All right, so we're halfway done with the switch configuration
for 802.1x.
Our next step is on that same switch.
We'll take a look at the interface or port
configurations that allow the authentication
and authorization to happen on the switch.
And so here are those commands we're
going into configuration mode.
And I just want to make sure that on the switch
I've got these VLAN that they exist
and we can use VLAN 999 as a dead end, where we can just
put all unused ports there.
And then when we bring up other ports we get them authorized WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then when we bring up other ports we get them authorized
with 802.1x.
We can have the 802.1x authorization placed them
in the VLAN of our choice based on the authorization profile
being used.
So on this switch I've got fa 0/1-8 then we are all going
to configure the same as access ports.
We can do that with this command, switchport host.
That does a few things for us, including
that's why it's an access port.
And it also enables port fast at the same times.
So it's a little shortcut there, and then we'll
assign all those ports to VLAN 999.
So basically, unused ports even if they're up they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So basically, unused ports even if they're up they're
going to go basically nowhere.
Then we're going to specify lines 51
and 52 the authentication priority
and the authentication order.
We're going to use .1x to begin with.
But if .1x fails, we want to fall over to mac authentication
bypass that'll be for devices like printers, or cameras,
or other devices that don't have a supplicant,
but we still want to get their mac address in the system
and then authenticate them based on a specific mac address,
but we want to try .1x first and in the event of a failure like WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but we want to try .1x first and in the event of a failure like
of .1x.
We want the action to be next method so it'll do .1x.
If the client doesn't have a supplicant and can't perform
.1x, it'll time out and then the next authentication method
would be to try Mac authentication bypass.
Row 54 says, well, if the server's
dead we can't reach a radius server what do you want to do?
And the action is authorized VLAN 10 if the server cannot be
reached.
Though based on our environment we may want that be VLAN 10
or maybe we leave it in VLAN 999 it just depends on what you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or maybe we leave it in VLAN 999 it just depends on what you
want to have happen if the AAA server cannot be reached.
And if the triple-a server has gone away,
unreachable for a while, and it comes back now it's
reachable, what do you want to do?
Line 55 says, we want to go ahead and re initialize.
So now that the server is back on line
we're going to go through the authorization process
formally with that AAA server to verify
we have the correct people online
as far as the authentication and also the correct authorization
profiles are applied.
And row 56 authentication host-mode
depends on how you want it to behave.
Currently I have a set for a multi-domain. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Currently I have a set for a multi-domain.
Here's what that means.
It means, that if we have a voice VLAN and a data VLAN.
The devices on each of those VLANs
have to authenticate and be authorized before they're going
to get access to the network.
Then think of multi-domain like a voice domain, or a voice
VLAN, and a traditional data VLAN.
Other options would be single host,
which would mean just one device can get authorized.
We also have an option for multi hosts, which
means after one device authenticates and gets
authorized everybody else is like a free ride getting in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authorized everybody else is like a free ride getting in
through that port.
And there's also an option called multi-off,
which allows everybody to get on,
but everybody has to be authorized.
And that would include your voice VLANs
and your data VLANs, but every device
is going to be authenticated.
So our current setting here multi-domain.
We can have voice and data.
There's just one device per domain.
And if we have violations, what do you want to switch to do?
And restrict simply says send a log message
that we had some tried to get in and block that additional mac
address from being able to forward traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address from being able to forward traffic
into the switch.
And this command right here, authentication open,
it could be a lifesaver and it could also be devastating.
Basically, what this says is, if someone gain access to the port
and they do not have a supplicant,
so they can't do 802.1x what do you want to do?
And the answer is once the switch times out with its
802.1x and its mab authentication it would then
say, well I guess I'll just let it through.
Now the reason in a lab environment
this could be very, very helpful is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this could be very, very helpful is
that if you're rolling out or doing some testing
you can have this as a fallback in your config.
Make sure things is working and once everything's dialed in you
could remove this and the interface configs and then
require 802.1x authentication before any access is given.
So this is just a great one for allowing it up
and doing tests and practicing.
And then when you're ready, take it out.
And the next command mab, mac authentication bypass
is for those devices, which don't have a supplicant
and yet we still want to authenticate them
with mac authentication bypass.
So as part of our identity story we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as part of our identity story we
would include the mac address of the devices like cameras,
and internet things devices that we want to authenticate,
but they don't support a supplicant.
Also in our policy for authentication
and authorization, we'd also want
to make sure that we're using or trying mac authentication
bypass or one of our authentication methods
if we want it to work as well.
And then line 60 simply tells a switch on this port
that it should be the authenticator.
So there's three basic parts to 802.1x.
We have the client, who is the supplicant. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have the client, who is the supplicant.
We have the switch, the network access device
acting as the authenticator.
And then we have the authentication server,
which in our case is the identity services engine.
I've also specified a time out period
and you may want to increase or decrease this
depending on how long you want this device to wait before it
gives up on a client responding to the authentication requests.
And the benefit of tweaking this a little bit is if we use
the defaults it could take a long time before .1x fails with
the default timers before it ever tried mac authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the default timers before it ever tried mac authentication
bypass.
So if you want that to happen faster,
you can tweak the timers on how long it should take for the .1x
to happen.
And this command, authentication port-control auto says,
let's do it.
Let's go ahead and implement 802.1x and control this port
based on whatever the identity services engine says regarding
authorization profiles.
What VLAN, what downloadable ACLs we should have,
what av pairs we should send and so forth.
So let me take these interface config commands
that we just went through. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we just went through.
I will copy those to my buffer.
Right click, copy, and let's go to the switch and deploy it.
So here at the switch we'll right click,
and we'll click on paste, and I will paste all that goodness
in.
Now all of our ports if we do a show interface status that'll
be a good indicator.
Is showing us that these ports Fa0/1 through 8,
are all assigned to VLAN 999.
Looks like we have a connected device to port Fa0/1, that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Looks like we have a connected device to port Fa0/1, that's
our client.
Looks like we have the switch trying
to do the authentication.
Currently I don't have a valid user name over there
at the client, though it's not going to be too successful,
but it'll time out and it should fail after the timeout
intervals pass.
And we can see here, it failed on the dot1x.
It then started trying mab and that fails probably
because the AAA server isn't allowing that at the moment.
And then we have an authorization fail message.
If we go back to the client it should show here
on that interface authentication failed that's expected. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on that interface authentication failed that's expected.
Now the other thing we could do is
we could also look at the log files
on the identity services engine to take
a look at why it failed, what did it match, and so forth.
So we'll do that in the next video,
we'll take a look at verifying our configuration on the switch
by taking a look at the switch itself.
I've got some show commands I'll share with you.
We'll take a look at the client from the client's perspective,
and also the logs over on the identity services engine.
All that coming up and more in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.