I want you to think a minute about connecting to something far away.
Now normally we're going to do that through the Internet which is great but usually when you're connecting
to something far away you're connecting to an application.
If you go into Google you're connecting to a web page.
If you're grabbing your e-mail you're connecting to an e-mail server.
If you're playing Counter-Strike you're connecting to a gaming server so normally when you are a client
and you're connecting to a server what you're doing is you're connecting not only to just one computer
but one application within that computer.
Now I want to take that a step further.
In this episode network access control what I want to talk about is not the idea of simply connecting
to one application but connecting to your ready an entire network.
Now network access control is all over the place.
For example if you're connecting to a wireless network if you're sitting in a airport and you want to
connect to the Internet what you're actually doing first is you're connecting to a wireless network
that's network access control.
Let's say you have two offices one in Dallas and one in Houston and you have a dedicated T-3 line that
you're paying thousands of dollars a month for.
That's not on the Internet so your own dedicated line you're actually from one office to the other creating
what we call remote access.
And the third great example would be like a VPN connection with a VPN.
What you're doing is you're sitting on some computer someplace and you're connecting not to simply one
computer but to your entire local area network via the Internet.
So in these three cases you've got some kind of box some kind of system that's acting as a gatekeeper
that you need to get through through some kind of authentication process that allows you to become part
of that other network.
Now to do that we've got a whole bunch of different ways and that's really what this episode is all
about.
But to do that you'd need to understand that it all started with something a long long time ago called
Point to Point protocol point to point protocol.
BPP was originally designed arguably for Dial-Up networks.
Anybody old enough out there to remember using a modem to connect to get onto the Internet.
Keep in mind what you were doing back then is you were connecting your old computer through a modem
through a telephone line to another modem to another computer which then gave you access to a big network
called the Internet.
He was an amazing protocol.
It's not very much any more today how ever the cornerstone of so much network access control done today
started with PPD and a lot of the traditions and concepts stay with it so that's why I want to talk
about GPP for a moment or point to point protocol was designed primarily to take a computer that only
had a phone line and make it look at Bark smell taste like it had some seven mile ethernet connection
over to an Internet service provider.
So people had a lot of jobs so it was a transport protocol it's jobs where to do things like for example
initiate the connection.
Its job was to get an IP address get a subnet mask default gateway interpret that in such a way that
this computer here would think that he was connected via a network card and would go ahead and make
that initial connection.
Oh and by the way maybe we ought to put some authentication in there.
One of the big problems with BP is that it had very rudimentary authentication mechanisms.
It could basically just do passwords with people you had two choices.
You could do what was known as a pap.
So a pap protocol was simply passwords in the clear so you would simply send data.
Your passwords were in the clear and Pap was not very exciting.
The other alternative and one that we saw for a long long time was something called chap.
Sometimes you'll hear the Microsoft version called and this chap chap was a little bit better than pap
than that and it would at least you would create a connection that the server would make a challenge
of some type and usually that would be the password that was hash or something like that.
And then your computer would send that information and compare the hashes and at least it wasn't in
the clear.
At least it was hashed.
So that was wonderful and fantastic and while we were doing Dial-Up GPP was the king.
However it didn't take long for people to begin to understand that connecting to a network we might
want something better than just a username and password.
So we began to see it by this time things like T.L. s had come along and smart cards were being developed
and what the powers of the Internet decided to do.
Was to take TPP and initially the idea was just to create extensions to be but it really developed into
something called a P.
Now EAP is not even really a protocol.
EAP is a framework that's designed to run inside some transport layer protocol that's actually doing
all the work that's moving the data and setting the IP addresses and all that kind of stuff.
And it's just handling the authentication stuff.
So really EAP was developed initially as an extension to just the authentication part of it.
Now what I want to do right now is run through all the different types of EAP that are out there.
It is amazing that we can do certificates and smart cards and we can still use passwords if you want
to.
So let's take a moment and marched through the different EAP methods.
The most simple form of EAP is EAP and the five it's basically just M-S chap in that it will take the
passwords and hash them into an empty five hash and exchange them.
Next is EAP pre-shared key.
So DSK uses pre-determine symmetric key.
So in this case we have two computers each by each computer already has the key typed into it and then
they don't even have to exchange anything because they already have the keys built into them.
Anybody who's worked with wireless access points.
For example WPA or WPA too.
It's very similar to that.
Next is a p t ls.
And yep that means that EAP will handle a full blown TLM.
However when you say EAP t.a less that requires both a server and a client certificate.
So if I have a computer that wants to connect to a network and it's using APL s both of them have to
have certificates EAP TTL S uses the T.L. s exchange method.
But in this case like going to most web sites only the server has a certificate.
Now remember EAP is only an extension to some type of protocol that's actually making the connections
so Peepy was great but BPP was really just a point to point protocol so as we begin to have more important
uses for connections newer transport protocols came along and to make things a little bit more complicated
some protocols actually predated EAP.
So we have a couple of these authentication protocols that actually kind of predate EAP and kind of
have their own little space in the sector.
So what I want to do now is go through the different types of protocols that encapsulate EAP and a couple
of weird guys while we're at it.
So here's a scenario here on the left I've got a computer that wants to connect to some network now
between the network and this computer's going to be some kind of gatekeeper this gatekeeper could be
a wireless access point.
It could be a VPN concentrator it could be all kinds of stuff but there's always some box that's going
to be between me and the network it wants to get to.
So probably the most common place we see EAP used is called 8:0 2.1 X ATO 2.1 X is a full blown authentication
standard that allows us to make connections between some type of client system or in this case I'm going
to actually call it the supplicant and my network itself.
So in this case what say we have a wireless network able to 11.
So 2.1 X which is also known as AP over ethernet or EAP over 8 0 to 11 cause it works both with wired
and wireless connections just great great some form of connection between the supplicant and the authenticator
which I'm going to call this middle box and then runs EAP within that for the actual authentication
itself.
Now keeping this diagram up the other place where we can make a connection is between the authenticator
and then some kind of authentication server and if you've been watching other episodes you'll probably
recognize that this is radious because radious lives on 8:0 2.1 x.
OK let's go now and talk about a couple of the weirdos.
One of the first weirdos is something called Leap leap was invented by Cisco before 8 0 to 11 standards
the security standards came out and it's Cisco's high security wireless standard.
It's basically EAP with a password within a TS tunnel leap is no good anymore.
We don't use it.
Instead it's been supplanted by something called EAP fast.
So fast tends to be the where where we go within a Cisco environment the last oldie Goldie I want to
talk about is something called Peep peep was Microsoft's version of HP before HP came along.
Piep is designed for all kinds of different network access controls but it's basically like Lepe simply
EAP communication within a TLM tunnel and we don't use Piep anymore either.
The passwords are just too easy to hack.
So when it comes to network access control EAP is really the way we go.
I don't care if you're setting up a VPN if you're set up a wireless network whatever you're setting
up at some point or another you're going to be running into EAP and the beautiful part about it is that
it takes care of so much force.
It makes life really easy when it comes to authenticating one computer that wants to join a network.