All language subtitles for Free-CCNA-Wireless-Security-Day-57-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will look at wireless network\nsecurity.

Specifically, exam topic 1.11.d, encryption,\n

You’ve probably noticed by now that there\n

learn to understand wireless networks.

Wireless security is no exception, and this\n

So, take notes and do extra research if you\n

of the concepts introduced in this video before\n

First I’ll give a brief introduction to\n

Then I’ll introduce various authentication\n

to the most secure methods used in modern\nnetworks.

Then I’ll introduce various encryption and\nintegrity methods.

Encryption plays a role in all kinds of networks,\n

networks because a signal can be received\n

And integrity means making sure that messages\n

Finally we’ll look at Wi-Fi Protected Access,\n

to provide standard sets of wireless network\nsecurity protocols.

Watch until the end of the video for a bonus\n

ExSim for CCNA, the best practice exams for\nthe CCNA.

As you know, security is important in all\nnetworks.

However, it’s even more essential in wireless\nnetworks.

The main reason for that is: because wireless\n

device within range of the signal can receive\nthe traffic.

In wired networks, traffic is often only encrypted\n

You usually don’t encrypt wired traffic\n

But in wireless networks, it is very important\n

That’s because, as I said before, any device\n

traffic, but we want to ensure that only the\n

So, in this video we will cover three main\n

You’ve heard these terms before, but let’s\n

We’ll look at these in more depth later\n

As mentioned in the previous video, all clients\n

Authentication just means verifying the identity\n

In a corporate setting, only trusted users\n

However, a separate SSID which doesn’t have\n

Those guest SSIDs have less strict authentication\n

to the Internet, not to internal company resources.

Not only should the AP authenticate the identity\n

authenticate the AP to avoid associating with\na malicious AP.

A malicious AP could trick users into associating\n

such as a man-in-the-middle attack.

There are multiple ways that authentication\n

a username and password combination, or with\n

For review, remember that before associating\n

an authentication process like this.

Okay, we’ll look at authentication in more\n

Traffic sent between clients and APs, so any\n

it can’t be read by anyone except the AP\nand the client.

You should know this already, but encryption\n

the sender and the intended recipient can\nread it.

There are many possible protocols that can\n

It’s important that the sender and recipient\n

like they are speaking different languages.

The recipient wouldn’t be able to decrypt\nthe sender’s messages.

Note that all devices on the wireless LAN\n

each client will use a unique encryption and\n

Only the AP will have the appropriate key\n

clients won’t be able to decrypt it because\n

However there is also a ‘group key’ which\n

All of those clients keep a copy of that group\n

Again, we’ll look at wireless encryption\n

that let’s introduce the final concept,\nintegrity.

As explained in the security fundamentals\n

a message is not modified by a third party,\n

So, the message that is sent by the source\n

is received by the destination host.

To ensure that, a MIC, message integrity check,\n

To demonstrate how it works, let’s say the\n

First, the sender calculates a MIC for the\n

Just like encryption, there are many different\n

MIC, and it’s important that the sender\n

Then the sender encrypts the message and MIC,\n

The recipient decrypts the message, and then\n

using the same protocol as the sender.

It compares the two MICs, and if the MIC calculated\n

recipient are the same, the recipient assumes\n

Note that if the two MICs aren’t the same,\n

So, instead of saying a MIC helps to protect\n

accurate to say that it helps to identify\n

If the integrity has been compromised, the\n

Now let’s move on to look at various wireless\n

This will just be an overview of various authentication\n

However, we will be covering a lot of them.

Here they are, 7 different methods.

The good news is you don’t need know to\nany of them in depth.

Just a basic understanding of each is fine.

Even though you only need a basic understanding,\n

methods when first learning them.

The original 802.11 standard included two\n

The first one is open authentication, which\nis very simple.

The client sends an authentication request,\n

No questions asked, no credentials required.

So, this is clearly not a secure authentication\nmethod.

The AP just accepts all authentication requests.

