All right, let's go ahead and start with iOS Xe. We're going to start with the
modern platform because chances are this is where everybody is migrating
towards.
But again, as always, it's important for us to understand how arrow s works.
What we'll find is that this iOS Xe interface, the graphical user interface,
this was largely based on how arrow s was configured.
And so once we learn our way around one of these, we can pretty well figure out
our way around the other one, just keeping in mind on the back end.
And I was Xe does things just a little bit different than arrow s at times, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I was Xe does things just a little bit different than arrow s at times,
even if the end user experience and ultimately the security protocols that we
're configuring are going to be the same between them.
So the way we do this is we go to configuration.
And we're going to go over here to our WLANs so under tags and profiles WLANs.
And I've just removed the WLAN that we made earlier.
I'm just going to create a new one. So we're going to call this CBT and let's
just go ahead and call this iOS Xe.
So we can differentiate here. And so I'm going to copy that and just whoops. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we can differentiate here. And so I'm going to copy that and just whoops.
That's right. It automatically assumes the SSID is going to be the same.
And so we'll just leave it like that. I'm going to enable it. Always very
important that we remember to enable it.
And we go over to the security tab. Now, before when we were just getting this
online, we just said none over here and get rid of most of the options down
here.
We're going to want to use one of these options. Let's just go ahead and go
through these and kind of talk through them.
So again, at the top here, we do see some sub tabs. We've got layer two
security, layer three security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
security, layer three security.
This would be our web auth. So we'd want to enable web policy here and triple A
, which is going to be important for us when we're configuring 802.1x.
So coming over to layer two, the first thing we have to do is to do is decide
which version of WPA we're going to run.
Now again, none over here would just disable layer two security and there's a
place for that static web.
There is absolutely no place for that. We should never configure static web
outside of very peculiar requirements.
Instead, we should really be focusing in on either WPA two plus and well, plus WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead, we should really be focusing in on either WPA two plus and well, plus
and WPA three.
This would be again, WPA three running backwards compatible with WPA two.
Or we could do WPA three alone. We could go WPA and WPA two if there's a real
need again.
I've seen medical environments with very old equipment like IV pumps that
require WPA.
That would be a scenario where we just would have to enable it.
But we see we can't get WPA and WPA three running at the same time. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we see we can't get WPA and WPA three running at the same time.
So we just have to pick the one that makes the most sense again for most of us.
That will be backward compatibility with WPA two for the reasons we discussed.
If we can go full on WPA three, then that's a wonderful thing if we can.
So we're going to start with our pre shared key configuration.
Again, when we looked at our options, our methods, we started with pre shared
key.
So we're going to scroll down here and this authentication key management is
going to be one of the primary configuration boxes.
We're going to spend a lot of time in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to spend a lot of time in.
And the reason for that is because we're going to enable 802.1x in here.
We're going to enable pre shared key.
We do see some options, some other options in here as well.
In fact, let's just go ahead and talk about some of these.
So real quick, we have Cisco centralized key management or CCKM.
CCKM was a way to share credentials between access points which would stream
line our roaming process.
But as we see here, Cisco is going to deprecate that because it's kind of old WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But as we see here, Cisco is going to deprecate that because it's kind of old
at this point and we really shouldn't be using it.
Instead, we should be using fast transition, which is the industry standard 802
.11r and it allows us to very seamlessly roam bypassing credentials between
access points.
It's the same thing that Cisco's solution did.
We just don't need Cisco's proprietary solution anymore.
So that's where we see FT down here.
FT is talking about fast transition.
So maybe I'd want fast transition with pre shared key or fast transition with
802.1x. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
802.1x.
So these are our options.
We also see a couple of other acronyms.
We see OWE, which is opportunistic wireless encryption, and we see SAE, the
simultaneous authentication of equals.
These are WPA3 concepts and they're actually pretty cool.
SAE is basically a new version of pre shared key.
