Alright, next up we're going to dive into wireless security.
Remember on the blueprint, wireless security happens later on, but it just made
sense
to cover it all at once.
So, we're going to want to make sure that we keep all of these security
concepts in
mind as we advance through the blueprint and eventually cover security.
But either way, let's go ahead and jump into this.
So again, pause the video as often as needed in order to make sure you can
answer these
questions yourselves.
So first up here, out of eight questions again, which security mechanism is
used to control
access to the wireless network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access to the wireless network.
A big part of the conversation that we had had to do with authentication and
encryption
being two of the key security concepts required for wireless security.
Because I might have an access point that is radiating outward.
It doesn't just communicate in a straight line to the laptop, but rather it
radiates
everywhere.
And if this access points against the wall, then there could be cars out here
in the parking
lot that will receive that RF signal.
Trying to limit the RF signal would be useful, but it's ultimately going to be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Trying to limit the RF signal would be useful, but it's ultimately going to be
impossible
to fully contain within the walls of our organization.
As such, making sure that we have good authentication and good encryption will
be required.
Encryption for the sake of data privacy, allowing us to communicate freely with
the access point
in such a way that the message gets garbled.
So anybody else listening to the same message is not going to know what it says
.
It's just standard encryption in that regard.
But authentication is all about access control, making sure that I am who I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But authentication is all about access control, making sure that I am who I
claim to be.
I can't just say that I'm the CEO or for that matter, just any staff member,
but rather
I have to prove it.
And we have lots of ways of proving it.
We could do a username and password.
We could do certificates, multi-factor authentication, lots of ways to prove
that I belong on the
network.
And all of that falls into the category of authentication.
So as we talk about different security mechanisms, for example, WPA, personal
versus WPA enterprise,
we start to see how these different mechanisms handle authentication and how WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we start to see how these different mechanisms handle authentication and how
they handle encryption.
And the way that enterprise does it is a whole lot more scalable than personal,
which is
why we certainly want to be deploying WPA enterprise when we can in our
corporate networks.
All right, question number two, which wireless security suite is based on the
use of a PSK
otherwise known as a pre-shared key.
Well the PSK is synonymous with WPA personal.
So that would be C. PSK, that whole concept is the idea that I connect to a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that would be C. PSK, that whole concept is the idea that I connect to a
wireless network
and I simply provide this password of sorts.
I can put that in quotes.
It's basically the wireless password that allows me to log in.
So if I go to a public cafe, oftentimes they'll say, hey, here's the SSID and
here's the network
password.
Well, this password is really the PSK, which is why we're referring to it here
in air quotes
because it's not technically a password, but it is a pre-shared key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because it's not technically a password, but it is a pre-shared key.
And the reason why we emphasize that is because this key is going to be used to
derive the
actual encryption keys.
This isn't desirable.
This is one of the main reasons we want to move away from WPA2 in these types
of networks,
although this doesn't impact WPA enterprise.
It only impacts WPA personal.
So for a variety of reasons, a lot of which we've gone into depth on, WPA
personal should
not be deployed into our corporate networks.
Instead, PSK's and the use of WPA personal, this should be reserved for our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Instead, PSK's and the use of WPA personal, this should be reserved for our
small office,
home office types of environments where we don't necessarily have access to a
radius
or tack X plus server.
Instead, in our corporate networks, we should be deploying WPA enterprise,
which does not
require a PSK, but it does require the use of those authentication servers.
Question number three, which device serves as the supplicant keyword there in
the 802.1x
architecture? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
architecture?
So let's think back.
802.1x defines this architecture where we have a device logging in to another
device,
which might be the access point.
It might be the wireless LAN controller.
And then we have an authentication server over here running radius or possibly
tack X
plus.
So the 802.1x architecture assigns labels to each one of these.
So the supplicant is actually here.
It's going to be the client who's trying to connect to the network.
So that would be our supplicant here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that would be our supplicant here.
And then we have this phrase for the device in the middle.
It is the authenticator.
So this could be the access point, but in a lot of cases, especially in the
lightweight
architecture, it will actually be the wireless LAN controller.
