 --> 05:32.520 align:middle line:90%
the default timers before it
ever tried mac authentication

137
05:32.520 --> 05:33.030 align:middle line:84%
bypass.

138
05:33.030 --> 05:34.770 align:middle line:90%
So if you want that
to happen faster,

139
05:34.770 --> 05:38.010 align:middle line:90%
you can tweak the timers on how
long it should take for the .1x

140
05:38.010 --> 05:38.910 align:middle line:84%
to happen.

141
05:38.910 --> 05:42.090 align:middle line:90%
And this command, authentication
port-control auto says,

142
05:42.090 --> 05:42.960 align:middle line:84%
let's do it.

143
05:42.960 --> 05:46.680 align:middle line:90%
Let's go ahead and implement
802.1x and control this port

144
05:46.680 --> 05:50.400 align:middle line:90%
based on whatever the identity
services engine says regarding

145
05:50.400 --> 05:51.810 align:middle line:84%
authorization profiles.

146
05:51.810 --> 05:55.020 align:middle line:90%
What VLAN, what downloadable
ACLs we should have,

147
05:55.020 --> 05:57.790 align:middle line:90%
what av pairs we should
send and so forth.

148
05:57.790 --> 05:59.760 align:middle line:90%
So let me take these
interface config commands

149
05:59.760 --> 06:01.380 align:middle line:84%
that we just went through.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:59.760 --> 06:01.380 align:middle line:84%
that we just went through.

150
06:01.380 --> 06:03.780 align:middle line:84%
I will copy those to my buffer.

151
06:03.780 --> 06:08.820 align:middle line:90%
Right click, copy, and let's
go to the switch and deploy it.

152
06:08.820 --> 06:10.800 align:middle line:90%
So here at the switch
we'll right click,

153
06:10.800 --> 06:14.190 align:middle line:90%
and we'll click on paste, and
I will paste all that goodness

154
06:14.190 --> 06:15.120 align:middle line:84%
in.

155
06:15.120 --> 06:18.900 align:middle line:90%
Now all of our ports if we do
a show interface status that'll

156
06:18.900 --> 06:20.420 align:middle line:84%
be a good indicator.

157
06:20.420 --> 06:24.652 align:middle line:90%
Is showing us that these
ports Fa0/1 through 8,

158
06:24.652 --> 06:25.860 align:middle line:84%
are all assigned to VLAN 999.

159
06:25.860 --> 06:30.330 align:middle line:90%
Looks like we have a connected
device to port Fa0/1, that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:25.860 --> 06:30.330 align:middle line:90%
Looks like we have a connected
device to port Fa0/1, that's

160
06:30.330 --> 06:31.860 align:middle line:84%
our client.

161
06:31.860 --> 06:33.360 align:middle line:90%
Looks like we have
the switch trying

162
06:33.360 --> 06:34.860 align:middle line:84%
to do the authentication.

163
06:34.860 --> 06:37.350 align:middle line:90%
Currently I don't have a
valid user name over there

164
06:37.350 --> 06:40.170 align:middle line:90%
at the client, though it's not
going to be too successful,

165
06:40.170 --> 06:43.110 align:middle line:90%
but it'll time out and it
should fail after the timeout

166
06:43.110 --> 06:44.500 align:middle line:84%
intervals pass.

167
06:44.500 --> 06:47.820 align:middle line:90%
And we can see here,
it failed on the dot1x.

168
06:47.820 --> 06:51.090 align:middle line:90%
It then started trying mab
and that fails probably

169
06:51.090 --> 06:54.640 align:middle line:90%
because the AAA server isn't
allowing that at the moment.

170
06:54.640 --> 06:56.880 align:middle line:90%
And then we have an
authorization fail message.

171
06:56.880 --> 06:59.490 align:middle line:90%
If we go back to the
client it should show here

172
06:59.490 --> 07:02.670 align:middle line:90%
on that interface authentication
failed that's expected.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

172
06:59.490 --> 07:02.670 align:middle line:90%
on that interface authentication
failed that's expected.

173
07:02.670 --> 07:04.200 align:middle line:90%
Now the other thing
we could do is

174
07:04.200 --> 07:05.880 align:middle line:90%
we could also look
at the log files

175
07:05.880 --> 07:07.680 align:middle line:90%
on the identity
services engine to take

176
07:07.680 --> 07:11.060 align:middle line:90%
a look at why it failed, what
did it match, and so forth.

177
07:11.060 --> 07:12.700 align:middle line:90%
So we'll do that
in the next video,

178
07:12.700 --> 07:16.117 align:middle line:90%
we'll take a look at verifying
our configuration on the switch

179
07:16.117 --> 07:17.700 align:middle line:90%
by taking a look at
the switch itself.

180
07:17.700 --> 07:19.680 align:middle line:90%
I've got some show commands
I'll share with you.

181
07:19.680 --> 07:22.263 align:middle line:90%
We'll take a look at the client
from the client's perspective,

182
07:22.263 --> 07:25.290 align:middle line:90%
and also the logs over on
the identity services engine.

183
07:25.290 --> 07:27.380 align:middle line:90%
All that coming up and
more in the next video.

184
07:27.380 --> 07:29.220 align:middle line:90%
So I'll see you there
in just a moment.

185
07:29.220 --> 07:31.740 align:middle line:90%
Meanwhile, I hope this has
been informative for you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
07:29.220 --> 07:31.740 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

186
07:31.740 --> 07:34.970 align:middle line:90%
and I'd like to thank
you for viewing.