1
00:00:00,970 --> 00:00:06,920
Wired Ethernet networks don't have any authentication by default to access the network.

2
00:00:06,939 --> 00:00:13,900
All you need to do is plug your Ethernet cable into a switch and you'll gain access to the network with

3
00:00:13,900 --> 00:00:21,460
no authentication, no authorization and no accounting, triple A or authentication authorization and

4
00:00:21,490 --> 00:00:27,790
accounting, is a way to centralize policies that are applied to network devices.

5
00:00:28,880 --> 00:00:36,500
As an example, you could centralize the authentication of users by using a triple A server such as

6
00:00:36,500 --> 00:00:44,900
Cisco Secure ACS, authentication means that you are authenticating a username and password before

7
00:00:44,900 --> 00:00:49,070
a user can access the network or a device on the network.

8
00:00:49,670 --> 00:00:55,840
Authorization determines what you are allowed to do once you've been authenticated.

9
00:00:56,360 --> 00:01:01,400
So are you, as an example, allowed to go to privilege mode or enable mode on a router?

10
00:01:01,880 --> 00:01:04,819
Are you allowed to access a server on the network?

11
00:01:05,390 --> 00:01:08,920
Accounting is a log of what's happened on the network.

12
00:01:09,080 --> 00:01:16,130
So as an example, you could log users attempts to access a network device via Telnet or SSH.

13
00:01:17,370 --> 00:01:25,590
In a moment, I'll demonstrate triple A using a GNS3 network where I have a Cisco ACS server connected.

14
00:01:26,670 --> 00:01:34,290
The server is running within VMware, but is connected via a GNS3 switch to multiple network devices,

15
00:01:34,940 --> 00:01:41,580
I'll configure the network to use local authentication and then we'll centralize the authentication so

16
00:01:41,580 --> 00:01:48,840
that logins are authorized from a Central ACS server rather than having a local username and password

17
00:01:48,840 --> 00:01:51,270
database on each network device.

18
00:01:52,020 --> 00:01:54,570
Now to stop anyone just accessing your network.

19
00:01:54,720 --> 00:02:02,790
You can implement identity based authentication or identity based networks by using a protocol called

20
00:02:02,790 --> 00:02:04,110
802.1x.

21
00:02:04,680 --> 00:02:12,330
The IEEE 802.1x standard allows you to implement identity based networking, where a client machine

22
00:02:12,330 --> 00:02:17,310
has to present a username and password before they can gain access to the network.

23
00:02:17,910 --> 00:02:22,410
In 802.1x, you have three components or three roles.

24
00:02:22,950 --> 00:02:31,530
The client, also known as the Supplicant, is a PC such as a Windows PC running a a802.1x compliant

25
00:02:31,530 --> 00:02:32,550
client software.

26
00:02:33,090 --> 00:02:39,870
An authenticator doesn't authenticate the client, but sends authentication information through to an

27
00:02:39,870 --> 00:02:41,100
authentication server.

28
00:02:41,700 --> 00:02:48,030
The authenticator would be something like an Ethernet switch, which is controlling access to the network.

29
00:02:48,510 --> 00:02:54,720
The client PC is connected to a port on the switch, acting as the authenticator, and no frames from

30
00:02:54,720 --> 00:03:00,750
the client are permitted except 802.1x frames before authentication takes place.

31
00:03:01,080 --> 00:03:07,380
So when the client sends traffic to the switch, acting as the authenticator, it will send an 802.

32
00:03:07,380 --> 00:03:12,090
.1x challenge to the client asking for authentication information.

33
00:03:12,750 --> 00:03:19,860
A username and password is sent to the switch, but the switch doesn't read that information, but passes

34
00:03:19,860 --> 00:03:27,390
it on to the authentication server, which could be a Radius or Tacacs server, Radius and Tacacs are

35
00:03:27,390 --> 00:03:32,160
the protocols used between the authenticator and authentication server.

36
00:03:32,880 --> 00:03:36,620
The authentication server validates the credentials of the client.

37
00:03:37,230 --> 00:03:42,570
In other words, it makes sure that the client username and password are correct and that the client

38
00:03:42,570 --> 00:03:44,460
is allowed to access the network.

39
00:03:44,970 --> 00:03:50,460
If the username and password are correct, the authentication server sends a message to the authenticator

40
00:03:50,610 --> 00:03:54,450
or switch, which then permits the client to access to the network.

41
00:03:55,020 --> 00:03:59,010
The authenticator sends a successful authentication message to the client

42
00:03:59,310 --> 00:04:06,060
and now when the client forwards traffic such as HTTP or Telnet traffic, that is permitted onto the

43
00:04:06,060 --> 00:04:06,620
network.

44
00:04:07,260 --> 00:04:14,670
The important thing with 802.1x is that the client cannot access the network until authentication

45
00:04:14,670 --> 00:04:21,510
has succeeded based on the information stored in the authentication server and authentication server

46
00:04:21,510 --> 00:04:28,350
could use a local database or it could use a centralized directory such as Active Directory for the

47
00:04:28,350 --> 00:04:30,300
storing of usernames and passwords.