We're going to jump into configuring our iOS XC as well as our AirOS wireless
LAN controllers
for wireless security.
When we configured these earlier on, we would create the WLANs, and those WLANs
have our
SSIDs and our SSID configurations, and that includes the network security.
Now in order to just focus on getting our WLANs and SSIDs configured, we didn't
configure
any security at all.
We simply said no security.
But now it's time for us to go in and configure all of the security concepts WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But now it's time for us to go in and configure all of the security concepts
that we talked
about in the previous skill.
We're going to get in there, find the security tab, and we'll be able to
configure Layer
2, Layer 3, as well as the needed AAA configuration for getting our WPA
enterprise online.
So there are three primary methods that we're going to want to explore for our
enterprise
networks.
We shouldn't just go into our wireless security configuration and configure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We shouldn't just go into our wireless security configuration and configure
whatever is easiest
for us, which would probably be just disabling the security again.
But certainly we wouldn't want to necessarily go with pre-shared key unless we
have a very
specific reason for doing that.
But as we look at our three methods, certainly the first one is going to be the
pre-shared
key.
When we see pre-shared key, we are referring to that concept of WPA personal.
And we should always be attention to anything labeled "personals" really not
designed
for being used in the enterprise space.
Now pre-shared key will work as well as it's designed to work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now pre-shared key will work as well as it's designed to work.
It will allow us to hand the pre-shared key out to individuals.
It will serve as our authentication mechanism from that perspective, meaning
that again,
we prove that we belong on the network by showing that we have the key.
And so that's an authentication mechanism.
And it will provide encryption, no problem.
So the issue here, as we detailed out, is that there's no real scaling here.
And there's no real granularity. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's no real granularity.
This is a big concern in the enterprise space.
If I have dozens or hundreds or thousands of employees, then if one of them
leaves and
they know the pre-shared key, that's going to be a big problem for me.
I'm going to have to change the pre-shared key on every single mobile device if
I consider
that pre-shared key to be compromised.
Furthermore, if I have the pre-shared key, then I'm next to somebody else who's
using
the same pre-shared key.
Well, since they're using it to encrypt traffic and derive their encryption WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, since they're using it to encrypt traffic and derive their encryption
keys ultimately,
well, I can use it to decrypt their traffic as well.
And so that's a real danger to even using this in a cafe, for example.
This is why we have to be careful when we're using our corporate devices at our
on public
Wi-Fi.
We should always be using a VPN or something to encrypt our traffic on top of
the wireless
security, because even if we're using a pre-shared key to connect to a cafe's
Wi-Fi, well, anybody
who is sitting around who also has that pre-shared key could not only use it to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
who is sitting around who also has that pre-shared key could not only use it to
listen in on
my communications, but then decrypt it, and they'll be able to see everything I
'm doing
that isn't itself encrypted.
So we have to be very careful with pre-shared key, but as we see here, WPA
Personal, again,
not really designed for use in the enterprise space, and yet we'll still have
to know how
to configure this.
When we do configure a pre-shared key, it's going to be an ASCII pre-shared key
, which
means it can be a memorable word or phrase, whatever it is that we want to
deploy as the
key that will be used to allow devices to access the wireless network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
key that will be used to allow devices to access the wireless network.
From there, our second option is going to involve 802.1x, and when we see that
option,
we're going to know that that's referring to WPA Enterprise.
And there's the name Enterprise, which tells me that we are now talking about a
solution
we should be deploying into our corporate networks.
So this is going to require the configuration of AAA services, especially
something like
a radius or possibly a TAC-AC server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a radius or possibly a TAC-AC server.
So whatever we're running in our environment, and if in your lab environment
you don't have
this running, but you still want to configure it, then we can still configure
dummy addresses,
but we're going to want to make sure we at least know the configuration process
, even
if we can't test it on the back end.
Now the pre-shared key is going to be pretty similar between iOS and iOS, but
802.1x, when
we configure this on iOSXE, iOSXE is going to configure AAA services like it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we configure this on iOSXE, iOSXE is going to configure AAA services like it
does on an
iOSXE switch, meaning that we're going to configure our servers, and we're
going to
configure our server groups.
We're going to add the servers specifically into our groups, and then we're
going to reference
those as part of our 802.1x configuration.
Meanwhile, if we're looking at iOS, iOS is going to be a little bit simpler
than iOSXE,
I'm just going to manually configure servers and specify them in my security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm just going to manually configure servers and specify them in my security
policy.
So not particularly ideal if I have a lot of servers, for example, but again,
this is
where iOSXE is falling back on the fact that it's truly running iOSXE on the
back end.