It will get that request will get handed off from the access point to the
wireless LAN
controller.
But either way, whether it's the WLC or the AP, that would be the authenticator
.
And then this over here, whether we're running radius or tack X is known as the
authentication
server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server.
So we do need to keep these roles in mind.
This is what the 802.1x architecture defines for us, but then it's EAP that
ends up defining
for us how exactly we're authenticating.
But as long as we have this architecture, we can deploy WPA enterprise.
This is what's required for WPA enterprise is making sure we have an
authentication mechanism
thereby making it so we don't have to authenticate with the pre shared key
anymore.
But rather we can authenticate using our corporate accounts or whatever we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But rather we can authenticate using our corporate accounts or whatever we're
going
to use for the sake of authentication.
And that makes things a whole lot more scalable and a whole lot more granular.
All right.
Next question.
When running WPA enterprise, what is the primary goal of the WPA four way
handshake?
So the famous four way handshake with WPA, when I first tried to initialize
communications
with the access point, the access point is going to trigger the WPA four way
handshake.
And it involves four different messages that go back and forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it involves four different messages that go back and forth.
And the primary goal of the four way handshake is to here be derive the
encryption keys.
Remember, the PSK is not actually used for encryption directly, but rather it's
used
to derive the encryption keys, which will then create or be used for encryption
.
However, that is for WPA personal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, that is for WPA personal.
So it doesn't really matter whether we're talking about personal enterprise.
I called out enterprise here.
And the primary reason I did that was because in enterprise, the PSK having
that also authenticates
the user.
So in that sense, with personal mode, the PSK sort of serves both.
It serves to authenticate because, hey, I have the PSK PSK and therefore I
belong on
the network.
However, I also use the PSK to derive the encryption keys and then I can
encrypt and decrypt my
traffic that way. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic that way.
However, in the enterprise space, remember, this four way handshake follows the
802.1x
back and forth.
So the messages look kind of like this, where we have a bunch of messages going
back and
forth for 802.1x.
And this handles fully the authentication process.
Only if I properly authenticate do I then get to do the four way handshake at
which point
the sole focus to the sole purpose and focus, that was a combination of those
words, the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
words, the
sole purpose and focus of the four way handshake is to derive the encryption
keys, which will
allow us to encrypt and decrypt our traffic.
Question number five, what are the primary limitations of PSK that prevent it
from being
useful in enterprise networks choose to?
Well I just sort of alluded to this, but when we're talking about PSK being WPA
personal,
it's going to be a challenge for a couple of reasons.
First of all, be here, rotating keys doesn't scale well at all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
First of all, be here, rotating keys doesn't scale well at all.
So if we think about it, everybody who has the PSK I just said, therefore is
able to,
or by the definition of having the PSK is able to authenticate to the network.
And so if we're able to authenticate to the network with the PSK, that means
anybody who
ever has that PSK can authenticate and gain access.
And that's a problem in the enterprise space.
People come and go all the time in enterprise networks.
And so I might be a consultant, I might join the organization and quit two
weeks later. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
weeks later.
And meanwhile, I was given the pre shared key.
And so does that mean that I as a temporary employee or just for that matter,
somebody
who was listening to a conversation.
Now that we have the PSK, we are forever able to authenticate to the corporate
network.
That's not a good deal at all.
So we'd want to at that point change the pre shared key, but imagine doing that
to dozens
if not hundreds or thousands of devices, that would not scale well at all.
It's one of the biggest limitations that we have just from a practicality
perspective.
But we also have the low granularity for individual users. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we also have the low granularity for individual users.
So I can't actually do anything from an individual user perspective.
I can't remove individual users.
I can't add individual users.
It all comes down to who has the PSK.
So they're definitely tied together here.
But at the same time, these would be two very good reasons for avoiding WPA
personal and
enterprise networks.
And I do keep in mind, it does encrypt just as well as WPA enterprise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I do keep in mind, it does encrypt just as well as WPA enterprise.
It also does have an authentication mechanism.
We can't say it lacks one.
It does have one.
It's just not very effective.
