WEBVTT

00:00:00.000 --> 00:00:16.840
Hello everyone and welcome to the last lesson of our Encore wireless section.

00:00:16.840 --> 00:00:19.320
This is all about WebAuth.

00:00:19.320 --> 00:00:23.040
WebAuth is that little portal you see when you're trying to join a network.

00:00:23.040 --> 00:00:26.080
A lot of you guys have that experience in a hotel.

00:00:26.080 --> 00:00:33.200
Many of you probably have this as a guest wireless LAN environment for your enterprise

00:00:33.200 --> 00:00:34.200
environment.

00:00:34.200 --> 00:00:36.680
It's really important to understand WebAuth.

00:00:36.680 --> 00:00:45.120
It has its own security features and it has its own, like, it's in its own security realm,

00:00:45.120 --> 00:00:46.120
let's say.

00:00:46.120 --> 00:00:51.160
There's some important things we're going to cover for our Encore exam, so let's go

00:00:51.160 --> 00:00:53.440
ahead and get started here.

00:00:53.440 --> 00:00:56.920
So WebAuthenticationTypes, what are you going to see?

00:00:56.920 --> 00:00:58.920
So WebAuth is the basic one, right?

00:00:58.920 --> 00:01:06.640
This is a basic message where you're going to see, I'm going to make sure that you're

00:01:06.640 --> 00:01:08.520
going to see that.

00:01:08.520 --> 00:01:13.840
What happens is, let's roll back a little bit, I had too many things going through my

00:01:13.840 --> 00:01:15.040
mind there.

00:01:15.040 --> 00:01:20.520
What happens is you attempt to join a network, an SSID, and you're presented with a page

00:01:20.680 --> 00:01:24.280
and the page says, oh, you need to enter your credentials.

00:01:24.280 --> 00:01:28.600
And oftentimes if you're at a hotel, it's like your room number or a pre-shared key

00:01:28.600 --> 00:01:29.960
or things like this.

00:01:29.960 --> 00:01:32.840
This is the regular WebAuth.

00:01:32.840 --> 00:01:40.440
There's also AuthBypass, and this is used with a MAC address as the client identity.

00:01:40.440 --> 00:01:45.760
Now what this does is this validates with the authentication server and you're ready

00:01:45.760 --> 00:01:47.040
to go.

00:01:47.040 --> 00:01:52.560
But it uses that HTTP front end in order to get you there.

00:01:52.560 --> 00:01:54.040
And then there's the consent.

00:01:54.040 --> 00:01:57.440
This is the one where there's not really any authentication that takes place.

00:01:57.440 --> 00:02:04.160
You just got to kind of agree to the user policy or the policy for using the network.

00:02:04.160 --> 00:02:06.800
You must accept the policy to use it.

00:02:06.800 --> 00:02:08.280
That's how that works.

00:02:08.280 --> 00:02:12.360
And then lastly, one of the authentication types is WebConsent.

00:02:12.360 --> 00:02:19.200
Now WebConsent is very important because it does both.

00:02:19.200 --> 00:02:24.040
Now you always kind of want to have, when you have a guest on your network, you want

00:02:24.040 --> 00:02:26.440
them to accept the access policy.

00:02:26.440 --> 00:02:31.120
So really this is where people should really live and breathe, down here in the WebConsent.

00:02:31.120 --> 00:02:38.280
If you're using WebAuth for a guest wireless LAN, you really want to use WebConsent because

00:02:38.280 --> 00:02:46.680
this is what, you know, your employees often sign papers with HR that say, I consent to

00:02:46.680 --> 00:02:52.440
this or that when using the network or when using company equipment and things like this.

00:02:52.440 --> 00:02:55.520
WebConsent is different because you have guest users on that account.

00:02:55.520 --> 00:02:59.160
You don't have that HR paperwork and backing.

00:02:59.160 --> 00:03:03.320
And usage policy is important if something goes wrong.

00:03:03.320 --> 00:03:08.320
Usage policy allows you to prosecute people who may have nefarious intentions.

00:03:08.320 --> 00:03:10.840
You're not welcoming them on your network.

00:03:10.840 --> 00:03:15.240
And believe it or not, the legal aspect of this is real.

00:03:15.240 --> 00:03:16.720
It's a real thing.

00:03:16.720 --> 00:03:21.240
So having a usage policy is important, but also having that authentication where they

00:03:21.240 --> 00:03:24.560
have to have something you give them, right?

