WEBVTT

1
00:00.000 --> 00:00.180 align:middle line:84%


2
00:00.180 --> 00:01.740 align:middle line:90%
If we had some friends
come over to the house,

3
00:01.740 --> 00:03.450 align:middle line:90%
and they asked, hey, can
we get on your network?

4
00:03.450 --> 00:04.890 align:middle line:84%
We'd like to say, yeah, you bet.

5
00:04.890 --> 00:05.807 align:middle line:84%
We'd give them access.

6
00:05.807 --> 00:07.545 align:middle line:90%
However, in a
corporate environment,

7
00:07.545 --> 00:09.420 align:middle line:90%
if somebody wants to
just get on the network,

8
00:09.420 --> 00:11.958 align:middle line:84%
the default answer should be no.

9
00:11.958 --> 00:14.298 align:middle line:84%
[MUSIC PLAYING]

10
00:14.298 --> 00:16.640 align:middle line:84%


11
00:16.640 --> 00:19.160 align:middle line:90%
So in that light, one of the
big aspects of network security

12
00:19.160 --> 00:23.000 align:middle line:90%
design is access control,
access to the network.

13
00:23.000 --> 00:25.295 align:middle line:90%
And one popular way of
doing access control is with

14
00:25.295 --> 00:27.560 align:middle line:84%
something called 802.1x.

15
00:27.560 --> 00:29.900 align:middle line:90%
And it works
something like this.

16
00:29.900 --> 00:32.520 align:middle line:90%
The client who wants to
get onto the network--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.900 --> 00:32.520 align:middle line:90%
The client who wants to
get onto the network--

17
00:32.520 --> 00:35.417 align:middle line:90%
the switch port right here on
this switch is going to say,

18
00:35.417 --> 00:36.000 align:middle line:84%
you know what?

19
00:36.000 --> 00:37.640 align:middle line:90%
I'm really not
comfortable about allowing

20
00:37.640 --> 00:40.057 align:middle line:90%
a whole bunch of traffic in
here until I know who you are.

21
00:40.057 --> 00:42.560 align:middle line:90%
And so there's some software
running on this computer that's

22
00:42.560 --> 00:44.090 align:middle line:84%
referred to as a supplicant.

23
00:44.090 --> 00:45.810 align:middle line:90%
And with that
supplicant software,

24
00:45.810 --> 00:47.510 align:middle line:84%
it communicates with the switch.

25
00:47.510 --> 00:49.552 align:middle line:90%
And it communicates
information about that user--

26
00:49.552 --> 00:51.968 align:middle line:90%
about their username, their
password, or other credentials

27
00:51.968 --> 00:52.880 align:middle line:84%
that are required.

28
00:52.880 --> 00:55.208 align:middle line:90%
And the switch itself, if
we had to do that locally,

29
00:55.208 --> 00:57.500 align:middle line:90%
have all the credentials on
every single switch, that'd

30
00:57.500 --> 00:58.170 align:middle line:84%
be a nightmare.

31
00:58.170 --> 01:00.170 align:middle line:90%
So what we do is we have
centralized management.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:58.170 --> 01:00.170 align:middle line:90%
So what we do is we have
centralized management.

32
01:00.170 --> 01:02.010 align:middle line:84%
And we have a AAA server.

33
01:02.010 --> 01:04.849 align:middle line:90%
And often, that AAA server
will be supporting RADIUS.

34
01:04.849 --> 01:06.650 align:middle line:90%
And in Cisco, what
we would be using

35
01:06.650 --> 01:10.780 align:middle line:90%
is a device called ICE, the
Identity Services Engine,

36
01:10.780 --> 01:12.155 align:middle line:84%
as a AAA server.

37
01:12.155 --> 01:13.280 align:middle line:84%
So here's the play-by-play.

38
01:13.280 --> 01:15.660 align:middle line:90%
The client, who wants
access to the network.

39
01:15.660 --> 01:18.050 align:middle line:90%
The switch, acting
as an authenticator,

40
01:18.050 --> 01:19.340 align:middle line:84%
would say, who are you?

41
01:19.340 --> 01:21.950 align:middle line:90%
And using the software
on that computer,

42
01:21.950 --> 01:23.297 align:middle line:84%
it would communicate who it is.