It's where I just enter a key and I share that with everybody and that's my
authentication and encryption method.
The difference is SAE makes it so that we don't use the pre shared key to
derive the encryption keys, meaning that the encryption keys are derived out of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
derive the encryption keys, meaning that the encryption keys are derived out of
band.
And therefore, if you and I both have the same key, I can't decrypt your
traffic.
You can't decrypt my traffic.
It's a lot better than the pre shared key system of WPA2.
Now, is it still a pre shared key?
It is, but we use this fancy term SAE and so we use that instead.
OWE is really cool.
So OWE is the concept that I should be able to go again to a cafe or something. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So OWE is the concept that I should be able to go again to a cafe or something.
And if it's open Wi-Fi, where I don't have to use a password to join, remember,
pre shared key helps us derive the encryption keys.
Well, WPA3 separates that and suggests, hey, rather than just saying, hey, if
you either have to use the same key for everybody or you have to use no key,
and this is encrypted, but everybody has the same key, this is not encrypted.
And everybody can just listen to each other.
Well, why not say, okay, we don't need a password to join, but you will still
negotiate an encryption key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
negotiate an encryption key.
And that's what OWE is.
It allows us to join a open wireless network.
And yet, I still encrypt my traffic to the access point because why broadcast
my wireless traffic in a way everybody can understand.
So a little bit about WPA3 thrown in there, really outside the scope of the
course, but it is how our modern wireless networks are doing security and it's
certainly where we're going.
So we see SAE and OWE.
We know we're talking about WPA3 here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We know we're talking about WPA3 here.
So in our case, we're going to keep things simple.
I'm just going to configure a pre shared key.
So that's what PSK is right here.
Now we are seeing some information in here about WPA3 security and SAE and PSK
and such.
And so in order to basically make pre shared key work because that's a WPA2
concept, I'm going to have to come up here to WPA parameters.
This is where I can take a look at WPA, WPA2 and WPA3 configurations and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is where I can take a look at WPA, WPA2 and WPA3 configurations and
ultimately enablement.
So if I uncheck WPA3, notice my errors go away.
That's because I'm choosing to run WPA2 mechanisms and not WPA3.
So I checked the PSK box, I scroll down, I see that my PSK format, I can
technically put it into hexadecimal.
Usually we leave that as ASCII.
And now I'm ready to enter a pre shared key.
Something like CBTN1234, there we go. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Something like CBTN1234, there we go.
Notice that if it's ASCII, it has to be at least eight characters long.
So CBTN1234 lowercase CBTN, that should work fine.
So I'm going to say apply to the device.
So now that I have the WLAN configured, I have to remember that this is iOSXE,
it doesn't automatically get pushed out.
I have to deploy this using the policy tag.
So I'm going to come down to my tags and I'm going to just modify the default
policy tag here and say I'm going to add my...
...WLAN profile to my policy profile and we'll use the lab configured one and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
...WLAN profile to my policy profile and we'll use the lab configured one and
then apply to the device.
So at this point, we should have our access point broadcasting our SSID.
And so let's go ahead and go take a look at that.
By looking at the bottom of my screen here, I'm going to pull up my Wi-Fi
options.
And I do see that CBTN iOSXE SSID.
So I can click on this, say connect, it's going to require that security key of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I can click on this, say connect, it's going to require that security key of
CBTN1234.
If I hit next, I should be able to join, maybe I shouldn't have shared on this
very suspicious network that I'm joining, but, you know, is what it is.
So we will be able to join and here we go.
We are connected via that pre-shared key.
So that is iOSXE PSK.
But let's go ahead and show the configuration for our 802.11 and what is
ultimately WPA Enterprise.
So let's go and go back to our WLAN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go and go back to our WLAN.
Click on it here.
Go to the security tab and we're going to scroll down.
So now I'm going to uncheck the PSK box and I'm going to check the 802.1x box
over here.
Now notice there's nothing for me to configure on this screen.