00:03:24.560 --> 00:03:30.440
Something they know, something, you know, have that security systems go with something

00:03:30.560 --> 00:03:34.400
you know, something or some type of authentication.

00:03:34.400 --> 00:03:40.560
You want with that usage policy, you want a username or password or something you give

00:03:40.560 --> 00:03:45.880
that guest user so that you don't have just anyone joining your network like you would

00:03:45.880 --> 00:03:47.360
with just a consent policy.

00:03:47.360 --> 00:03:52.760
You want them to actually have to have some token you give them or some knowledge you

00:03:52.760 --> 00:03:55.400
give them so that only authenticate users.

00:03:55.400 --> 00:04:00.240
Now, if you're a public place like a Starbucks, the consent is obviously the way you're going

00:04:00.240 --> 00:04:01.240
to go.

00:04:01.240 --> 00:04:04.200
Maybe you could have, if you're a coffee shop, small coffee shop, you could have the

00:04:04.200 --> 00:04:08.160
password of the day up there and change it, but that's a lot of work and it depends on

00:04:08.160 --> 00:04:09.160
your organization.

00:04:09.160 --> 00:04:13.840
But these are the WebAuth types and I'd like you to know them for the exam.

00:04:13.840 --> 00:04:15.600
I'm going to take myself off the screen.

00:04:15.600 --> 00:04:18.480
I'm kind of covering some of the words here.

00:04:18.480 --> 00:04:22.000
Let's go ahead and take a look at WebAuth roles.

00:04:22.000 --> 00:04:24.080
Now we talked about the types.

00:04:24.080 --> 00:04:25.080
Now let's talk about the roles.

00:04:25.080 --> 00:04:28.080
First, there's clients.

00:04:28.080 --> 00:04:31.520
Those are the people who request access to the wireless LAN and the services.

00:04:31.520 --> 00:04:33.920
These are the people who want to use it.

00:04:33.920 --> 00:04:37.640
The access point is where they're going to connect to.

00:04:37.640 --> 00:04:43.660
This restricts IP traffic except DHCP and DNS when they initially connect.

00:04:43.660 --> 00:04:47.480
We're going to go through this step by step, but the access point is really what they're

00:04:47.480 --> 00:04:55.440
hitting first and your guest or WebAuth roles are going to constrict everything until they

00:04:55.440 --> 00:04:58.360
sign that user policy, until they say yes.

00:04:58.360 --> 00:05:04.800
They're really only going to get traffic to DHCP, DNS, and your wireless LAN controller.

00:05:04.800 --> 00:05:07.920
The controller itself manages the access points and clients.

00:05:07.920 --> 00:05:09.840
We know that already.

00:05:09.840 --> 00:05:17.360
It intercepts the HTTP request, so that HTTP request we initially send out, we stop there

00:05:17.360 --> 00:05:23.320
and it redirects to the wireless LAN controller and shoots out that page that you create,

00:05:23.320 --> 00:05:25.400
the WebAuth page.

00:05:26.360 --> 00:05:27.360
Let's take an example.

00:05:27.360 --> 00:05:30.280
I'm sure you guys have all seen this or most of you have at least.

00:05:30.280 --> 00:05:37.600
You try and join that hotel network and then immediately you're redirected to the HTTP.

00:05:37.600 --> 00:05:42.680
It's got that thing and then it's got the big web page and it says enter your room key

00:05:42.680 --> 00:05:48.880
or enter your token or your password and then agree to the usage policy.

00:05:48.880 --> 00:05:52.320
That's what the wireless LAN controller is doing in this case.

00:05:52.320 --> 00:05:54.680
Then you have the authentication server.

00:05:54.680 --> 00:05:58.280
That is very dependent on your configuration.

00:05:58.280 --> 00:06:04.200
If I'm just doing consent, I'm not going to see a lot here, but we'll show you both of

00:06:04.200 --> 00:06:05.200
those systems.

00:06:05.200 --> 00:06:07.160
Now, let's start with the first one.

00:06:07.160 --> 00:06:11.440
What does this connection look like with those roles in mind?

00:06:11.440 --> 00:06:15.440
We have the client, we have the AP, we have the wireless LAN controller, and there's that

00:06:15.440 --> 00:06:16.560
AAA server.

00:06:16.560 --> 00:06:18.440
There are roles.

00:06:18.440 --> 00:06:21.640
We even talked about the DHCP and DNS.

