With software-defined networking,
it would be awesome to just to hit a button and say, yes,
I want to do 802.1X authentication.
Make it happen.
However, until that's in place, what I'd like to do is walk you
through some of the commands from a AAA perspective
and dot1x perspective in global config that we want to put
on a switch to go ahead and have it be able to do 802.1X
authentication in coordination with a AAA server.
In our case, that AAA server is going to be running RADIUS,
and it's the Identity Services Engine.
Let's take a look at our topology. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's take a look at our topology.
And I'll walk you through several of the commands
that we're going to need to implement.
And to put this in perspective, what we're configuring
is this bad boy right here.
We have the Identity Services Engine already configured
for 802.1X.
We did that in a previous set of videos.
And now we're going to be focusing on this switch.
Now, at the moment, this switch is a little eight-port switch,
nothing too fancy.
And as we progress and do additional features,
we just want to make sure that any feature we want to use
on the switch, like 802.1X or if we want to use TrustSec
or MACsec, you'd want to make sure that the actual switch WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or MACsec, you'd want to make sure that the actual switch
hardware and software supports those features before we try
to implement them.
Well, I've done the testing.
This switch does support 802.1X authentication.
Let's take a look at a few of the commands
that we need to implement to make
that happen in conjunction with our Identity Services Engine.
And to help us along in this process,
I've got a console here to our switch.
Let's do a show version.
And it's a 3560 switch.
And it supports the features that we need.
Also, let's do a show users and just
verify that I am connected as admin. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
verify that I am connected as admin.
And I'm connected logically on line vty 0.
Do a show ssh.
Press Enter.
I'm currently using SSH for this remote access.
So let's keep that in mind as we implement these commands
for AAA and 802.1X.
Let's start off with global configuration.
We're all familiar with this bad boy.
This is config t.
And I'm using Visual Studio Code or VS
Code as a nice holding tank for some of these commands.
But you could use notepad.
And what I did was I just went out to Cisco's documentation
for 802.1X, went through the commands.
There's a lot of them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's a lot of them.
And I just pulled a few in that I thought
would be relevant for discussing and also a few
that are required to make this all work.
So config t.
We're going into configuration mode.
The first thing, right off the bat,
we want to create a user account that has King Kong
rights locally on this box.
That way, if we need to log in with a local account,
we've got a user with privilege level
15 access that we can go in with.
Next, we're enabling aaa new model if it isn't already.
We're going to enable new model.
And that allows us our additional AAA commands,
including this guy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including this guy.
Now, this one right here doesn't really
apply to dot1x authentication.
But it does apply if we want to remotely connect to this box.
So I'm creating a default method list for logins.
This says aaa authentication for any login--
like, for example, on the vty lines, through Telnet, or SSH.
We want the default method to be the local database.
That's what this say.
And the local database has this one user account,
at least, because we just created it.
Or we will when we apply these configs.
So that basically says that when we connect via the vty lines, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that basically says that when we connect via the vty lines,
we can log in as user admin, and we'll have King Kong rights,
assuming we know the password.
Next, let's take a look at the default method
list we're going to use for dot1x authentication.
So at some point coming up in the next video,
we'll apply dot1x authentication and enforce it on the ports,
like Fast Ethernet 0/1 and 2 and so forth.
And what line 7 says is that the default method
for dot1x authentication is to use a RADIUS server or one
from a group of RADIUS servers.
If you just have one, it's still going to be the same syntax. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you just have one, it's still going to be the same syntax.
This says that the authorization for network access, the default
method, is going to be using a RADIUS server once again.
And our RADIUS server is the Identity Services Engine.
And we've also enabled accounting
using that same RADIUS server.
All right.
So the next problem is if we're telling these method lists,
these default method lists, to use a AAA server,
we should create at least one AAA server, which
is going to be our ISE server.
Let's do that next.
So that looks like this from the configuration perspective. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that looks like this from the configuration perspective.
So here is radius server Our-ISE, just a name.
And then we'd specify the address
for that server, which is 192.168.1.105.
And if you don't want to use the default ports
or you want to be sure what the ports are for authentication
and accounting, you can go ahead and specify them right here.
So I specified 1812 and 1813.
And then we specify the key.
I'm using this key for the RADIUS key.
And I'm also specifying an automate-tester.
Now, this username doesn't have to really exist.
But this allows this device, the switch,
as a network access device, to go ahead and probe periodically WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as a network access device, to go ahead and probe periodically
to the server just to verify the server is alive, awake,
and well.
Now, even if that user doesn't exist,
we can still get a negative message back
from that server, which implies that ISE is still up, alive,
and well.
So this is an example of creating one RADIUS server.
And if you add multiple RADIUS servers,
you could tuck them all into a group.
And that's what I've done right here,
aaa group server radius, and gave it the name of Our-Group.
And then I tucked inside of it this RADIUS server
called Our-ISE as a nested element inside this group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
called Our-ISE as a nested element inside this group.
Now, one of the challenges is that if the RADIUS server is
no longer online, it's not reachable for some reason,
we want to be aware of that.
And so we can set the timers for how often should it check
and how many times should it check before it gives up
on that server.
And that's what rows 21 and 22 are all about.
Row 23 is aaa server radius dynamic-author.
And what this is about is change of authorization.
If there's a change that happens later
on regarding the user or some other account, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on regarding the user or some other account,
line 23 allows the switch to implement that COA,
the Change Of Authorization, should the need arise.
And as part of that, we specify the client--
this is the actual switch's IP address--
and the server key as part of the COA
or the dynamic authorization that we've just set up.
All right.
Now, this command right here, ip radius source-interface,
not required.
And here's why the ip radius source-interface option is
helpful.
We may want to source this traffic, these RADIUS requests,
from a loopback address.
And that way, if we lose a single physical address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way, if we lose a single physical address
but we still have path between ourselves and the ISE server,
we can still communicate.
But we don't want the IP address that we're
sending from to change based on an interface going up or down.
So whatever IP address we used on the ISE server,
we'd want to specify that interface with that IP address
as the source interface for the RADIUS requests.
Lines 30 and 31 allow us to send and receive
vendor-specific attributes between the ISE server
and this network access device, this switch.
And this global config command of dot1x system-auth-control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this global config command of dot1x system-auth-control
allows the switch to be able to do 802.1X authentication
assuming the details for the authentication are implemented
at the interface, as well.
And row 34 here, ip device tracking,
that tells the switch, go ahead and track the MAC address.
For example, let's say somebody authenticated on port fa0/1.
Life is good.
And there's a downloadable ACL associated with that device.
IP device tracking periodically will use ARC messages just
to verify that that address that is in use by that device WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to verify that that address that is in use by that device
is still present and responding and is still there.
And that is the configuration or global config.
So just to verify all of that, if I took all of that
up to that point and just right clicked--
go ahead and copy, and let's go paste that in.
So we'll right click.
We'll click on Paste.
I'll verify I have a config t there.
Fantastic.
And here we go.
Now, in addition to the global configuration commands
regarding AAA and dot1x, we also need to do some special WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding AAA and dot1x, we also need to do some special
commands for the interfaces where we want 802.1x
authentication to happen.
So to do that, we'll take a look at those commands in the very
next video followed up by verification
that the global configs, the interface configs,
are all working as a whole.
And we'll look at that at the CLI of the switch.
We'll look at it from the perspective
of the client, the supplicant.
And we'll say take a look at it from the perspective
of the authentication server, the ISE device itself.
So we'll continue this discussion
about the interface configs in the next video.
Meanwhile, I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.