That's because I have to come over here to this other sub tab, the AAA tab, and
this is where I need to select, well, this is interesting, an authentication
list.
What's going on here? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What's going on here?
Well, the reality is that, again, iOSXE is trying to use its normal mechanism
for configuring AAA and radius and TAC-AC servers.
Meaning that I can't actually select a server that can't enter my own server IP
address here.
I'm actually going to have to close out of this and go perform that
configuration.
So let's go ahead and go to configuration.
Look in the security section and specifically AAA.
So my goal is to simply get a radius server or a TAC-X plus server connected
into the WLAN for the sake of 802.1x. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into the WLAN for the sake of 802.1x.
So what I'm going to do here is I'm just going to configure a radius server by
saying add here.
And we're going to add a name for the server.
This is just for reference purposes.
I'll just say CBT-N, maybe lab, and then the IP address, I'm just going to
create a dummy address since my lab doesn't have a radius server, 10, 0, 0, 1,
and then the secret key.
So this will just be something like CBT-N 1, 2, 3, 4 again.
And I can change the ports if I need to or any other configuration tuning for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I can change the ports if I need to or any other configuration tuning for
the most part.
I'm just going to hit apply and now I have a server.
But again, iOSX-E likes to refer to server groups. And so I'm going to have to
come over to server group, hit add, create a CBT-N radius group.
And from here we can add the server I just configured. Again, this is where
that name shows up.
It's important for reference there. Put it into the assigned server's window.
And now I have created a server group that has all of my radius servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now I have created a server group that has all of my radius servers.
In theory, I might have more than one server over here. I can add them all into
the same group.
But we're not actually done yet. We have to go over here to this AAA method
list.
So the AAA method list is basically telling the server how to go about
referencing different server groups.
So we think about the AAA command in iOSX-E that allows us to specify a check
radius and then check tacks, and then maybe check nothing or something along
those lines. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those lines.
And that's exactly what this method list is doing is it's thinking along the
lines of iOSX-E configuration and saying, "Okay, where should I start and what
should I check in what order?"
And so what I'm going to do here is just edit the default. We'll just go here.
And we see that, well, there's, it looks like, radius is there already.
I'm going to move my radius group into here. And I could add more TACX servers
or radius servers.
But again, I have just told the wireless lane controller that I'm essentially, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But again, I have just told the wireless lane controller that I'm essentially,
I'm just really going to want you to check this one group full of servers.
In this case, it's one server, but it's this group. I can also fall back to
local authentication and create local usernames and passwords.
But I'm just going to configure that. And that is what we had to do from a
security AAA perspective.
So now I'm going to go back to configuration and WLANs, click on my WLAN, go to
my security tab, and scroll down. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
my security tab, and scroll down.
Now I'm going to uncheck PSK, add 802.1X. Remember, now go over to AAA to
finish this.
This authentication list is now going to give me what the list that I created.
Now I edited the default.
We could certainly have created our own. I'm just going to select this. And
that's it.
Because the list defines the order of operations, which groups to check and
what order and what those IP addresses are, it's all wrapped up in this one
dropdown. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dropdown.
And so I can say update and apply to device. And now we can see over here,
could have seen this earlier as well.
So it showed WPA2 and PSK with AES encryption. Well, now it's showing us WPA2
with 802.1X and AES.
And since the radio server is a dummy address, I'm not going to be able to test
this.
But this is how we would log in using one of the EAT methods that we've talked
about by either providing username and password or possibly a certificate.
But this is our WLAN security configuration iOSXE. So much of it just comes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But this is our WLAN security configuration iOSXE. So much of it just comes
down to picking our method.
Going to the security tab layer two. And after we decide which version of WPA
we're going to use,
figuring out how to configure the authentication key management section, making
sure to either check, let me get rid of that, either check PSK or 802.1X at
which point we need to make sure AAA servers are properly configured.
[BLANK_AUDIO]