-: 802.1x.
802.1x is a standardized framework
that's used for port-based authentication
on both wired and wireless networks.
Now, since 802.1x is just the framework,
it's actually going to utilize other mechanisms
to do the real authentication for us.
For example, both the remote authentication
dialing user service, known as RADIUS,
and the terminal access controller
access control system plus, or TACACS+,
can both be utilized to conduct the authentication,
using the 802.1x protocol.
There are three roles that are required
for an authentication to occur under 802.1x.
The first is the supplicant,
which is the device or user that's requesting access
to the network, such as PC1 in this image.
Then, there's an authenticator,
which is the device through which the supplicant
is attempting to access the network.
Normally, this is going to be something like a switch,
a wireless access point, or a VPN concentrator.
Finally, there's the authentication server,
which is going to be the centralized device
that performs the authentication,
which is usually going to be your RADIUS
or your TACACS+ server.
Now, 802.1x is certainly something
that should be considered in your network architecture
as it's considered one of the best protections
that you can add to your internal network connectivity
to prevent rogue devices from gaining access
to your organization's devices and connections.
802.1x also allows for us
to encapsulate the extensible authentication protocol,
or EAP, when we're using a wired or wireless connection.
EAP is actually not a single protocol by itself,
but a framework in a series of protocol
that allows for numerous different mechanisms
of authentication, including things like simple passwords,
digital certificates, and public key infrastructure.
EAP-MD5 is a variant of the EAP
and it utilizes simple passwords
and the challenge handshake authentication process
to provide remote access authentication.
If you're using this method, you have
to ensure that you're using long, strong,
and complex passwords in order for you
to maintain the security of your system.
EAP-MD5 is a one-way authentication process
and it's not going to provide mutual authentication.
EAP-TLS is a form of EAP
that's going to use public key infrastructure,
with a digital certificate being installed
on both the client and the server,
as the method of authentication.
This makes it immune to password-based attacks,
since neither side is going to use a password
and instead, they're going to use digital certificates
to identify themself.
This is considered a form of mutual authentication
between both devices, the client, and the server,
because each one is going to authenticate with the other.
Another variant of this is called EAP-TTLS.
This form is going to require a digital certificate
on the server, but not on the client.
Instead, the client is going to use a password
for its authentication.
This makes it more secure than the traditional EAP-MD5,
which just uses passwords,
but it is less secure than the EAP-TLS
because that one removes the password vulnerability
by using two-digit certificates.
Now, EAP-FAST, or EAP flexible authentication
via secure tunneling, is our fourth variant of EAP.
And this is going to use a protected access credential,
instead of a certificate,
to establish that mutual authentication between devices.
The fifth and final type of EAP is called PEAP,
or protected EAP.
This variant also supports mutual authentication
by using server certificates
and the Microsoft Active Directory databases
for it to authenticate a password from the client.
Now, in addition to all these cross platform variants
of EAP, there's also a proprietary protocol from Cisco,
called LEAP, or the lightweight EAP.
But, for you to be able to use this in your organization,
you have to be running a Cisco-based network
and all of your clients have to support it.
For this reason, most of the time,
I just use standard EAP in my networks
and not using the Cisco proprietary one.