And it absolutely is available on Cisco hardware.
We can configure it if we so desire.
And there might be situations, especially for guest networks, where it makes
sense to
configure the pre shared key type of methodology.
It allows our users to gain access to the guest network just by way of a PSK.
So we're not going to be held back by those other options.
However, for the enterprise side, especially our internal users, we usually at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, for the enterprise side, especially our internal users, we usually at
all costs
want to avoid using WPA personal.
All right, we're in the home stretch here.
Three more questions.
WebAuth is considered to be security deployed at which layer.
So this especially is going to be useful to us in the graphical user interface
in the
wireless LAN controllers.
Because when we're configuring things, we get these tabs and the different tabs
allow
us to configure different aspects of the configuration.
One of those is going to be layer two security and one's going to be layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
One of those is going to be layer two security and one's going to be layer
three security.
And so how do we go about knowing where which options are where?
Well, we're talking about web auth.
That is layer three security because layer two security is anything at the
actual Wi-Fi
or 802.11 layer.
These are going to use the phrase that's properly named, I suppose, which is Wi
-Fi protected
access.
So WPA is tied directly into the protocol at layer two.
And that's where wireless stops. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's where wireless stops.
This is a wireless physical layer and has its own headers at layer two being
802.11.
Wireless Ethernet headers is what they're known as.
And so that's the end of it.
And so if we say, hey, guess what?
We're going to have absolutely no security here at layer one or layer two,
especially
layer two.
At that point, we might want to deploy security that happens outside of the
wireless layer,
which would be our web authentication that happens at layer three. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which would be our web authentication that happens at layer three.
So web auth is at layer three, WPA is at layer two.
And again, that's going to help us navigate around inside of our wireless LAN
controller
interfaces.
Next question for both iOSXE and iOS, where can the security method be
configured for
the SSID?
Well, all SSID configuration is going to happen at the WLAN.
So A is going to be our answer here.
Now it looks a little bit different between iOSXE and iOS.
However, keep in mind that AroS was used as an inspiration of sorts, or maybe a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, keep in mind that AroS was used as an inspiration of sorts, or maybe a
foundation
for iOSXE's graphical user interface.
The big difference is on the back end, AroS commands look a whole lot different
than
iOSXE commands, which look like and feel like we're on a switch.
And so some things are going to be a little bit different, but graphically,
visually,
some things will look very similar.
And this is one of them.
So as I just kind of drew out here, we're going to go over to the security tab.
And then we'll see these individual tabs, including layer two and layer three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll see these individual tabs, including layer two and layer three
security,
where I can configure my WPA or I can configure my web auth, as well as triple
A aspects.
That all happens inside of the WLAN.
And although we're going to need to configure site tags in iOSXE, AP groups in
AroS, the
triple A is still going to be important because we need to configure our radius
and tack
acts servers.
But as far as deciding the security method to use, that all happens within the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But as far as deciding the security method to use, that all happens within the
WLAN.
And last question, when configuring WPA enterprise on a Cisco wireless LAN
controller, what other
configuration must be provided?
Well, at this point, enterprise we should know does not use a pre shared key.
The question is what does it use?
Well, enterprise is going to require the use of that 802.1x architecture, which
involves
not only the supplicant and the authenticator, maybe the wireless LAN
controller in this
case, but also this server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
case, but also this server.
The server is either running radius or tack X plus, but either way, we
typically refer
to this as a triple A server, or at least we can.
So D here is the answer.
It's going to require us configuring a radius server or configuring a tack X
plus server
and making sure that we are our authenticator, the wireless LAN controller
probably is able
to check in with it to find out, hey, is this user allowed on the network?
The radius and tack X server will store all of that information. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The radius and tack X server will store all of that information.
So this was a review over the security of the wireless.
It would only really cover a couple of skills, but there was a lot of
information in those
skills.
So if you have these questions, trip the alarm, say, oh, I better go review
that, then again,
the source is at the bottom of every single question, be sure to go back and
review that.
And from here, what we're going to do is jump into the lab and make sure that
we remember
how to configure everything wireless.