1 1 00:00:00,250 --> 00:00:02,240 Network Access Protocols. 2 2 00:00:02,240 --> 00:00:03,770 In this lesson, we're going to discuss 3 3 00:00:03,770 --> 00:00:05,490 the different network access protocols 4 4 00:00:05,490 --> 00:00:06,670 that are used in our networks, 5 5 00:00:06,670 --> 00:00:11,370 including RADIUS, TACACS+, 802.1x and EAP. 6 6 00:00:11,370 --> 00:00:13,820 The first network access protocol we're going to discuss is 7 7 00:00:13,820 --> 00:00:17,453 RADIUS, or the Remote Authentication Dial-In User Service. 8 8 00:00:17,453 --> 00:00:21,310 RADIUS provides a centralized administration of dial-up VPN 9 9 00:00:21,310 --> 00:00:23,390 and wireless network authentication. 10 10 00:00:23,390 --> 00:00:26,910 RADIUS supports the use of 802.1x and EAP, 11 11 00:00:26,910 --> 00:00:28,970 the Extensible Authentication Protocol. 12 12 00:00:28,970 --> 00:00:31,700 Both of which we're going to discuss in just a moment. 13 13 00:00:31,700 --> 00:00:34,150 RADIUS is considered a client server protocol 14 14 00:00:34,150 --> 00:00:37,060 and it operates within layer 7 of the OSI model. 15 15 00:00:37,060 --> 00:00:38,910 This is the application layer. 16 16 00:00:38,910 --> 00:00:41,480 It's going to utilize UDP for making its connections, 17 17 00:00:41,480 --> 00:00:42,690 making it fairly fast 18 18 00:00:42,690 --> 00:00:45,310 during authentication to authorization. 19 19 00:00:45,310 --> 00:00:46,750 Now, to implement RADIUS, 20 20 00:00:46,750 --> 00:00:49,140 you need to usually run it on a separate server, 21 21 00:00:49,140 --> 00:00:51,170 but this can be loaded up on the same server 22 22 00:00:51,170 --> 00:00:52,640 as your Windows domain controller 23 23 00:00:52,640 --> 00:00:54,980 if you're using a smaller domain environment. 24 24 00:00:54,980 --> 00:00:57,310 RADIUS is going to be used to authenticate users, 25 25 00:00:57,310 --> 00:00:58,700 authorize them to services, 26 26 00:00:58,700 --> 00:01:01,130 and account for their usage of those services. 27 27 00:01:01,130 --> 00:01:03,600 This means it's considered an AAA, 28 28 00:01:03,600 --> 00:01:06,800 or Authentication, Authorization and Accounting service. 29 29 00:01:06,800 --> 00:01:08,960 For network connectivity RADIUS is commonly 30 30 00:01:08,960 --> 00:01:11,830 going to use port 1812 for authentication messages 31 31 00:01:11,830 --> 00:01:14,270 and port 1813 for accounting messages. 32 32 00:01:14,270 --> 00:01:16,280 But some proprietary versions of RADIUS 33 33 00:01:16,280 --> 00:01:21,090 may also use port 1645 and 1646 for these purposes. 34 34 00:01:21,090 --> 00:01:23,310 Now, while RADIUS is a cross platform standard, 35 35 00:01:23,310 --> 00:01:27,050 there is a proprietary protocol from Cisco known as TACACS+, 36 36 00:01:27,050 --> 00:01:29,080 which is similar in functionality. 37 37 00:01:29,080 --> 00:01:31,310 Now this is our second network access protocol 38 38 00:01:31,310 --> 00:01:32,500 that we need to discuss. 39 39 00:01:32,500 --> 00:01:35,390 This is known as Terminal Access Controller Access Control 40 40 00:01:35,390 --> 00:01:37,890 System Plus, or TACACS+. 41 41 00:01:37,890 --> 00:01:39,890 Now TACACS+ is going to be used to perform 42 42 00:01:39,890 --> 00:01:43,150 the role of an authenticator in an 802.1x network, 43 43 00:01:43,150 --> 00:01:44,850 just like RADIUS can. 44 44 00:01:44,850 --> 00:01:46,440 It's really up to you to determine which one 45 45 00:01:46,440 --> 00:01:48,330 is going to be best for your organization's needs 46 46 00:01:48,330 --> 00:01:50,230 in coordinating with your network engineers 47 47 00:01:50,230 --> 00:01:51,990 and your cybersecurity team to decide 48 48 00:01:51,990 --> 00:01:54,310 if you're going to use RADIUS or TACACS+. 