1 © 2005 Cisco Systems, Inc. All rights reserved. 111 © 2004, Cisco Systems, Inc. All rights reserved.

2 © 2005 Cisco Systems, Inc. All rights reserved. Network Security 1 Module 7 – Configure Trust and Identity at Layer 2

3 © 2005 Cisco Systems, Inc. All rights reserved. Learning Objectives 7.1 Identity-Based Networking Services (IBNS) 7.2 Configuring 802.1x Port-Based Authentication

4 © 2005 Cisco Systems, Inc. All rights reserved. Module 7 – Configure Trust and Identity at Layer Identity-Based Networking Services (IBNS)

5 © 2005 Cisco Systems, Inc. All rights reserved. Identity Based Network Services Cisco VPN Concentrators, IOS Routers, PIX Security Appliances Unified Control of User Identity for the Enterprise Router Internet Cisco Secure ACS Firewall VPN Clients Hard and Soft Tokens Remote Offices OTP Server

6 © 2005 Cisco Systems, Inc. All rights reserved. IBNS Benefits

7 © 2005 Cisco Systems, Inc. All rights reserved x Roles Authentication Server Authenticator Supplicant Exchanges of Extensible Authentication Protocol (EAP) messages. Between the supplicant and the authentication server. Authenticator acts as a transparent relay for this exchange and as a point of enforcement.

8 © 2005 Cisco Systems, Inc. All rights reserved x Features and Benefits

9 © 2005 Cisco Systems, Inc. All rights reserved x Topologies

10 © 2005 Cisco Systems, Inc. All rights reserved x Authenticator and Supplicant The perimeter router acts as the authenticator Internet Cisco Secure ACS Home Office The remote user’s PC acts as the supplicant

11 © 2005 Cisco Systems, Inc. All rights reserved x Components

12 © 2005 Cisco Systems, Inc. All rights reserved. How 802.1x Works

13 © 2005 Cisco Systems, Inc. All rights reserved. How 802.1x Works (Continued)

14 © 2005 Cisco Systems, Inc. All rights reserved. EAP Characteristics

15 © 2005 Cisco Systems, Inc. All rights reserved. EAP Selection Cisco Secure ACS supports the following varieties of EAP: EAP-MD5 – An EAP protocol that does not support mutual authentication. EAP-TLS – EAP incorporating Transport Layer Security (TLS). LEAP—An EAP protocol used by Cisco Aironet wireless equipment. LEAP supports mutual authentication. PEAP – Protected EAP, which is implemented with EAP-Generic Token Card (GTC) and EAP-MSCHAPv2 protocols. EAP-FAST – EAP Flexible Authentication via Secured Tunnel (EAP- FAST), a faster means of encrypting EAP authentication, supports EAP-GTC authentication.

16 © 2005 Cisco Systems, Inc. All rights reserved. Cisco LEAP

17 © 2005 Cisco Systems, Inc. All rights reserved. EAP-TLS

18 © 2005 Cisco Systems, Inc. All rights reserved. PEAP

19 © 2005 Cisco Systems, Inc. All rights reserved. How Does Basic Port Based Network Access Work?

20 © 2005 Cisco Systems, Inc. All rights reserved. ACS Deployment in a Small LAN

21 © 2005 Cisco Systems, Inc. All rights reserved. ACS Deployment in a Global Network

22 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS RADIUS Response Cisco Secure ACS Cisco Catalyst Switch End User 802.1x RADIUS After a user successfully completes the EAP authentication process the Cisco Secure ACS responds to the switch with a RADIUS authentication- accept packet granting that user access to the network.

23 © 2005 Cisco Systems, Inc. All rights reserved. Module 7 – Configure Trust and Identity at Layer Configuring 802.1x Port-Based Authentication

24 © 2005 Cisco Systems, Inc. All rights reserved x Port-Based Authentication Configuration

25 © 2005 Cisco Systems, Inc. All rights reserved x Port-Based Authentication Configuration (Cont.)

26 © 2005 Cisco Systems, Inc. All rights reserved. Enabling 802.1x Authentication

27 © 2005 Cisco Systems, Inc. All rights reserved. Enabling 802.1x Authentication (Cont.)

28 © 2005 Cisco Systems, Inc. All rights reserved. Configuring Switch-to-RADIUS Communication radius-server host 172.l auth-port 1812 key rad123 Switch(config)# Configure the RADIUS server parameters on the switch.

29 © 2005 Cisco Systems, Inc. All rights reserved. Enabling Periodic Re-Authentication configure terminal Switch# Enter global configuration mode dot1x re-authentication Switch(config)# Enable periodic re-authentication of the client, which is disabled by default. dot1x timeout re-authperiod seconds Switch(config)# Set the number of seconds between re-authentication attempts.

30 © 2005 Cisco Systems, Inc. All rights reserved. Manually Re-Authenticating a Client Connected to a Port dot1x re-authenticate interface fastethernet0/12 Switch(config)# Starts re-authentication of the client.

31 © 2005 Cisco Systems, Inc. All rights reserved. Enabling Multiple Hosts configure terminal Switch# Enter global configuration mode interface fastethernet0/12 Switch(config)# Enter interface configuration mode, and specify the interface to which multiple hosts are indirectly attached. dot1x multiple-hosts Switch(config-if)# Allow multiple hosts (clients) on an 802.1x-authorized port.

32 © 2005 Cisco Systems, Inc. All rights reserved. Resetting the 802.1x Configuration to the Default Values configure terminal Switch# Enter global configuration mode dot1x default Switch(config)# Reset the configurable 802.1x parameters to the default values.

33 © 2005 Cisco Systems, Inc. All rights reserved. Displaying 802.1x Statistics show dot1x statistics Switch# Display 802.1x statistics show dot1x statistics interface interface-id Switch# Display 802.1x statistics for a specific interface.

34 © 2005 Cisco Systems, Inc. All rights reserved. Displaying 802.1x Status show dot1x Switch# Display 802.1x administrative and operational status. show dot1x interface interface-id Switch# Display 802.1x administrative and operational status for a specific interface.

35 © 2005, Cisco Systems, Inc. All rights reserved.