00:06:21.640 --> 00:06:23.840
We're going to go through this process.

00:06:24.000 --> 00:06:29.280
First off, our client's going to connect to the web off SSID and it's going to go directly

00:06:29.280 --> 00:06:30.280
to that AP.

00:06:30.280 --> 00:06:31.280
We're coming out here.

00:06:31.280 --> 00:06:32.280
Boom.

00:06:32.280 --> 00:06:36.680
The AP responds with, ooh, all right, so somebody's trying to connect to me.

00:06:36.680 --> 00:06:42.360
We're going to use that CapWack tunnel to throw this directly here to the DHCP.

00:06:42.360 --> 00:06:44.600
Notice I didn't say anywhere else.

00:06:44.600 --> 00:06:48.000
It's going to go to the CapWack tunnel, it's going to go to the wireless LAN controller.

00:06:48.000 --> 00:06:55.120
They're going to get an IP address from DHCP and there's going to be a DNS in there that's

00:06:55.120 --> 00:06:58.600
going to point us to that HTTPS.

00:06:58.600 --> 00:07:02.880
This configuration is important.

00:07:02.880 --> 00:07:05.360
This is going to assign the IP address to a client.

00:07:05.360 --> 00:07:06.480
I know what you're thinking.

00:07:06.480 --> 00:07:10.680
I know you're saying, whoa, must be done already.

00:07:10.680 --> 00:07:15.960
He has an IP address or she has an IP address and they have DNS access, they must be able

00:07:15.960 --> 00:07:16.960
to get the internet.

00:07:16.960 --> 00:07:21.600
No, remember the wireless LAN controller is going to stop all other communication.

00:07:21.600 --> 00:07:24.080
We're in that CapWack tunnel.

00:07:24.080 --> 00:07:28.640
So our traffic is segregated from regular data at this point.

00:07:28.640 --> 00:07:31.280
We're going directly to the wireless LAN controller.

00:07:31.280 --> 00:07:34.000
We're going to initiate that HTTP session.

00:07:34.000 --> 00:07:43.800
So that webpage that says, oh, can the user get in, yes or no, do you sign the acceptable

00:07:43.800 --> 00:07:44.800
use policy?

00:07:44.800 --> 00:07:46.560
That's what we're sending back.

00:07:46.560 --> 00:07:51.120
See, the web auth, we're going to redirect.

00:07:51.120 --> 00:07:52.560
That's what we're sending back.

00:07:52.560 --> 00:07:54.920
That's really what people are going to see.

00:07:54.920 --> 00:08:01.520
Then on that webpage, you have to enter your username or password or if you're using consent,

00:08:01.520 --> 00:08:02.840
click yes or no here.

00:08:02.840 --> 00:08:05.360
Yes, I agree to the user policy.

00:08:05.360 --> 00:08:12.920
Once that's done, it's then sent to that AAA server as a validator and it says, oh, did

00:08:12.920 --> 00:08:14.080
they click yes or no?

00:08:14.360 --> 00:08:16.720
It says, oh, is that password correct?

00:08:16.720 --> 00:08:18.720
Oh, is that username correct?

00:08:18.720 --> 00:08:26.640
If it's an okay, then yes, and then you get redirected to your original URL.

00:08:26.640 --> 00:08:30.160
That's what's happening behind the scenes.

00:08:30.160 --> 00:08:37.000
Now if it's a no, you get shot right back here, okay?

00:08:37.000 --> 00:08:42.880
So if you click no or if the password's incorrect, you're going to be sent right back to that

00:08:42.880 --> 00:08:44.200
HTTP.

00:08:44.200 --> 00:08:51.040
You are not outside of that CapWAP tunnel until you finish this process.

00:08:51.040 --> 00:08:58.440
You are dealing directly with that web auth configuration.

00:08:58.440 --> 00:09:00.760
So clear the screen a little bit.

00:09:00.760 --> 00:09:07.480
What about if we have an external web server that's actually happening here, a more custom

00:09:07.480 --> 00:09:08.480
configuration?

00:09:08.480 --> 00:09:11.880
Well, really, it just adds this in.

00:09:11.880 --> 00:09:14.840
So really, the wireless LAN controller contacts this.

00:09:14.840 --> 00:09:15.840
We go through DHCP.

00:09:15.840 --> 00:09:17.800
You still get the same thing.

00:09:17.800 --> 00:09:19.640
That's the only difference.

