With our identity services engine configured for 802.1x,
which we did in our previous set of videos.
And more recently, configuring the network access device,
the switch, for 802.1x.
It's now time to take a look at some commands
that we can do at the client, the supplicant,
at the authenticator, which is the switch, and also
on the ISE server, the authentication server,
just to verify that it's all working.
So let's start off at the switch.
And so he's periodically trying on Fa0/1.
It's not going to end well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's not going to end well.
So .1x is going to time out.
Then Mac authentication bypass is
going to time out, because the ISE server isn't supporting it.
And once he's done, I'm exhausted.
I tried all my methods and authorization failed.
So from the client's perspective,
it looks something like this.
Now, as a quick tip, because we have the authentication open
over on the switch--
and let's take a look real quick at the interface.
Do a show run for interface fa 0/1.
Because we have this command right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because we have this command right here,
if we turn off 802.1x at the client,
we're still going to get in because he's not trying to do
802.1x.
Because of this command, right here.
And we can verify that by going to client.
And I'm going to right-click on that Ethernet adapter,
go to properties.
And for authentication, I'm going to say don't enable IEEE
802.1x authentication.
Click on OK.
Check it out.
It's still trying to do 802.1x.
But if we do a show authentication, session, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But if we do a show authentication, session,
and then we specify for interface fast ethernet 0/1,
even though it failed the 802.1x because we have
the authentication open command-- check this out.
It says the authz failed.
It shows the mode.
And if you do a show interface status, it's still in VLAN 999,
but this guy has access in VLAN--
Now, there's not a whole bunch of places he can go.
But we can also specify what we want the default
VLAN to be in the event that the authentication
server is no longer available. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server is no longer available.
So that could be a benefit for rolling out or testing 802.1x
that we don't just to cut somebody off right
at the switch port when we didn't intend to just
because we missed a parameter.
So it's a great way of doing stage testing.
Just turn out the authenticator, and that client
will still have access to whatever the VLAN is associated
with that access port.
All right, so let's go back to this client.
And we'll go to Properties.
And we'll go to Authentication, say we do want to authenticate.
Here we're using Microsoft Protected EAP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here we're using Microsoft Protected EAP.
And here, I'm not verifying the server's identity,
the ISE server's identity.
But if you wanted to verify the server's identity,
make sure that you have a trusted CA that's
been imported that can validate the certificate that's
being presented.
I'm just going to go ahead and turn that off.
And then down below, the authentication method
is using EAP MSCHAP version 2.
And I'll click on Cancel because I'm not
making any changes there.
And under additional settings, let's go ahead
and under User Authentication, we'll save credentials,
and we'll put in the information for Bob and Bob's password. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we'll put in the information for Bob and Bob's password.
And then we'll click on OK.
And OK.
And that should trigger reauthentication
in the background, which is happening right there.
And look at that.
VLAN 80 was assigned.
And there's also a downloadable ACL
as I recall with that policy from our previous videos.
We could verify that with a couple up arrow keys.
Show authentication sessions.
Interface fa0/1.
And there's Bob's MAC address.
There is his IP address that he got via DHCP.
There's his name.
There's our success message. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's our success message.
There's our downloadable ACL.
If we wanted to see that, we do a show access list and that
would show up right there.
And if we did a show VLAN brief, it
should show us that interface fa0/1 is assigned to VLAN 80.
Great.
And if we did a show interface status, that's should show us
the same information, right there.
So that's from the perspective of the switch on our Windows
client.
It should show us that we have an authenticated session
or connectivity with the authentication set.
And if we go to ISE, we can verify it from there as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we go to ISE, we can verify it from there as well.
So here on ISE, if we want to see our RADIUS logs,
we can hover over operations, click on Live Logs,
and then take a look.
So the authentication came up as Bob.
This blue icon with an eye represents
that we currently have a session, that he is there.
And here is the detailed report for the authentication.
So the Our-Site1-Switch-Policy-Set is
the policy set.
And then we have the authentication policy
and the authorization policy as part of that.
And because Bob is a member of ISE OPS, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And because Bob is a member of ISE OPS,
he was delivered the authorization profile
that included the VLAN assignment and also
the downloadable ACL.
And one of the biggest benefits of using the log files
is that it's going to tell you in detail about what
policy was hit for authentication
and authorization.
And if it hit the wrong policy, then start diving there
and say, OK, why did that miss?
Why wasn't this matched?
Correct it, and then move forward.
And then once you have it all dialed in and saved,
you can replicate that and start rolling it out
to more and more devices once you know that it's working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to more and more devices once you know that it's working.
So in this video, we've had the opportunity to test our 802.1x
authentication by looking at details in the logs for the ISE
server, by looking at the actual supplicant, the client itself,
and also the authenticator, which is, in our case,
our 3560 switch that's running 802.1x authentication on its
ports.
So thanks for joining me.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.