WEBVTT

1
00:00.000 --> 00:02.130 align:middle line:84%


2
00:02.130 --> 00:05.438 align:middle line:90%
With our identity services
engine configured for 802.1x,

3
00:05.438 --> 00:07.230 align:middle line:90%
which we did in our
previous set of videos.

4
00:07.230 --> 00:09.900 align:middle line:90%
And more recently, configuring
the network access device,

5
00:09.900 --> 00:12.090 align:middle line:84%
the switch, for 802.1x.

6
00:12.090 --> 00:14.010 align:middle line:90%
It's now time to take
a look at some commands

7
00:14.010 --> 00:16.530 align:middle line:90%
that we can do at the
client, the supplicant,

8
00:16.530 --> 00:18.900 align:middle line:90%
at the authenticator, which
is the switch, and also

9
00:18.900 --> 00:20.820 align:middle line:90%
on the ISE server, the
authentication server,

10
00:20.820 --> 00:23.400 align:middle line:90%
just to verify that
it's all working.

11
00:23.400 --> 00:25.660 align:middle line:90%
So let's start
off at the switch.

12
00:25.660 --> 00:29.250 align:middle line:90%
And so he's periodically
trying on Fa0/1.

13
00:29.250 --> 00:30.520 align:middle line:84%
It's not going to end well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.250 --> 00:30.520 align:middle line:84%
It's not going to end well.

14
00:30.520 --> 00:32.189 align:middle line:84%
So .1x is going to time out.

15
00:32.189 --> 00:33.930 align:middle line:90%
Then Mac authentication
bypass is

16
00:33.930 --> 00:36.570 align:middle line:90%
going to time out, because the
ISE server isn't supporting it.

17
00:36.570 --> 00:39.150 align:middle line:90%
And once he's done,
I'm exhausted.

18
00:39.150 --> 00:41.610 align:middle line:90%
I tried all my methods
and authorization failed.

19
00:41.610 --> 00:43.500 align:middle line:90%
So from the client's
perspective,

20
00:43.500 --> 00:45.900 align:middle line:84%
it looks something like this.

21
00:45.900 --> 00:51.150 align:middle line:90%
Now, as a quick tip, because
we have the authentication open

22
00:51.150 --> 00:52.322 align:middle line:84%
over on the switch--

23
00:52.322 --> 00:54.405 align:middle line:90%
and let's take a look real
quick at the interface.

24
00:54.405 --> 00:58.740 align:middle line:90%
Do a show run for
interface fa 0/1.

25
00:58.740 --> 01:00.490 align:middle line:90%
Because we have this
command right here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.740 --> 01:00.490 align:middle line:90%
Because we have this
command right here,

26
01:00.490 --> 01:03.420 align:middle line:90%
if we turn off
802.1x at the client,

27
01:03.420 --> 01:05.820 align:middle line:90%
we're still going to get in
because he's not trying to do

28
01:05.820 --> 01:07.740 align:middle line:84%
802.1x.

29
01:07.740 --> 01:09.240 align:middle line:90%
Because of this
command, right here.

30
01:09.240 --> 01:12.180 align:middle line:90%
And we can verify that
by going to client.

31
01:12.180 --> 01:14.770 align:middle line:90%
And I'm going to right-click
on that Ethernet adapter,

32
01:14.770 --> 01:16.110 align:middle line:84%
go to properties.

33
01:16.110 --> 01:20.330 align:middle line:90%
And for authentication, I'm
going to say don't enable IEEE

34
01:20.330 --> 01:21.920 align:middle line:84%
802.1x authentication.

35
01:21.920 --> 01:23.790 align:middle line:84%
Click on OK.

36
01:23.790 --> 01:24.555 align:middle line:84%
Check it out.

37
01:24.555 --> 01:26.970 align:middle line:84%
It's still trying to do 802.1x.

38
01:26.970 --> 01:31.660 align:middle line:90%
But if we do a show
authentication, session,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:26.970 --> 01:31.660 align:middle line:90%
But if we do a show
authentication, session,

39
01:31.660 --> 01:35.400 align:middle line:90%
and then we specify for
interface fast ethernet 0/1,

40
01:35.400 --> 01:37.770 align:middle line:90%
even though it failed the
802.1x because we have

41
01:37.770 --> 01:40.160 align:middle line:90%
the authentication open
command-- check this out.

42
01:40.160 --> 01:42.600 align:middle line:84%
It says the authz failed.

43
01:42.600 --> 01:44.310 align:middle line:84%
It shows the mode.

44
01:44.310 --> 01:48.570 align:middle line:90%
And if you do a show interface
status, it's still in VLAN 999,

45
01:48.570 --> 01:50.435 align:middle line:90%
but this guy has
access in VLAN--

46
01:50.435 --> 01:52.560 align:middle line:90%
Now, there's not a whole
bunch of places he can go.