If I log in to my iOSXE device at CLI, I'm going to feel very comfortable if I
know switch
and router configuration.
And so anything that we're doing in the graphical user interface, like servers
and groups, we
say, well, this isn't how AROS did it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say, well, this isn't how AROS did it.
Why is it doing it that way?
Well, it's because again, it really is running iOSXE, and probably that's how
iOSXE is.
Handles, whatever it is we're configuring.
Now, the last thing to look at, or the last option or method that we have
available to
us is going to be that web auth, which is considered by Cisco, and I guess
everyone,
to be a layer three security method, meaning that we're not going to use layer
two security,
which are these other two options. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which are these other two options.
So web auth is going to allow both of our wireless LAN controller types to host
that
web page.
And we'll do some minor customization of that web page and take a look at that.
But we can also redirect to an external web page, if that's what we desire.
If we want something a little bit more customizable, something that we design
ourselves, it's
going to have to be an external type of web page that we redirect to.
If we're okay with the basic web page that Cisco gives us, then we can simply WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we're okay with the basic web page that Cisco gives us, then we can simply
use that.
Now I also want to chat very briefly about WPA versions, because we're going to
see those
versions get addressed in our configuration.
And this is a little bit of a history lesson as well with how wireless security
was developed.
So infamously, meaning famous for the wrong reasons, web was deployed as our
first wireless
security.
And we used to configure web by using a key sort of like a pre shared key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we used to configure web by using a key sort of like a pre shared key.
We type the key in, it was in hexadecimal, and that would allow us to connect
to the
network.
So this key is once again, providing authentication and encryption, sort of
like our WPA pre shared
key option.
The problem with web is that it we used a mechanism known as RC4, which was
actually
fairly crackable with the way that it brought data in and used it to encrypt
traffic.
But what's interesting about this is the encryption algorithm or the cipher
known as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
known as
T-Kip, this was actually okay.
RC4 was the problem.
And so what the wireless world did was they developed WPA, and WPA was able to
be a software
upgrade for web clients.
The reason why it was software upgradeable was because it's still used the same
hardware,
it's still used T-Kip.
It just redefined how exactly it was using T-Kip to encrypt the traffic.
So then WPA2 came out, and WPA2 said, okay, so T-Kip is still kind of an old WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So then WPA2 came out, and WPA2 said, okay, so T-Kip is still kind of an old
algorithm
here.
We don't necessarily want to use T-Kip, we're going to use AES.
And AES to this day is considered to be a secure encryption protocol.
So we're using AES, however, we can also use T-Kip for backward compatibility.
Now these days T-Kip is considered to be unsecure.
We do not want to run that backward compatibility, or at least that's not the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We do not want to run that backward compatibility, or at least that's not the
desire anymore.
So we do want to make sure that T-Kip is disabled unless we very specifically
need very old wireless
clients to connect to our network.
Furthermore, WPA3 is out now because WPA2 has found to have some problems of
its own.
And so we certainly would want to move to WPA3 if we can, but this is going to
require
new hardware, and it's going to use GCMP for the encryption.
So what we find is when we enable WPA, we can do it as WPA and WPA2 together WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what we find is when we enable WPA, we can do it as WPA and WPA2 together
because
again of the backward compatibility, we just want to make sure T-Kip and WPA is
disabled
with that policy.
We can also do a WPA2 and a WPA3 policy, but that disables a lot of the most
useful
features of WPA3, and that we might just not have a choice until most of all of
our stations
are upgraded for WPA3.
Or we can simply migrate fully to WPA3, but again, like I just said, we need to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we can simply migrate fully to WPA3, but again, like I just said, we need to
make sure
that we're not excluding WPA2 stations that really need to be part of our
network.
So over the course of time, we see this progression happening, and hopefully
eventually we're
all running on WPA3 without the need to worry about running WPA2 from a
backward compatibility
perspective.
So with that, let's go ahead and jump into the configuration.
Again, we're going to configure iOSXE and AROS, but hopefully this gives us a
good overview
of what we're trying to accomplish, and the focus should be on two main points WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of what we're trying to accomplish, and the focus should be on two main points
here,
understanding the different policies that we could configure with WPA, and then
especially
these three methods, and really understanding that these are our primary
options.
When we look at the graphical user interface, we're going to see a lot of
different things
we can click and drop downs and such, but if we really stick to these methods
and keep
in mind what we're trying to accomplish here, as far as just configuring one of
these at
a time, that will help us to digest the graphical user interface and make sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a time, that will help us to digest the graphical user interface and make sure
that we know
how to configure our wireless LAN controllers for wireless security.