49 49 00:01:54,310 --> 00:01:57,150 Personally, I like to use RADIUS almost exclusively 50 50 00:01:57,150 --> 00:01:59,810 within my organization because I've found that TACACS+ 51 51 00:01:59,810 --> 00:02:01,400 is a little bit slower to operate 52 52 00:02:01,400 --> 00:02:04,340 because it relies on TCP instead of UDP. 53 53 00:02:04,340 --> 00:02:06,340 Also, if you're going to use TACACS+ 54 54 00:02:06,340 --> 00:02:09,320 you need to make sure you have port 49 open and available, 55 55 00:02:09,320 --> 00:02:11,760 so clients can access the TACACS+ server 56 56 00:02:11,760 --> 00:02:13,850 and communicate without any issues. 57 57 00:02:13,850 --> 00:02:16,210 Now, even though I said, I prefer to use RADIUS, 58 58 00:02:16,210 --> 00:02:18,330 TACACS+ does have some benefits. 59 59 00:02:18,330 --> 00:02:20,950 In developing TACACS+ Cisco has included 60 60 00:02:20,950 --> 00:02:22,830 some additional security and its server 61 61 00:02:22,830 --> 00:02:25,000 is going to independently conduct authentication, 62 62 00:02:25,000 --> 00:02:27,350 authorization and accounting processes. 63 63 00:02:27,350 --> 00:02:30,080 TACACS+ also supports all network protocols 64 64 00:02:30,080 --> 00:02:32,930 where RADIUS doesn't support the remote access protocol, 65 65 00:02:32,930 --> 00:02:35,440 net bios frame protocol, and a few others. 66 66 00:02:35,440 --> 00:02:38,110 Overall, TACACS+ is a really good choice, 67 67 00:02:38,110 --> 00:02:40,790 but only if you're going to be using Cisco devices 68 68 00:02:40,790 --> 00:02:42,720 exclusively across your network. 69 69 00:02:42,720 --> 00:02:44,070 If you're like me and you prefer 70 70 00:02:44,070 --> 00:02:45,910 to have cross-platform capability, 71 71 00:02:45,910 --> 00:02:47,260 then you're going to want to use RADIUS 72 72 00:02:47,260 --> 00:02:49,340 for your implementations instead. 73 73 00:02:49,340 --> 00:02:51,530 As we've been discussing RADIUS and TACACS+ 74 74 00:02:51,530 --> 00:02:55,020 I've mentioned 802.1x and EAP a couple of times. 75 75 00:02:55,020 --> 00:02:57,970 So let's circle back and cover those topics right now. 76 76 00:02:57,970 --> 00:02:59,470 The third network access protocol 77 77 00:02:59,470 --> 00:03:01,480 we need to discuss is 802.1x. 78 78 00:03:01,480 --> 00:03:04,600 Now, 802.1x is a standardized framework 79 79 00:03:04,600 --> 00:03:06,360 that's used for port-based authentication 80 80 00:03:06,360 --> 00:03:08,640 on both wired and wireless networks. 81 81 00:03:08,640 --> 00:03:11,500 Now, since 802.1x is just a framework, 82 82 00:03:11,500 --> 00:03:13,520 it's actually going to utilize other mechanisms 83 83 00:03:13,520 --> 00:03:15,164 to do the real authentication for us, 84 84 00:03:15,164 --> 00:03:18,570 things like RADIUS and TACACS+ that we just spoke about. 85 85 00:03:18,570 --> 00:03:21,420 Now, for authentication to occur under 802.1x, 86 86 00:03:21,420 --> 00:03:23,400 there are three roles that are required. 87 87 00:03:23,400 --> 00:03:25,330 There's a supplicant, an authenticator, 88 88 00:03:25,330 --> 00:03:27,100 and an authentication server. 89 89 00:03:27,100 --> 00:03:28,790 First, we have our supplicant. 