Let's touch quickly on the concept of 802.1x and E, and we'll start with 802.1x
.
802.1x is a set of authentication standards created by the IEEE.
It defines how to perform authentication when a host joins a network.
And what's cool about this is it can be deployed for wireless authentication,
but it can also
be deployed for wired authentication.
A lot of us might have some level of experience deploying 802.1x into our wired WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A lot of us might have some level of experience deploying 802.1x into our wired
LAN space.
However, once again, we can use it on the wireless side in order to make sure
that our
clients are actually supposed to be getting onto our wireless network.
Now there's a specific architecture in mind with 802.1x.
And so we need to understand what that architecture looks like.
So in our case, we've got a station that's trying to authenticate.
We've got a device here that is trying to perform that authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We've got a device here that is trying to perform that authentication.
And then we also have a server on the back end.
802.1x gives us specific terms for these.
The station is known as a supplicant.
It's the one that's trying to authenticate to the network.
The device here in the middle, this is the authenticator.
The authenticator is responsible for deciding whether or not the supplicant is
allowed to
join the network.
So we've got some amount of communications going back and forth here.
But even though the authenticator is responsible for that, usually we're going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But even though the authenticator is responsible for that, usually we're going
to still have
another device over here, which is the authentication server.
The authentication server is usually going to be running radius or tack-acts.
And it's going to have the credentials or otherwise it's going to understand
who's
allowed to access the network.
And so we have communications going back and forth between the authenticator
and the
authentication server.
Now in a wireless world, the authenticator is usually the access point or it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now in a wireless world, the authenticator is usually the access point or it
could be
the wireless LAN controller.
Meaning that the access point passes this information through to the wireless
LAN controller here.
And then the wireless LAN controller has the communication back and forth with
the authentication
server.
And so we've got two different potential sources of architecture here or
different ways of
doing this in the wireless world.
And with lightweight architecture very often, it's going to be the wireless LAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And with lightweight architecture very often, it's going to be the wireless LAN
controller
that's actually serving the authenticator role.
So it's not just 802.1x, but we also have EAP involved with this process.
EAP is interesting.
It actually stands for the extensible authentication protocol.
And yet it's not really a protocol.
Or at least it's not a protocol we would deploy into our network.
Instead this is more of a framework that helps us to define different protocols WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead this is more of a framework that helps us to define different protocols
that can
be built on EAP.
So for example, we're going to have protocols such as protected EAP, which is P
EEP.
And we're going to have EAP TLS and EAP TTLS.
We've got a lot of different types of EAP protocols that are built on this ext
ensible authentication
protocol.
And the type of EAP is what's going to determine the authentication mechanism. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the type of EAP is what's going to determine the authentication mechanism.
Namely, are we going to use a username and password?
Are we going to use certificates and so on and so forth?
Now anytime we're talking about wireless security, we tend to group these two
together.
And it makes sense because when we look at an 802.1x supplicant, communicating
with an
authenticator, 802.1x doesn't tell us how to authenticate.
It just defines this architecture for us.
So it's EAP that actually allows us to communicate back and forth between the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's EAP that actually allows us to communicate back and forth between the
supplicant and the
authenticator.
And then it's, as mentioned, something like radius on the back end or
potentially takx
plus that is going to allow the authenticator to communicate with the
authentication server.
And so all of these protocols and frameworks, 802.1x, EAP and radius or takx,
these are
going to work together to allow us to authenticate a station, allow it to
connect to the network.
[BLANK_AUDIO]