00:09:19.640 --> 00:09:24.240
Your AAA, RADIUS, or TACAC server still handles the authentication.

00:09:24.240 --> 00:09:25.680
Maybe you're not using AAA.

00:09:25.680 --> 00:09:27.180
Maybe you're using something else.

00:09:27.180 --> 00:09:32.120
Maybe it's just a simple password, a pre-shared key, something of that nature.

00:09:32.120 --> 00:09:36.520
If it's a pre-shared key or something of that nature, then it actually goes to the wireless

00:09:36.520 --> 00:09:38.400
LAN controller for authentication.

00:09:42.320 --> 00:09:46.680
Let's talk about some of these features.

00:09:46.680 --> 00:09:51.520
Secure HTTP access, HTTPS.

00:09:51.520 --> 00:09:57.880
We do certificate validation, so make sure you rotate this annually or however long it

00:09:57.880 --> 00:10:01.200
takes for them to go out.

00:10:01.200 --> 00:10:02.800
Remember, certs expire.

00:10:02.800 --> 00:10:06.720
So however long your cert's valid for, you need to rotate them.

00:10:06.720 --> 00:10:10.240
If not, what your clients are going to see is certification expired, and they're going

00:10:10.240 --> 00:10:11.520
to have to accept it.

00:10:11.520 --> 00:10:14.480
Some of the Apple products get really funky about this.

00:10:14.480 --> 00:10:21.240
If a certificate, even if it's just on your wireless controller, doesn't match, and rightfully

00:10:21.240 --> 00:10:22.240
so.

00:10:22.240 --> 00:10:23.440
That is a security setting.

00:10:23.440 --> 00:10:28.720
So make sure you rotate these annually or you rotate them as needed.

00:10:28.720 --> 00:10:32.320
Custom WebAuth login portals, you can create this.

00:10:32.320 --> 00:10:36.280
If you have a developer on hand or you're handy enough to do the development yourself,

00:10:36.280 --> 00:10:39.400
you can create fancy pages for your organization.

00:10:39.400 --> 00:10:43.160
In fact, a lot of the hotels you see have their own custom WebAuth.

00:10:43.160 --> 00:10:46.280
That's why we have that server.

00:10:46.280 --> 00:10:48.120
Let me roll back.

00:10:48.120 --> 00:10:51.920
That's when this comes into play, that external web server.

00:10:51.920 --> 00:10:55.320
That's when that comes into play.

00:10:55.320 --> 00:11:02.080
Custom web browsers and banners, sometimes you can put a banner on here that says, if

00:11:02.080 --> 00:11:09.040
you connect to our network, you consent to our user policy.

00:11:09.680 --> 00:11:10.680
That's important.

00:11:10.680 --> 00:11:17.280
Or another thing I've seen for web browser banners is no unauthorized users are allowed

00:11:17.280 --> 00:11:18.280
on this network.

00:11:18.280 --> 00:11:20.120
Please disconnect now.

00:11:20.120 --> 00:11:21.480
That can be set up by legal.

00:11:21.480 --> 00:11:24.280
That means you could be prosecuted for connecting to that network.

00:11:24.280 --> 00:11:26.920
It's like a no trespassing sign, really.

00:11:26.920 --> 00:11:31.000
But you can set up custom browsers also letting them know, hey, this is going to go down.

00:11:31.000 --> 00:11:32.000
But this is really cool.

00:11:32.000 --> 00:11:34.760
This is a CLI configuration.

00:11:34.760 --> 00:11:39.640
And then when not configured for the username or password, it's going to appear somewhere

00:11:39.640 --> 00:11:40.640
else.

00:11:40.640 --> 00:11:44.120
So the custom web browser banners appear when people log on.

00:11:44.120 --> 00:11:48.760
But when not configured on username or password, they appear at the login screen.

00:11:48.760 --> 00:11:54.160
That's when you're using just consent again.

00:11:54.160 --> 00:12:00.440
You can set up custom authentication and proxy web pages and pre-authentication ACLs and

00:12:00.440 --> 00:12:01.440
URL filters.

00:12:01.440 --> 00:12:05.600
So if you're coming from here, we can go ahead and skip here.

00:12:05.600 --> 00:12:14.160
We can put in URL filters to further limit those web auth users on what they can actually

00:12:14.160 --> 00:12:15.160
reach.

00:12:15.160 --> 00:12:21.760
Remember, this is really used for guest wireless LANs, guest SSIDs.