However, it is still used today in combination\n

After the client is authenticated and associated\n

user to authenticate via other methods before\n

Think about Starbucks WiFi, or other public\nWiFi.

You might be free to associate your device\n

but then you are probably required to login\n

After that authentication, your device is\n

So, open authentication itself is not secure\n

Then the second method in the 802.11 standard\n

Actually WEP is not just an authentication\n

For encryption, it uses the RC4 algorithm.

If you’re curious about RC4 try reading\n

WEP is a shared-key protocol, it requires\n

Those WEP keys can be 40 bits or 104 bits\nin length.

However those above keys are combined with\n

total length to 64 bits or 128 bits.

Again, read up on wikipedia if you’re curious\n

but you don’t have to know it for the CCNA.

Now, usually longer key lengths are more secure,\n

You definitely should not use WEP on modern\nwireless networks.

So, that’s WEP encryption, but how can WEP\n

First, the AP sends a ‘challenge phrase’.

This is just a series of bits, the actual\ncontents don’t matter.

The client then encrypts the challenge phrase\n

Finally the AP takes the client’s encrypted\n

If they match, it means the AP and client\n

the authentication is successful.

Basically, the AP is just testing if the client\n

Note that WEP can be used just to provide\n

If WEP authentication is not used, open authentication\n

Okay, I just covered the first two options\n

However, open authentication on its own is\n

either as an encryption method or an authentication\nmethod.

So, new wireless authentication methods were\nneeded.

Now let’s look at those more secure methods,\n

EAP itself isn’t a single authentication\n

other protocols, called EAP methods, are based\n

It is an authentication framework.

It defines a standard set of authentication\n

We will look at four of those methods: LEAP,\n

Note that EAP is integrated with a protocol\n

802.1X is used to limit network access for\n

There are three main entities in 802.1X.

This is the device that wants to connect to\nthe network.

Then there is the authenticator.

This is the device that provides access to\nthe network.

Finally, the authentication server.

This is the device that receives client credentials\n

802.1X is used in all kinds of networks, both\n

know these three definitions, supplicant,\n

In an 802.11 wireless LAN, the supplicant\n

The authenticator is the device that provides\n

But actually, in a split-MAC architecture\n

the authentication, not the AP itself.

And the authentication server is usually a\nRADIUS server.

The 802.11 wireless authentication required\n

However, it does not yet have full access\nto the network.

The only traffic allowed from the client is\n

And it is the authentication server that will\n

to permit access or deny access to the network.

So, the WLC is now a middle-man in the authentication\nprocess.

The 802.11 authentication required to simply\n

is the additional step of EAP authentication\n

So, let’s look at some different EAP authentication\n

The first is LEAP, lightweight EAP.

It was developed by Cisco as an improvement\nover WEP.

Clients must provide a username and password\nto authenticate.

But in addition to that, mutual authentication\n

sending a challenge phrase to each other.

In WEP, only the server sent a challenge phrase,\n

So, first challenge phrases are exchanged,\n

phrase and sends it back, and they use that\n

To further improve the security, dynamic WEP\nkeys are used.

These are WEP keys that automatically change\n

However, like WEP, LEAP is considered vulnerable\n

Instead, you should use one of the next methods.

The next method is EAP-FAST, EAP flexible\n

This was also developed by Cisco.

First, a PAC, protected access credential,\n

This PAC is like a shared key and is used\n

tunnel between the client and authentication\nserver.

So, now there is a secure tunnel established\n

The final step is that the client is authenticated\n

The last two methods are similar to EAP-FAST,\n

Like EAP-FAST, it involves establishing a\n

But instead of a PAC, the server has a digital\ncertificate.

It will show its digital certificate to the\n

This certificate is also used to establish\n

And because only the server provides a certificate\n

be authenticated within the secure tunnel.

One protocol that can be used for that authentication\n

Remember that EAP-FAST uses a PAC, but PEAP\n

However both involve establishing a secure\n

And finally the last authentication method\n

Whereas PEAP only requires the AS, authentication\n

a certificate on the AS and on every single\nclient.