43
01:23.297 --> 01:25.130 align:middle line:90%
Then the switch, acting
as an authenticator,

44
01:25.130 --> 01:27.590 align:middle line:90%
would make a little road
trip over to the ICE server

45
01:27.590 --> 01:30.950 align:middle line:90%
and say, hey, I just got
this request from so-and-so.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:27.590 --> 01:30.950 align:middle line:90%
and say, hey, I just got
this request from so-and-so.

46
01:30.950 --> 01:32.000 align:middle line:84%
What you think?

47
01:32.000 --> 01:33.500 align:middle line:90%
And then the ICE
server, where there

48
01:33.500 --> 01:36.223 align:middle line:90%
is policy and the details
for if that user can log on,

49
01:36.223 --> 01:37.640 align:middle line:90%
based on the time
of day and where

50
01:37.640 --> 01:39.848 align:middle line:90%
he's trying to log on from,
will give a response back

51
01:39.848 --> 01:40.498 align:middle line:84%
to the switch.

52
01:40.498 --> 01:43.040 align:middle line:90%
And then the switch can say,
OK, this port is now authorized.

53
01:43.040 --> 01:44.630 align:middle line:84%
I can allow your traffic in.

54
01:44.630 --> 01:46.820 align:middle line:90%
So that way, if we have
hackers and attackers who

55
01:46.820 --> 01:48.350 align:middle line:90%
are trying to get into
the network, at least

56
01:48.350 --> 01:49.940 align:middle line:90%
on the wired network,
they won't have

57
01:49.940 --> 01:52.720 align:middle line:90%
access in because they won't
get any further than that switch

58
01:52.720 --> 01:53.220 align:middle line:84%
port.

59
01:53.220 --> 01:55.710 align:middle line:90%
Now, 802.1x is not
just for wired ports.

60
01:55.710 --> 01:57.320 align:middle line:90%
We can also use it
with our wireless.

61
01:57.320 --> 01:59.203 align:middle line:90%
So if we have a
wireless LAN controller

62
01:59.203 --> 02:00.620 align:middle line:90%
and we have an
access point and we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
01:59.203 --> 02:00.620 align:middle line:90%
and we have an
access point and we

63
02:00.620 --> 02:02.750 align:middle line:90%
have an ICE server or a
AAA server we can use,

64
02:02.750 --> 02:03.900 align:middle line:84%
we can do it there as well.

65
02:03.900 --> 02:05.858 align:middle line:90%
And it's really a matter
of just linking it up.

66
02:05.858 --> 02:08.687 align:middle line:90%
We need to tell the wireless
LAN controller not only about

67
02:08.687 --> 02:10.729 align:middle line:90%
the APs that it's managing,
but also the wireless

68
02:10.729 --> 02:13.010 align:middle line:90%
LAN controller about
the AAA server.

69
02:13.010 --> 02:15.540 align:middle line:90%
We specify our policies
on the AAA server.

70
02:15.540 --> 02:18.050 align:middle line:90%
And then when wireless
clients try to connect,

71
02:18.050 --> 02:21.530 align:middle line:90%
we can require 802.1x
authentication there to verify

72
02:21.530 --> 02:24.560 align:middle line:90%
who that user is, again, before
we allow them full access

73
02:24.560 --> 02:25.490 align:middle line:84%
to the network.

74
02:25.490 --> 02:27.950 align:middle line:90%
So this is the interface for
a wireless LAN controller.

75
02:27.950 --> 02:30.110 align:middle line:90%
Now for Encore, the
goal here is just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:27.950 --> 02:30.110 align:middle line:90%
Now for Encore, the
goal here is just

76
02:30.110 --> 02:32.810 align:middle line:90%
to get a big picture of
some of the security factors

77
02:32.810 --> 02:34.490 align:middle line:84%
that we've put into our design.

78
02:34.490 --> 02:36.240 align:middle line:90%
And I just want to
give you a little taste

79
02:36.240 --> 02:37.710 align:middle line:84%
and feel of some of those parts.

80
02:37.710 --> 02:38.960 align:middle line:90%
So on this wireless
LAN controller,

81
02:38.960 --> 02:40.700 align:middle line:90%
if we wanted to tell
this controller, hey,

82
02:40.700 --> 02:43.200 align:middle line:90%
you're using a AAA server, and
we want to have policies that

83
02:43.200 --> 02:45.650 align:middle line:90%
are using a AAA
server for the 802.1x,

84
02:45.650 --> 02:48.950 align:middle line:90%
we would specify where that AAA
server is under the Security

85
02:48.950 --> 02:49.485 align:middle line:84%
tab.