47
01:52.560 --> 01:55.530 align:middle line:90%
But we can also specify
what we want the default

48
01:55.530 --> 01:58.230 align:middle line:90%
VLAN to be in the event
that the authentication

49
01:58.230 --> 02:01.010 align:middle line:84%
server is no longer available.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:58.230 --> 02:01.010 align:middle line:84%
server is no longer available.

50
02:01.010 --> 02:04.730 align:middle line:90%
So that could be a benefit for
rolling out or testing 802.1x

51
02:04.730 --> 02:06.596 align:middle line:90%
that we don't just to
cut somebody off right

52
02:06.596 --> 02:09.080 align:middle line:90%
at the switch port when
we didn't intend to just

53
02:09.080 --> 02:10.330 align:middle line:84%
because we missed a parameter.

54
02:10.330 --> 02:12.580 align:middle line:90%
So it's a great way of
doing stage testing.

55
02:12.580 --> 02:14.580 align:middle line:90%
Just turn out the
authenticator, and that client

56
02:14.580 --> 02:17.910 align:middle line:90%
will still have access to
whatever the VLAN is associated

57
02:17.910 --> 02:19.410 align:middle line:84%
with that access port.

58
02:19.410 --> 02:21.280 align:middle line:90%
All right, so let's go
back to this client.

59
02:21.280 --> 02:22.890 align:middle line:84%
And we'll go to Properties.

60
02:22.890 --> 02:25.870 align:middle line:90%
And we'll go to Authentication,
say we do want to authenticate.

61
02:25.870 --> 02:30.067 align:middle line:90%
Here we're using
Microsoft Protected EAP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:25.870 --> 02:30.067 align:middle line:90%
Here we're using
Microsoft Protected EAP.

62
02:30.067 --> 02:32.150 align:middle line:90%
And here, I'm not verifying
the server's identity,

63
02:32.150 --> 02:33.787 align:middle line:84%
the ISE server's identity.

64
02:33.787 --> 02:35.870 align:middle line:90%
But if you wanted to verify
the server's identity,

65
02:35.870 --> 02:38.750 align:middle line:90%
make sure that you have
a trusted CA that's

66
02:38.750 --> 02:41.150 align:middle line:90%
been imported that can
validate the certificate that's

67
02:41.150 --> 02:41.635 align:middle line:84%
being presented.

68
02:41.635 --> 02:43.520 align:middle line:90%
I'm just going to go
ahead and turn that off.

69
02:43.520 --> 02:45.437 align:middle line:90%
And then down below, the
authentication method

70
02:45.437 --> 02:47.643 align:middle line:84%
is using EAP MSCHAP version 2.

71
02:47.643 --> 02:49.310 align:middle line:90%
And I'll click on
Cancel because I'm not

72
02:49.310 --> 02:50.480 align:middle line:84%
making any changes there.

73
02:50.480 --> 02:53.150 align:middle line:90%
And under additional
settings, let's go ahead

74
02:53.150 --> 02:56.690 align:middle line:90%
and under User Authentication,
we'll save credentials,

75
02:56.690 --> 03:00.830 align:middle line:90%
and we'll put in the information
for Bob and Bob's password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:56.690 --> 03:00.830 align:middle line:90%
and we'll put in the information
for Bob and Bob's password.

76
03:00.830 --> 03:02.730 align:middle line:84%
And then we'll click on OK.

77
03:02.730 --> 03:04.700 align:middle line:84%
And OK.

78
03:04.700 --> 03:06.770 align:middle line:90%
And that should trigger
reauthentication

79
03:06.770 --> 03:09.452 align:middle line:90%
in the background, which
is happening right there.

80
03:09.452 --> 03:10.160 align:middle line:84%
And look at that.

81
03:10.160 --> 03:12.370 align:middle line:84%
VLAN 80 was assigned.

82
03:12.370 --> 03:14.210 align:middle line:90%
And there's also
a downloadable ACL

83
03:14.210 --> 03:17.430 align:middle line:90%
as I recall with that policy
from our previous videos.

84
03:17.430 --> 03:19.670 align:middle line:90%
We could verify that with
a couple up arrow keys.

85
03:19.670 --> 03:21.380 align:middle line:84%
Show authentication sessions.

86
03:21.380 --> 03:23.500 align:middle line:84%
Interface fa0/1.

87
03:23.500 --> 03:25.340 align:middle line:84%
And there's Bob's MAC address.

88
03:25.340 --> 03:27.710 align:middle line:90%
There is his IP address
that he got via DHCP.

89
03:27.710 --> 03:28.880 align:middle line:84%
There's his name.

90
03:28.880 --> 03:30.440 align:middle line:84%
There's our success message.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.880 --> 03:30.440 align:middle line:84%
There's our success message.

91
03:30.440 --> 03:32.660 align:middle line:84%
There's our downloadable ACL.

92
03:32.660 --> 03:36.140 align:middle line:90%
If we wanted to see that, we
do a show access list and that

93
03:36.140 --> 03:38.420 align:middle line:84%
would show up right there.

