- [Narrator] We've examined the
Extensible Authentication Protocol in 802.1x
in a previous video.
And here, we want to describe
a bit more about how 802.1x
provides network access control or NAC
including some of the most commonly used
EAP methods.
When we are using 802.1x,
there are three roles involved.
We have the supplicant,
the authenticator,
and the authentication server.
The Supplicant is our endpoint.
If we are going to use .1x,
the end point must have
supplicant software installed
that supports 802.1x authentication.
The good news is that Windows and macOS
now both have
native supplicant software installed,
that's also offered by
Cisco AnnyConnect Software as well.
The supplicant software will communicate
identity credentials through EAP over LAN,
providing those through the authenticator.
The authenticator is the piece that controls
access to the network
based on the authentication status
of the endpoint.
Commonly, this is either a typical switch
or a wireless LAN controller.
This device receives EAP encapsulated packets
from the supplicant and re-encapsulates those
into RADIUS packets.
Those RADIUS packets are then forwarded
to the final piece,
the authentication server.
You probably already guessed that
the authentication server is a RADIUS server.
Tacx Plus is not supported for use with 802.1x
so this would need to be
a server providing RADIUS services.
The authentication server
receives the information from the authenticator
and validates the identity information
sent originally by the supplicant.
The server will then respond with either
a RADIUS accept or RADIUS deny message
which is sent back to the authenticator.
There are numerous EAP types
or EAP methods.
The most commonly used methods are based on
Transport Layer Security or TLS.
When we are choosing an EAP type,
we want to consider our
network security requirements.
In other words,
which EAP type is going to best meet
our security goals for the network.
And also, which EAP type is supported by
the authentication server that we are using
and also our endpoints.
We have inner authentication methods
and tunneled or outer authentication methods.
Inner methods are tunneled within
the outer methods.
Those tunneled methods will use
an outer TLS tunnel
between the supplicant
and the authentication server
very similar to the way
that an https session is established
between a secured website
and a local browser.
Let's take a look at a few of the most common
EAP authentication methods.
There are many, many options out there
but these are a few of the most common.
First we have EAP-MD5
that uses the MD5 algorithm
to hash supplicant credentials.
The limitation of EAP-MD5 is that
this is a one way authentication.
So the authentication server
validates the supplicant,
but the supplicant does not validate
the authentication server as a valid authority.
So there is an opportunity for an attacker
to impersonate a valid server
and to begin communicating with an endpoint
with this method.
EAP-TLS does provide mutual authentication
between the client and the server.
With this method,
the supplicant and server are both assigned
a digital certificate
that would be signed by a certificate authority
or a CA.
This is the most secure method
but it's also the most cumbersome to deploy
since it requires a certificate to be installed
on each clients.
Protected EAP or PEAP
only requires the authentication server to have
a certificate.
So it doesn't require one on the client itself.
This method creates a TLS tunnel
between the supplicant and the server.
Now, since there is no client certificate required,
this is less of an administrative burden.
With protected EAP, a tunnel is established
using TLS as the outer method
and then an inner method is used
to pass credentials
through the outer TLS tunnel.
One of the inner methods used by PEAP
can be EAP-MSCHAP version two.
This is used for communications with
an MS-CHAP version two session,
and it's the most common inner method
that we see used.
This uses a simple username and password
to communicate with our RADIUS server
which can authenticate using
Microsoft Active Directory Information.
EAP-GTC is another inner method
which is the Cisco alternative
to MS-CHAP version two.
This allows for more generic authentications
using things like eDirectory, LDAP,
token servers, and more.
And EAP-TLS is the final inner method option
that we'll mention.
This is essentially a TLS tunnel running
within another TLS tunnel
which obviously is the most secure option.
Now, this is fairly rare
due to all of the certificate requirements.
It requires certificates on the supplicant
and the server
and the endpoints.
So it's pretty complex to configure
and to manage.
Another outer method we want to look at is called
EAP-FAST.
This is similar to PEAP, protected EAP,
but this is Cisco's own alternative
that provides faster,
re-authentications,
and wireless roaming.
This also forms a TLS outer tunnel
just as PEAP does,
but the difference is
EAP-FAST ability to re-authenticate
using what are called
Protected Access Credentials
or PACs for short.
This can be thought of as similar to
a secure cookie.
This is stored locally on the client
as proof of authentication that can be used later
rather than having to re-authenticate.
And finally,
EAP-TTLS.
This is functionally similar to PEAP
but is much less widely supported.
Remember, the EAP inner methods
that we looked at with PEAP?
Well, with EAP-TTLS
this supports inner authentication methods
other than EAP.
Things like PAP, CHAP, and MS-CHAP.
So that's an overview of how we commonly use
802.1x as a method of network access control
including some of the most popular types
of EAP in use today.