In this video, I'd like to share with you a few details about
this protocol called 802.1x, explain why it matters,
and a big picture of how it works.
So let's use this drawing.
And let's start with a user like Bob.
Now, think about for a moment, how does a user normally
get access into the network?
There basically is two options.
One is they have a networking device that
is wired into a device, such as a switch,
or they are connected with a wireless adapter
through an access point, which in a corporate environment, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
through an access point, which in a corporate environment,
that's the radio frequencies for the Wi-Fi network.
And that access point is connected
into a switch, which then leads to a wireless LAN controller.
And that's where they get access into the network.
So our goal would be, whether it's
a wired connection or wireless, it
would be ideal if we could identify and authenticate
the user Bob before he just goes crazy on the network
and starts doing attacks on the network.
We want to identify who he is, and then control his access
once we find out who he is.
And there is a standard set of protocols
that we can use to do that.
And it's referred to as 802.1x, as in X-ray. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's referred to as 802.1x, as in X-ray.
So by using 802.1x we have the ability to identify who
the user is before we give them access onto the network.
And let me explain the basic pieces that are involved
in this network authentication authorization with 802.1x.
One element is we're going to have the device that's
going to be used for individuals to get on the network.
So in this example, it's a switch.
Now, that could be a multilayer switch, S-W-I-T-C-H. Great.
It could be a multilayer switch or a layer 2 switch.
But this is where the user is connecting into the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But this is where the user is connecting into the network.
And by default, switches just have ports.
They're normally assigned as access ports
in a specific VLAN.
These are connected.
And boom!
They're on the network.
However, what we can do is we can
use the role of an authenticator on that switch.
Now, an authenticator is simply a fancy way
of saying the device who's going to ask the person who's
connecting for credentials.
So this authenticator running software
or being configured to support it when Bob connects,
the authenticator would start asking questions,
like, hey, I think I need to know who you are, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like, hey, I think I need to know who you are,
and some information about you.
That's the authenticator's role.
In this example, it's the switch acting as the authenticator.
Now, Bob, the user, doesn't probably
know a lot about the details behind the scene
when the authenticator, the switch
is asking about who he is.
But his computer, if it's running some software--
there's a fancy name for it.
They call it a supplicant.
That software, when it gets these requests
from the switch--
and sometimes a supplicant can be third-party software
or it can be built in the operating WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or it can be built in the operating
system for the network adapter.
In either case, the supplicant running on Bob's computer
is going to go ahead and interact and work
back and forth with the switch.
So in this supplicant, it may prompt
the user for their identity, their username and password,
for example, or it may be pre-configured
with information about Bob, or about this device.
So as part of 802.1x we have the authenticator,
who is asking questions through the 802.1x protocol,
to the supplicant, who's answering those questions.
And effectively, if it's the user Bob,
that information is communicated over to the authenticator WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that information is communicated over to the authenticator
along with the password for Bob.
Now, one of the problems is that Bob
could be connecting to this switch one day,
and another switch another day, and how do we centrally
manage all that?
Well, the third part of the 802.1x is this bad boy right
here, the authentication server.
So here's what happens as the supplicant on Bob's computer,
the software, supplies the information
that the authenticator is asking for, once that information is
retrieved, the authenticator is then
going to go ahead and forward that over to an identity
server.
Now, in this example, it's going to be ISE, the Identity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, in this example, it's going to be ISE, the Identity
Services Engine.
And the protocol used right here is going to be RADIUS.
So effectively, think of it like the authenticator who says,
well, I know Bob's username.
Bob sent me his password.
Now I'm going to check with the server, which
also could be referred to as a AAA server, a RADIUS server.
ISE is an example of a RADIUS server and a AAA server.
And then the RADIUS server, after it
checks the credentials, it can go ahead and send back
a message to the authenticator and say, you know what?
Bob checks out.
Go ahead and give him access on this port right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Go ahead and give him access on this port right here.
And in addition, besides just the authentication of Bob,
we could also push down rules regarding authorization as well
that state things like, oh, yeah,
Bob's got this downloadable ACL applied to him,
or Bob's supposed to be in VLAN 30,
or VLAN 80, or whatever VLAN we want
to assign for that port dynamically based
on the authorization for Bob, who's coming in on that port.
Or if we're using a feature called TrustSec,
we could also push down to the switch
the security groups that Bob is associated with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the security groups that Bob is associated with
to further enforce policy.
So let's summarize.
The three basic parts of 802.1x authentication for this network
authentication and authorization is some type of software
that's running at the client acting as a supplicant.
Think of a supplicant like supplying the username,
and password, and credentials.
The switch in this example is acting
as the authenticator who's asking for that information.
And then the ISE server is acting
as the authentication server, where the switch takes
that information, ships it over to the authentication server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that information, ships it over to the authentication server,
and says, hey, are these credentials all good?
And if so, what type of authorization
should I allow for this port that the user
is trying to connect on?
That's the basics of 802.1x.
Now, check this out.
Not every device that's connecting to our network
is going to support a supplicant.
Maybe it's an operating system that
doesn't have a built-in supplicant,
or maybe it's a device that can't
run a supplicant, like a printer, or an IP
camera, or something else.
What do we do for that?
Well, we can also set up our switches to try 802.1x,
and say, hey, are you there? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and say, hey, are you there?
Are you there?
And if they don't respond using the 802.1x protocols,
we can then--
after a short timeout, we can then say, you know what?
Let's go ahead and check out your layer 2
address, your MAC address.
And we can do authentication based on a MAC address that's
expected.
Think of it like this.
Think of a security gate with a car coming up.
And the guard is looking at the driver and saying,
I need all your information.
Who are you?
The user says, the driver says, I'm Bob.
And the security guard looks it up and says, great.
Yep, you're good to go. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yep, you're good to go.
Now, that would be an example of 802.1x.
However, if we'd had a device that didn't support 802.1x,
it'd be sort of like a car driving up to the security
gate, and the security guard not paying attention to the driver,
just looking at the license plate, and saying, yep,
that license plate checks out.
Come on in.
And that is referred to as MAC, as in MAC address,
MAC authentication bypass.
We're just going to authenticate it based on the MAC address.
It's not as secure as 802.1x, but it's an important feature
to be aware of and have for all those devices on our networks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to be aware of and have for all those devices on our networks
that just cannot run a supplicant and participate
in 802.1x.
So that's what I wanted to drive home in this video was
the concept of 802.1x, finding out who the individual is
before letting them on the network,
and also in the absence of to 802.1x,
using a feature called MAC authentication bypass.
Now, one other aspect is this.
If we do have a client, like Bob and his computer,
and there is a supplicant there, there are a lot of options
regarding 802.1x that we can choose to use as we talk back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding 802.1x that we can choose to use as we talk back
and forth between the authenticator, the switch,
supplicant, which is running on the client's computer,
and the AAA server.
And we're going to take a look at those options,
including extensible authentication
protocol in the next video.
I'll see there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.