90 90 00:03:28,790 --> 00:03:31,220 This is the device or the user that's requesting access 91 91 00:03:31,220 --> 00:03:33,920 to the network, such as PC1 in this example. 92 92 00:03:33,920 --> 00:03:35,520 Then we have the authenticator, 93 93 00:03:35,520 --> 00:03:37,170 which is the device through which the supplicant 94 94 00:03:37,170 --> 00:03:39,040 is requesting to access the network. 95 95 00:03:39,040 --> 00:03:41,330 Normally, this is going to be something like a switch, 96 96 00:03:41,330 --> 00:03:44,350 a wireless access point or a VPN concentrator. 97 97 00:03:44,350 --> 00:03:46,600 Finally, there's the authentication server. 98 98 00:03:46,600 --> 00:03:48,100 This is going to be the centralized device 99 99 00:03:48,100 --> 00:03:49,730 that performs the authentication. 100 100 00:03:49,730 --> 00:03:52,917 Normally this will be your RADIUS or your TACACS+ server. 101 101 00:03:52,917 --> 00:03:56,170 802.1x is a great thing to have in your networks, 102 102 00:03:56,170 --> 00:03:58,660 because it is one of the best protections that you can add 103 103 00:03:58,660 --> 00:04:00,280 to your internal network conductivity, 104 104 00:04:00,280 --> 00:04:02,190 to prevent rogue devices from getting access 105 105 00:04:02,190 --> 00:04:04,810 to your organization's devices and connections. 106 106 00:04:04,810 --> 00:04:07,440 As I said, this is port-based authentication. 107 107 00:04:07,440 --> 00:04:08,940 So anything that connects to a switch 108 108 00:04:08,940 --> 00:04:11,483 or wireless access point or a VPN concentrator 109 109 00:04:11,483 --> 00:04:13,330 could be required to present itself 110 110 00:04:13,330 --> 00:04:15,870 for authentication using 802.1x 111 111 00:04:15,870 --> 00:04:18,620 prior to getting access to the entire network. 112 112 00:04:18,620 --> 00:04:22,696 Another feature of 802.1x is the ability to encapsulate EAP. 113 113 00:04:22,696 --> 00:04:25,832 This is our fourth network access protocol 114 114 00:04:25,832 --> 00:04:27,160 that we need to discuss, known as EAP, 115 115 00:04:27,160 --> 00:04:29,460 or the Extensible Authentication Protocol, 116 116 00:04:29,460 --> 00:04:32,390 which can happen over a wired or wireless connection. 117 117 00:04:32,390 --> 00:04:35,270 Now, EAP is actually not a single protocol by itself, 118 118 00:04:35,270 --> 00:04:37,630 but actually a framework in a series of protocols 119 119 00:04:37,630 --> 00:04:39,450 that allows for numerous different mechanisms 120 120 00:04:39,450 --> 00:04:42,024 of authentication, including things like simple passwords, 121 121 00:04:42,024 --> 00:04:45,160 digital certificates, and public key infrastructures. 122 122 00:04:45,160 --> 00:04:47,320 There are many different variants of EAP, 123 123 00:04:47,320 --> 00:04:52,130 such as EAP-MD5, EAP-TLS, EAP-TTLS, 124 124 00:04:52,130 --> 00:04:55,480 EAP-FAST and EAP-PEAP. 125 125 00:04:55,480 --> 00:04:58,980 Now, EAP-MD5 is a variant of EAP that utilizes 126 126 00:04:58,980 --> 00:05:01,050 simple passwords and the challenge handshake 127 127 00:05:01,050 --> 00:05:02,760 authentication process to provide 128 128 00:05:02,760 --> 00:05:04,570 remote access authentication. 129 129 00:05:04,570 --> 00:05:05,920 If you're using this method, 130 130 00:05:05,920 --> 00:05:08,110 you have to ensure you're using long, strong, 131 131 00:05:08,110 --> 00:05:10,600 and complex passwords in order for you to maintain 132 132 00:05:10,600 --> 00:05:12,230 the security of your systems. 