94
03:38.420 --> 03:41.080 align:middle line:90%
And if we did a
show VLAN brief, it

95
03:41.080 --> 03:44.120 align:middle line:90%
should show us that interface
fa0/1 is assigned to VLAN 80.

96
03:44.120 --> 03:44.960 align:middle line:84%
Great.

97
03:44.960 --> 03:47.990 align:middle line:90%
And if we did a show interface
status, that's should show us

98
03:47.990 --> 03:49.520 align:middle line:90%
the same information,
right there.

99
03:49.520 --> 03:52.730 align:middle line:90%
So that's from the perspective
of the switch on our Windows

100
03:52.730 --> 03:53.288 align:middle line:84%
client.

101
03:53.288 --> 03:55.580 align:middle line:90%
It should show us that we
have an authenticated session

102
03:55.580 --> 03:58.170 align:middle line:90%
or connectivity with
the authentication set.

103
03:58.170 --> 04:01.500 align:middle line:90%
And if we go to ISE, we can
verify it from there as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.170 --> 04:01.500 align:middle line:90%
And if we go to ISE, we can
verify it from there as well.

104
04:01.500 --> 04:04.130 align:middle line:90%
So here on ISE, if we want
to see our RADIUS logs,

105
04:04.130 --> 04:08.690 align:middle line:90%
we can hover over operations,
click on Live Logs,

106
04:08.690 --> 04:10.190 align:middle line:84%
and then take a look.

107
04:10.190 --> 04:12.620 align:middle line:90%
So the authentication
came up as Bob.

108
04:12.620 --> 04:14.720 align:middle line:90%
This blue icon with
an eye represents

109
04:14.720 --> 04:16.850 align:middle line:90%
that we currently have a
session, that he is there.

110
04:16.850 --> 04:20.149 align:middle line:90%
And here is the detailed
report for the authentication.

111
04:20.149 --> 04:22.220 align:middle line:90%
So the
Our-Site1-Switch-Policy-Set is

112
04:22.220 --> 04:23.050 align:middle line:84%
the policy set.

113
04:23.050 --> 04:24.800 align:middle line:90%
And then we have the
authentication policy

114
04:24.800 --> 04:27.250 align:middle line:90%
and the authorization
policy as part of that.

115
04:27.250 --> 04:30.500 align:middle line:90%
And because Bob is
a member of ISE OPS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:27.250 --> 04:30.500 align:middle line:90%
And because Bob is
a member of ISE OPS,

116
04:30.500 --> 04:32.690 align:middle line:90%
he was delivered the
authorization profile

117
04:32.690 --> 04:35.120 align:middle line:90%
that included the VLAN
assignment and also

118
04:35.120 --> 04:37.100 align:middle line:84%
the downloadable ACL.

119
04:37.100 --> 04:39.830 align:middle line:90%
And one of the biggest
benefits of using the log files

120
04:39.830 --> 04:42.175 align:middle line:90%
is that it's going to tell
you in detail about what

121
04:42.175 --> 04:43.550 align:middle line:90%
policy was hit
for authentication

122
04:43.550 --> 04:44.960 align:middle line:84%
and authorization.

123
04:44.960 --> 04:47.510 align:middle line:90%
And if it hit the wrong
policy, then start diving there

124
04:47.510 --> 04:49.340 align:middle line:84%
and say, OK, why did that miss?

125
04:49.340 --> 04:50.840 align:middle line:84%
Why wasn't this matched?

126
04:50.840 --> 04:52.400 align:middle line:90%
Correct it, and
then move forward.

127
04:52.400 --> 04:54.650 align:middle line:90%
And then once you have it
all dialed in and saved,

128
04:54.650 --> 04:56.870 align:middle line:90%
you can replicate that
and start rolling it out

129
04:56.870 --> 05:00.090 align:middle line:90%
to more and more devices once
you know that it's working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:56.870 --> 05:00.090 align:middle line:90%
to more and more devices once
you know that it's working.

130
05:00.090 --> 05:03.380 align:middle line:90%
So in this video, we've had the
opportunity to test our 802.1x

131
05:03.380 --> 05:06.200 align:middle line:90%
authentication by looking at
details in the logs for the ISE

132
05:06.200 --> 05:09.710 align:middle line:90%
server, by looking at the actual
supplicant, the client itself,

133
05:09.710 --> 05:12.200 align:middle line:90%
and also the authenticator,
which is, in our case,

134
05:12.200 --> 05:16.380 align:middle line:90%
our 3560 switch that's running
802.1x authentication on its

135
05:16.380 --> 05:16.880 align:middle line:84%
ports.

136
05:16.880 --> 05:17.988 align:middle line:84%
So thanks for joining me.

137
05:17.988 --> 05:19.280 align:middle line:84%
I'll see you in the next video.

138
05:19.280 --> 05:21.860 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

139
05:21.860 --> 05:25.090 align:middle line:90%
and I'd like to thank
you for viewing.