86
02:49.485 --> 02:51.360 align:middle line:90%
And with the Security
tab selected, over here

87
02:51.360 --> 02:55.130 align:middle line:90%
on the left, we'd go to AAA,
RADIUS, and Authentication.

88
02:55.130 --> 02:57.350 align:middle line:90%
And it's here where we can
specify the AAA servers

89
02:57.350 --> 02:57.950 align:middle line:84%
that we want to use.

90
02:57.950 --> 03:00.283 align:middle line:90%
We'd also want to configure
the policies for our various
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
02:57.950 --> 03:00.283 align:middle line:90%
We'd also want to configure
the policies for our various

91
03:00.283 --> 03:03.500 align:middle line:90%
wireless Local Area Networks,
that they should use 802.1x

92
03:03.500 --> 03:04.590 align:middle line:84%
for authentication.

93
03:04.590 --> 03:06.590 align:middle line:90%
So we could grab one of
our wireless LANs, here.

94
03:06.590 --> 03:08.390 align:middle line:90%
So here, it's showing
a high-level overview

95
03:08.390 --> 03:09.720 align:middle line:84%
on the general page.

96
03:09.720 --> 03:11.420 align:middle line:90%
But when we go to
Security, this is

97
03:11.420 --> 03:14.210 align:middle line:90%
where we can specify the details
for the type of authentication

98
03:14.210 --> 03:16.220 align:middle line:90%
that we want to
go ahead and use.

99
03:16.220 --> 03:20.060 align:middle line:90%
This is also where we'd specify
the AAA servers that we can

100
03:20.060 --> 03:23.600 align:middle line:90%
rely on when we need to verify
the credentials of a user

101
03:23.600 --> 03:26.540 align:middle line:90%
who's trying to
authenticate with 802.1x.

102
03:26.540 --> 03:30.237 align:middle line:90%
So here on the AAA server,
the RADIUS or the ICE server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:26.540 --> 03:30.237 align:middle line:90%
So here on the AAA server,
the RADIUS or the ICE server,

103
03:30.237 --> 03:32.570 align:middle line:90%
we have the policies that are
specifying what's allowed,

104
03:32.570 --> 03:33.400 align:middle line:84%
what's not allowed.

105
03:33.400 --> 03:34.940 align:middle line:90%
Here's also where
we'd have either

106
03:34.940 --> 03:36.740 align:middle line:90%
the information on
the user accounts,

107
03:36.740 --> 03:39.830 align:middle line:90%
or we could integrate ICE
with an Active Directory,

108
03:39.830 --> 03:42.950 align:middle line:90%
for example, to pull and
retrieve that information

109
03:42.950 --> 03:45.690 align:middle line:90%
if we don't want to have it
entered twice in our systems.

110
03:45.690 --> 03:47.780 align:middle line:90%
So the key here is that
nobody gets on the network

111
03:47.780 --> 03:50.390 align:middle line:90%
if we're using 802.1x
until we know who they are.

112
03:50.390 --> 03:53.300 align:middle line:90%
Now, there are some situations
where 802.1x just won't fit

113
03:53.300 --> 03:53.800 align:middle line:84%
the bill.

114
03:53.800 --> 03:55.175 align:middle line:90%
For example, we're
using it maybe

115
03:55.175 --> 03:56.820 align:middle line:84%
for everybody in our enterprise.

116
03:56.820 --> 03:59.330 align:middle line:90%
But what about a printer or
an internet of things device

117
03:59.330 --> 04:01.083 align:middle line:84%
that's connected to our network?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
03:59.330 --> 04:01.083 align:middle line:84%
that's connected to our network?

118
04:01.083 --> 04:02.750 align:middle line:90%
Well, hopefully that
thing is authorized

119
04:02.750 --> 04:04.042 align:middle line:84%
to be there in the first place.

120
04:04.042 --> 04:07.370 align:middle line:90%
But if they can't support
the interaction with 802.1x,

121
04:07.370 --> 04:09.320 align:middle line:90%
we also have an
option called MAB--

122
04:09.320 --> 04:12.050 align:middle line:84%
MAC Authentication Bypass.

123
04:12.050 --> 04:15.590 align:middle line:90%
Basically, we can hard code in
the system the MAC addresses

124
04:15.590 --> 04:19.339 align:middle line:90%
that should be allowed, even
if they can't do 802.1x with

125
04:19.339 --> 04:20.510 align:middle line:84%
a proper supplicant.