133 133 00:05:12,230 --> 00:05:15,160 EAP-MD5 is a one-way authentication process, 134 134 00:05:15,160 --> 00:05:17,480 and it's not going to provide mutual authentication 135 135 00:05:17,480 --> 00:05:19,147 like some of the other versions will. 136 136 00:05:19,147 --> 00:05:23,780 EAP-TLS is a form of EAP that uses public key infrastructure 137 137 00:05:23,780 --> 00:05:26,400 with digital certificates being installed on both the client 138 138 00:05:26,400 --> 00:05:29,100 and the server as a method of authentication. 139 139 00:05:29,100 --> 00:05:31,230 This makes it immune to password-based attacks 140 140 00:05:31,230 --> 00:05:33,160 since neither side is going to use a password. 141 141 00:05:33,160 --> 00:05:35,530 And instead they're going to be using digital certificates 142 142 00:05:35,530 --> 00:05:36,770 to identify themselves. 143 143 00:05:36,770 --> 00:05:38,700 This is considered a form of mutual authentication 144 144 00:05:38,700 --> 00:05:41,310 between both devices, the client and the server, 145 145 00:05:41,310 --> 00:05:42,760 because each of them is going to authenticate 146 146 00:05:42,760 --> 00:05:43,920 with the other one. 147 147 00:05:43,920 --> 00:05:47,640 Now, another variant of this is known as EAP-TTLS. 148 148 00:05:47,640 --> 00:05:49,800 This requires a digital certificate on the server, 149 149 00:05:49,800 --> 00:05:51,180 but not on the client. 150 150 00:05:51,180 --> 00:05:53,020 Instead, the client's going to use a password 151 151 00:05:53,020 --> 00:05:54,270 for its authentication. 152 152 00:05:54,270 --> 00:05:57,370 This makes it more secure than a traditional EAP-MD5, 153 153 00:05:57,370 --> 00:05:58,810 which just uses passwords, 154 154 00:05:58,810 --> 00:06:01,550 but it is less secure than EAP-TLS 155 155 00:06:01,550 --> 00:06:03,316 because we're now only using one digital certificate 156 156 00:06:03,316 --> 00:06:04,760 instead of two. 157 157 00:06:04,760 --> 00:06:07,340 Our fourth variant of EAP is EAP-FAST, 158 158 00:06:07,340 --> 00:06:11,010 or EAP Flexible Authentication via Secure Tunneling. 159 159 00:06:11,010 --> 00:06:13,980 EAP-FAST is going to use protected access credentials 160 160 00:06:13,980 --> 00:06:16,750 instead of a certificate to establish mutual authentication 161 161 00:06:16,750 --> 00:06:18,109 between the two devices. 162 162 00:06:18,109 --> 00:06:22,380 Now, our fifth and final variant of EAP is known as PEAP, 163 163 00:06:22,380 --> 00:06:24,280 or Protected EAP. 164 164 00:06:24,280 --> 00:06:26,550 This variant also supports mutual authentication 165 165 00:06:26,550 --> 00:06:28,040 by using server certificates 166 166 00:06:28,040 --> 00:06:30,190 and the Microsoft active directory database 167 167 00:06:30,190 --> 00:06:32,870 for it to authenticate a password from the client. 168 168 00:06:32,870 --> 00:06:34,850 Now, in addition to all these cross-platform 169 169 00:06:34,850 --> 00:06:36,070 variants of EAP, 170 170 00:06:36,070 --> 00:06:37,492 there's also a proprietary protocol 171 171 00:06:37,492 --> 00:06:38,880 that was developed by Cisco, 172 172 00:06:38,880 --> 00:06:41,470 known as LEAP or the Lightweight EAP. 173 173 00:06:41,470 --> 00:06:43,220 Now, since it's proprietary, 174 174 00:06:43,220 --> 00:06:45,400 it only works on Cisco based devices. 175 175 00:06:45,400 --> 00:06:47,444 So, unless you have all Cisco devices in your network, 176 176 00:06:47,444 --> 00:06:49,710 you should stick with using standard EAP 177 177 00:06:49,710 --> 00:06:50,960 in your networks instead.