00:12:21.760 --> 00:12:26.680
That's really where you see this the most.

00:12:26.680 --> 00:12:30.440
One configuration note that I would note for the exam, when we're dealing with virtual

00:12:30.440 --> 00:12:35.440
IP addresses for web auth, this can be IPv4 or 6.

00:12:35.440 --> 00:12:39.240
Use only between the controller and the wireless client.

00:12:39.240 --> 00:12:43.760
That's only for this virtual IP address.

00:12:43.760 --> 00:12:47.280
It redirects the address to the web authentication login page.

00:12:47.280 --> 00:12:50.280
We saw that in our configuration.

00:12:50.280 --> 00:12:53.240
These are non-routable IP addresses.

00:12:53.240 --> 00:12:55.080
That's one thing to note.

00:12:55.080 --> 00:13:00.400
And these do not overlap with the network infrastructure addresses.

00:13:00.400 --> 00:13:04.520
And these have their own RFC.

00:13:04.520 --> 00:13:06.280
What did I say about underlining?

00:13:06.280 --> 00:13:09.360
If I underline something, I would know it.

00:13:09.360 --> 00:13:21.160
I would know this, these ranges, the 2030113, the 19851100, and the 192020.

00:13:21.160 --> 00:13:22.880
They're all slash 24s.

00:13:22.880 --> 00:13:26.960
But these are the ones I would know, know this.

00:13:26.960 --> 00:13:28.640
All right.

00:13:28.640 --> 00:13:32.360
That was the last lesson in our web auth.

00:13:32.360 --> 00:13:33.680
We talked about a few things here.

00:13:33.680 --> 00:13:42.840
Let me roll back a few slides just so you can get this in your brain.

00:13:42.840 --> 00:13:45.080
Take a look at this process again.

00:13:45.080 --> 00:13:46.640
Broadcast SSID.

00:13:46.640 --> 00:13:54.160
We try and connect to the SSID, assign the IP to the client, goes out to the session,

00:13:54.160 --> 00:14:00.720
comes back with the browser, the HTTPS.

00:14:00.720 --> 00:14:02.200
This is the yes or no.

00:14:02.200 --> 00:14:08.120
This is that web page where you fill out your information, either consent or web auth with

00:14:08.120 --> 00:14:12.120
consent, which would mean the username and password.

00:14:12.120 --> 00:14:17.520
Those credentials that you entered are sent back to the AAA server or whatever authentication

00:14:17.520 --> 00:14:19.680
server is at this point.

00:14:19.680 --> 00:14:20.680
Then what happens?

00:14:20.680 --> 00:14:23.360
Well, it's either yes or no.

00:14:23.360 --> 00:14:25.160
Those match or they don't match.

00:14:25.160 --> 00:14:27.080
If it matches, then we go down.

00:14:27.080 --> 00:14:31.120
If it doesn't match, we go back up.

00:14:31.120 --> 00:14:38.140
Matches applies the access policy, then we can go wherever we want from here.

00:14:38.140 --> 00:14:41.320
We are a part of that guest traffic.

00:14:41.320 --> 00:14:46.740
Whatever policies we have in place for that, that's what gets applied to the data traffic.

00:14:46.740 --> 00:14:51.400
But now we are regular data traffic instead of being in a box.

00:14:51.440 --> 00:14:53.960
You are in a box from here to here.

00:14:53.960 --> 00:15:01.200
You cannot leave this communication, this internal communication, unless you get that

00:15:01.200 --> 00:15:05.240
authentication from that AAA server.

00:15:05.240 --> 00:15:11.880
All right, everyone, that wraps up our ENCQOR wireless sections.

00:15:11.880 --> 00:15:15.840
That's everything you should know for the exam.

00:15:15.840 --> 00:15:18.240
Remember to look in our supplemental learning assets.

00:15:18.240 --> 00:15:22.000
I've got two websites there for you to go through.

00:15:22.000 --> 00:15:23.720
Know this stuff.

00:15:23.720 --> 00:15:26.640
Watch these videos one time through.

00:15:26.640 --> 00:15:30.800
Go through those tables, and you should be well prepared for the exam.

00:15:30.800 --> 00:15:31.800
Thank you very much.

00:15:31.800 --> 00:15:37.040
I enjoy wireless quite a bit, and I enjoy teaching, so I will see you in one of my other

00:15:37.040 --> 00:15:38.040
courses.