The heart and soul of getting 802.1x to work is having
a supplicant on the end device that can interact with
our switch or device acting as the authenticator so we can get
the ball rolling.
And we ship off that information to our identity server,
who then says thumbs up or thumbs down, and allows
us to authorize that user on the network.
Now, when we're setting up 802.1x,
there is a suite of protocols in the family of EAP.
And it stands for the Extensible Authentication Protocol.
And the point I want to drive here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the point I want to drive here
is that if you have a supplicant that only supports
two or three options, you'd want to use those two or three
options.
However, at the identity services engine,
who's getting all these requests from the authenticator,
we also want to make sure we're supporting the options that
are needed for those clients.
So what I'd like to do is share with you
a few of the popular EAP options,
the extensible authentication protocol,
and also give you a sneak peak into a client,
and also on the identity services engine
to show you what they look like.
So this is Bob's computer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is Bob's computer.
And I've got control panel open so we
can take a look at the details.
So this is the interface I'd like
to focus on here for a moment.
So this Windows machine is configured to support 802.1x.
And if we want to modify the parameters on the supplicant,
we can right-click on that interface and go to properties.
And if 802.1x is currently set up,
it's going to have this option right here for authentication.
And then, you just simply check the check box that says Enable
IEEE 802.1x Authentication.
And then we can select the method that we want to use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we can select the method that we want to use.
Wow.
So based on a Microsoft client, we're
going to have a certain set of options
or extensible authentication protocol.
And let me point out a couple.
This right here is EEP TTLS, Which
stands for Extensible Authentication Protocol
Tunneled TLS, which TLS implies some security
in a encrypted tunnel.
Another one right here is the Microsoft Protected EAP.
Also known as PEAP, for Protected EAP.
And this was developed by Cisco, Microsoft, and also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this was developed by Cisco, Microsoft, and also
[INAUDIBLE].
And it was a joint effort.
And that's why we have it here on the Microsoft client.
So let's imagine that we select Protected EAP
for the authentication type that we're going to use for 802.1x.
If we click on Settings, check this out--
within Settings, we can also then verify
the authentication method within that EAP, in our case
Protected ERP.
And so these are the ones that are
built in that are supported under Protected EAP, which
is a secured password using EAP MSCHAP version 2
or a smart card or other certificate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or a smart card or other certificate.
And if we want to specify the password,
I'll go ahead and click on Cancel.
I didn't make any changes there.
If we want to configure the password for this,
we can click on Additional Settings.
And then here under User Authentication,
click on Replace Credentials.
Then we could put Lewis, or Bob, or whoever's connection
this is.
I think this is Bob.
So we'll put in Bob.
Put in his password, click on OK.
And then to verify it, we could go ahead.
Right there it says attempting to authenticate.
So we could disable it for a moment, bring it back up, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we could disable it for a moment, bring it back up,
and in the background, if the authenticator is set up,
which is the switch port we're connected to,
and the AAA server, the authentication server,
is all set up, we be able to successfully authenticate Bob.
So we could look at the authenticator and verify that.
And we could also look at the authentication server, which,
in our case, is ISE, to verify it.
In fact, let me give you a sneak peek at both of those.
Let's take a peek at the authenticator.
So this is the switch that Bob is using
to get access into the network.
So the switch is configured as an authenticator.
And if we do a show authentication sessions WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we do a show authentication sessions
and press Enter, it's going to give us details that hey,
here we have an authentication on G12/0/2, which
is where Bob is connected.
And if we did a show authentication sessions,
and we'll type in mac.
And then we'll supply Bob's mac address,
which we just saw here.
I'll copy-paste that.
And then we tack on the keyword of details,
it's going to show us all the details regarding
his authentication.
So we know it's Bob.
Fantastic.
There's his mac address.
The port is authorized, meaning the AAA server said, yep,
he's authenticated, and then assigning him some rights WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
he's authenticated, and then assigning him some rights
and permissions, including pushing down
parameters such as what VLAN Bob should belong
to, and also a security group tag, if we
have that configured.
So security group tags are used for TRUSSEC,
which we'll cover as well.
It also states down here the method that was used
for authentication, which was .dot1x.
We take a look at the Identity Services Engine--
and we'll have separate videos on how to configure and work
with this.
We can also look at the log files here,
just to verify what happened and also see that Bob successfully
authenticated.
So I'm going to log in to ISE, the Identity Services Engine. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'm going to log in to ISE, the Identity Services Engine.
And from here, if we hover over operations
and we go to the radius live logs,
because the language of love between the authenticator,
the switch, and this ISE server is radius.
So if you go to the live logs here,
this icon right there indicates a current session.
So Bob has authenticated.
If you want to see the details for that,
we can click on this icon right here for the authentication
detail report.
It will open up in a new window.
And sure enough, there is Bob.
There are some authentication authorization policy
sets that he was able to pass and get access through. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sets that he was able to pass and get access through.
And over here on the right, check this out.
Here it says extracted EAP identity.
There was a proposal for EAP TLS.
And if we scroll down, it said, nah, don't want to do that.
So it said, OK, let's do a proposal for PEAP,
protected EAP.
And then within that, if we scroll down further,
it'll use protected EAP to protect the conversation.
And then it used MS CHAP to protect the password
and credentials within that communication.
And also, one more little sneak peek into the world of ISE.
Let me share with you some of the defaults and options that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me share with you some of the defaults and options that
we have regarding to 802.1x, because the Identity Services
Engine has a plethora of options.
And normally our choices are going
to be limited by what is supported
by the supplicant of the client that it can use.
But we definitely want to make sure it's
supported on the Identity Services Engine as well.
And this is a list of the default network access,
or the default protocols, that ISE right out of the gate
is willing to accept.
So if we expand that--
my goal isn't here for you to memorize all these,
but simply to be aware that there's
lots of different options that the Identity Service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
lots of different options that the Identity Service
Engine supports.
So if we go down, here's allowed protocols.
There is EAP TLS, there's PEAP, there's also
LEAP, which was a Cisco proprietary method
for extensible authentication protocol.
The L is for lightweight.
So for the authentication for Bob,
we used PEAP and we also used the MS CHAP version 2, which
are both supported here by ISE.
And if we scroll down, there's EAP FAST.
And EAP FAST is another Cisco creation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And EAP FAST is another Cisco creation.
And it stands for the Flexible Authentication
via Secure Tunneling.
It was meant to replace Cisco's lightweight EAP, which
was LEAP.
And so with the EAP FAST, it's also
supporting the inter methods of MS CHAP 2
and some other options as well.
And if we scroll down, here is EAP TTLS,
which is the Tunnel TLS.
So the key is here there's lots of options when we're using
Extensible Authentication Protocol, or EAP,
in conjunction with 802.1x.
And most of those are going to be limited
by what the supplicant, whether it's a Microsoft WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by what the supplicant, whether it's a Microsoft
device or an Apple device or a third-party product,
based on what it can do.
And we want to ensure that ISE on the back end
also supports that.
And if we have policies that agree,
we can get that ball rolling and start
to do the authentication of Bob, which is important.
So the next question might be, well, Keith, what exactly,
based on authentication, what kind
of access rights, or permissions, or controls
can we implement if we've authenticated Bob?
That's a great question.
We're going to talk about that in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.