- [Instructor] We're going to take a look now
at how to configure EAP based authentication.
First, using an external RADIUS server,
the RADIUS server is going to be our AAA server
where the user database is stored.
So the first thing we're going to need to do
is to configure the wireless LAN controller
so that it recognizes the external RADIUS server.
And we'll first do that by logging in
to the wireless LAN controller,
which I've already done here.
You can see that that lands us
at a main monitoring page with a summary.
From there we can choose the security page
that's found along the top navigation menu.
And then you can see that our first sub menu
on the left hand side is already expanded
and that's the sub menu for AAA services.
From there you can see we have options
for both RADIUS and TACACS+
and underneath the RADIUS option which is expanded,
we can choose the authentication sub menu from there,
that's going to allow us to define
our external RADIUS server.
From there at the top right, we have a new button.
So that's what we want to choose, we want to make a new server
to define a new RADIUS server.
After I choose that, right at the top,
you can see that we have something called the Server Index
or the priority.
And the server with the lowest Server Index
is going to be assumed to be the most preferred server
for use with this wireless LAN controller.
So if that server becomes unresponsive,
then the wireless LAN controller is going to switch
to the next lowest Server Index.
So if you have multiple RADIUS servers,
you'll want to make sure that your primary server
is configured with the lowest server index.
Now in our case, I'm only going to configure
a single instance of RADIUS server
so we can leave that index priority value set to one.
Next we want to enter the RADIUS server's IP address.
In my case, I'll use the IP address 10.10.10.5.
And next we want to enter a shared secret key.
The radius shared secret is used
to make sure there is secure communication
between a RADIUS server and a RADIUS client.
And in this case, the client
is going to be our wireless LAN controller.
Now at this point in the configuration,
we would already have a shared secret key configured
on the actual RADIUS server.
So here, you just want to make sure that that key matches
when it's input on the wireless LAN controller,
that's going to make sure there are no communication errors.
Also notice that you can input that in either ASCII or hex.
Now ASCII is the most common format for that.
So I'm going to leave that be
and we'll enter the same shared secret key
that is configured on the RADIUS server itself.
So we have that done.
Next up, notice there is the key wrap option,
and that is disabled by default.
Now what the key wrap does is it wraps the shared secret key
with an AES encryption.
So it's really strong, it encapsulates that shared secret
with super strong encryption.
And you can see it stated that this is designed
for FIPS customers, and FIPS stands
for Federal Information Processing Standards.
These are cryptographic standards specified
by the United States government.
Now, these would be mandatory
for any US government employee computer,
so any computer used for government work,
that would need to be FIPS compliant,
I'm going to leave that disabled in our example.
And next, we want to check the port number
by default RADIUS uses UDP port 1812 for authentication
that's already populated as you can see,
so we can leave that there.
Now if you do happen to have your RADIUS server configured
for communication on another port for some reason
obviously, you want to change that here as well
so that they have communication.
And finally, you can see that the server status
is set to enabled, which is what we want.
Now, if we had multiple RADIUS servers configured
under here, that would allow you to easily disable a server,
maybe you had a server fail, or maybe it needs servicing,
you can simply click on that
and change the status to disabled
and that will take that out of service temporarily.
Once we have all of that populated,
we can hit the Apply button to save that.
And we've now identified our external RADIUS server,
we can see that listed here
under the list of RADIUS authentication servers.
The next thing we need to do is enable 802.1x authentication
on our wireless network.
Back along the top menu, we can see the WLANs menu
near the left, so we want to choose that.
And from there, we can see our SSIDs that are configured.
I'm going to choose the CORPORATE network.
So I have a couple of SSIDs, I have a CORPORATE and a guest,
so I'll choose CORPORATE and from there,
I'll select the Security tab,
the second tab from the left.
If we look at these settings,
you can see that the default settings that are in place
are actually already going to take care of what we want to do.
Layer 2 Security that defaults to WPA+WPA2.
So it is going to be WPA2 capable.
And we can see that the WPA2 policy has a blue checkmark,
meaning that it is enabled.
Also right below that AES also has a blue checkmark.
So that means we are using
the strongest security option here.
And under the Authentication Key Management area,
we see the very top option is 802.1x
that is also already enabled.
Now if we have older clients, maybe they're not capable
of 802.1x authentication, we could also enable PSK,
pre shared keys so that allows us to do that.
But ideally in an enterprise environment,
we don't want to do that.
So we're going to leave that 802.1x authentication enabled.
That completes everything inside of this Layer 2 tab.