126
04:20.510 --> 04:23.540 align:middle line:90%
So there'd be a process of the
authentication that attempts

127
04:23.540 --> 04:24.740 align:middle line:84%
with 802.1x.

128
04:24.740 --> 04:25.670 align:middle line:84%
It would time out.

129
04:25.670 --> 04:26.920 align:middle line:90%
And then it would go
ahead and check and see,

130
04:26.920 --> 04:29.003 align:middle line:90%
oh, do you have a MAC
address that's on the list--

131
04:29.003 --> 04:29.586 align:middle line:84%
the nice list?

132
04:29.586 --> 04:31.253 align:middle line:90%
And then it could
allow that MAC address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
04:29.586 --> 04:31.253 align:middle line:90%
And then it could
allow that MAC address

133
04:31.253 --> 04:33.110 align:middle line:90%
to go ahead and have
access into the network

134
04:33.110 --> 04:34.760 align:middle line:84%
because it was pre-configured.

135
04:34.760 --> 04:37.302 align:middle line:90%
And one other option that can
be used-- this is pretty cool--

136
04:37.302 --> 04:39.102 align:middle line:90%
is web authentication,
or WebAuthn.

137
04:39.102 --> 04:40.310 align:middle line:84%
And the way it works is this.

138
04:40.310 --> 04:42.977 align:middle line:90%
When a user tries to connect, if
they haven't authenticate yet--

139
04:42.977 --> 04:45.268 align:middle line:90%
so the system doesn't know
who they are, but needs to--

140
04:45.268 --> 04:46.790 align:middle line:90%
it can redirect
them to a web page.

141
04:46.790 --> 04:49.070 align:middle line:90%
And that web page can give
that user the opportunity

142
04:49.070 --> 04:51.300 align:middle line:90%
to put in their username
and credentials, whatever

143
04:51.300 --> 04:52.882 align:middle line:84%
we're requiring for log in.

144
04:52.882 --> 04:54.590 align:middle line:90%
And then once that
information gets input

145
04:54.590 --> 04:57.462 align:middle line:90%
by the user, that can be checked
with either the wireless LAN

146
04:57.462 --> 04:59.670 align:middle line:90%
controller for doing it
locally there, or better yet,

147
04:59.670 --> 05:00.462 align:middle line:84%
with a AAA server--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
04:59.670 --> 05:00.462 align:middle line:84%
with a AAA server--

148
05:00.462 --> 05:01.113 align:middle line:84%
ICE again.

149
05:01.113 --> 05:02.780 align:middle line:90%
And then once the
user is authenticated,

150
05:02.780 --> 05:04.340 align:middle line:90%
we can then allow that
traffic to go through.

151
05:04.340 --> 05:05.210 align:middle line:90%
And that way, we
don't have to have

152
05:05.210 --> 05:06.460 align:middle line:84%
a supplicant on that computer.

153
05:06.460 --> 05:07.835 align:middle line:90%
But we still have
the opportunity

154
05:07.835 --> 05:09.890 align:middle line:90%
to gain that information
about who that user is,

155
05:09.890 --> 05:12.790 align:middle line:90%
based on pausing them for a
few seconds at a captive portal

156
05:12.790 --> 05:13.985 align:middle line:84%
and doing WebAuthn.

157
05:13.985 --> 05:16.610 align:middle line:90%
So in this video, we've taken a
look at a few different methods

158
05:16.610 --> 05:18.470 align:middle line:90%
for authenticating
devices before allowing

159
05:18.470 --> 05:20.488 align:middle line:90%
them to connect and get
access into the network.

160
05:20.488 --> 05:23.030 align:middle line:90%
And in the next video, I'd like
to chat with you about, well,

161
05:23.030 --> 05:24.613 align:middle line:90%
once they're on the
network, how do we

162
05:24.613 --> 05:26.583 align:middle line:90%
keep those devices
secure and protected?

163
05:26.583 --> 05:28.250 align:middle line:90%
And that's the focus
for our next video.

164
05:28.250 --> 05:29.900 align:middle line:90%
So I'll see you there
in just a moment.

165
05:29.900 --> 05:32.510 align:middle line:90%
Meanwhile, I hope this has
been informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
05:29.900 --> 05:32.510 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

166
05:32.510 --> 05:35.710 align:middle line:90%
And I'd like to thank
you for viewing.