Now at the top, we can move over to the AAA servers tab.
And from here, we'll be able to see
our list of configured RADIUS servers.
By default, these are going to be populated
according to the server index that you've given them
when you configure the external servers.
So again, since we only have a single instance
of a RADIUS server identified,
that's all we see in this list, we see the IP address
and the port number listed here in the drop down,
so we can choose that.
And then we can go up and hit the Apply button
on the top right.
Notice that we do get a message here saying that
that's going to temporarily disable our wireless network.
So here's a pro tip,
you don't want to do that during production,
you'll have some very, very unhappy users.
So in my case, in a lab environment, that's okay.
I'm going to just go ahead and click the OK button.
And then that's finished.
And that's all we need to do
to complete the configuration for EAP
using an external RADIUS server.
Now maybe you have a smaller environment,
or maybe you don't have a RADIUS server.
In that case, you can use something
called local EAP instead,
and local EAP is going to use an authentication server
that is actually built into the wireless LAN controller.
So we can set that up by going back
to the Security tab near the top.
And now on the left menu structure, about halfway down,
we see the local EAP options, so we want to choose that.
That's going to expand the sub menu,
and we want to click Profiles.
Notice that we don't currently have any profiles.
I don't have local EAP set up yet.
So we'll want to go to the right and we'll want to click New
to create a new profile.
We want to give that a name.
I'm just going to name that Local-EAP
and we can hit the Apply button.
Now we can see our new profile
listed in the local EAP profiles window.
Now we want to actually click on the profile name.
And that's going to allow us
to edit some of the attributes of that profile.
And you can see all of the parameters that we have there,
you see that we can actually choose which type of EAP
we want to use, I'm going to choose protected EAP.
And I'm going to hit Apply again.
Now that we have a local EAP profile,
we can go back to the WLANs menu near the top left.
And we want to choose one of our networks.
I'm going to choose again, the CORPORATE network.
And I'm going to go back to that Security tab as well.
Then I want to choose AAA servers under the sub tabs.
The first thing we want to do if we're using local EAP
we want to make sure that we don't have
any external RADIUS servers enabled here.
And you see that we do actually have the RADIUS server
that we already configured, listed and enabled there.
So what we want to do besides server one,
we want to go and click in that drop down,
and we want to choose none, that's going to make sure
that it's not looking for that external server instead.
So we want to make sure that none of those are defined
when we're using local EAP.
Now if we scroll down to the bottom of that window,
you can see that we see the option
for local EAP authentication.
And of course, by default that is disabled.
So we can enable that simply by clicking the box.
And then the name of our profile that we set up already
is populated in there,
we only have the single Local-EAP profile that I made.
If we had multiple profiles,
again, you would be able to choose from those there.
So it already populated the profile that we had in place,
so that's good.
And now we're going to go back up and choose the Apply button.
We'll we get that same warning again,
letting us know that this is going to temporarily
disable our wireless networks.
Click Okay, then that's completed.
The last thing we need to do for our Local-EAP
is to actually configure our user database.
So since we're authenticating locally,
we actually need to have some local users
stored on this wireless LAN controller,
otherwise, they're not going to be able to authenticate.
So let's go under the Security tab at the top again.
And on the left, under the AAA menu that's expanded,
if we look about halfway down,
we'll see the Local Net Users option.
So let's click on that.
And you see this is not populated with any users yet,
we don't have any local users configured.
So we can click the New button on the right.
And we can begin to configure our users
in there for authentication.
So I'll just put a test user in there.
So I've created a user called test.
I've created the password reentered that
and now we can choose a specific wireless network
that they can be authenticated on.
Notice that we can choose one of the SSIDs
that we have configured already.
So that's going to allow them to be authorized access
on a specific network.
So in my case, again, I have the CORPORATE
and the Guest network I'll choose CORPORATE.
And again, I'll click Apply to apply that,
you can see that we now have the user
listed under our local net users.
And that's the last thing we need to do
to configure Local-EAP on the wireless LAN controller.
If we go back to our main WLANs window,
and we see our list of networks here.
If you look over on the right, under Security Policies,
notice that both of these networks display the Auth 802.1x
beside them under the Security Policies column.
So this is how we can verify that both of these networks
are in fact using EAP based authentication methods.
We can also ensure from here
that they are both in the enabled state
and they are in fact in that state.
So that's exactly what we want to see.
So that's a look at how we can configure
EAP based authentication both locally
on a Cisco wireless LAN controller
and using an external RADIUS server.