It is considered the most secure authentication\n

than PEAP because every client device needs\na certificate.

That can add a lot of complexity, time, and\neffort.

Because the client and server authenticate\n

is no need to authenticate the client within\nthe TLS tunnel.

However, the TLS tunnel is still used to exchange\n

talking about different encryption methods\nnext.

To summarize, EAP-TLS is the most secure authentication\n

so many enterprises might prefer PEAP instead.

So, those are the authentication methods you\n

To really understand these protocols you will\n

But the goal of this video is just to give\n

And remember, authentication refers to verifying\n

Although I did mention encryption throughout\n

talk about specific encryption methods used\n

So, these are the encryption methods, in addition\n

We could include WEP in this list too, but\n

As I said before, encryption of wireless traffic\n

have a basic understanding of these encryption\nmethods.

First up, TKIP, temporal key integrity protocol.

As I said before, WEP was found to be vulnerable,\n

So, a temporary solution based on WEP was\n

That temporary solution was TKIP.

It’s based on WEP but adds various security\nfeatures.

Now, I’m going to give you a list here but\n

Just understand that TKIP is like a more secure\nversion of WEP.

So, TKIP uses a MIC to protect the integrity\nof messages.

Hopefully you remember what a MIC is from\nearlier in the video.

Also a key mixing algorithm is used to create\n

of each frame using the same key.

This makes it harder to crack the encryption.

The initialization vector, which I mentioned\n

which makes brute-force attacks to crack the\n

The MIC includes the sender MAC address, used\n

Also a timestamp is added, so attackers can’t\n

Replay attacks involve re-sending frames that\n

Check wikipedia if you want to get an overview\n

Similarly, a TKIP sequence number keeps track\n

This also protects against replay attacks,\n

As I said, you probably don’t have to memorize\n

Just know that TKIP was developed as a more-secure\n

And know that TKIP is used in WPA, WiFi Protected\n

Next up is CCMP, counter/CBC-MAC protocol.

It was developed after TKIP and is more secure.

It is used in WPA2, and again I will explain\n

Note that for a device to use CCMP, it must\n

Old hardware built only to use WEP or TKIP\ncannot use CCMP.

It consists of two different algorithms to\n

For encryption, it uses AES counter mode.

AES is the most secure encryption protocol\n

world by corporations, governments, etc.

There are multiple modes of operation for\n

mode’ because it offers high performance,\nhigh speed.

Then it uses CBC-MAC, cipher block chaining\n

integrity check to ensure the integrity of\nmessages.

You don’t have to know exactly how CBC-MAC\n

So, that’s how CCMP provides encryption\nand integrity.

Finally there is GCMP, galois counter mode\nprotocol.

It is more secure and more efficient than\n

It is used in WiFi Protected Access 3.

Like CCMP, it consists of two algorithms.

First, AES counter mode encryption.

And then GMAC, Galois Message Authentication\n

Again, don’t worry about exactly how GMAC\n

So, those are the encryption methods you need\nto know.

Again, remember that I also introduced WEP\n

I’ve added some basic notes about each protocol\nbelow.

So far we’ve covered a lot of different\n

Make sure you have taken notes on each and\n

Now, with so many different authentication,\n

Which combinations work together and which\ndon’t?

And how can we know which hardware supports\nwhich standards?

To simplify things and create standard sets\n

developed the WPA, WiFi Protected Access,\n

The Wi-Fi alliance has developed three WPA\n

Note that the first one is just called WPA,\nnot WPA1.

For a device to be WPA certified, it must\n

This is just like how the Wi-Fi alliance certifies\n

They also certify devices for WPA, WPA2, and\nWPA3 security.

All three of the WPAs support two different\n

First is personal mode, in which a pre-shared\n

For example, when you connect to a home wifi\n

It’s common in small networks, such as SOHO\nnetworks.

Note that for security purposes, the PSK itself\n

A four-way handshake is used for the authentication,\n

If the devices use the same PSK to generate\n

decrypt each other’s traffic, meaning that\n

In addition to personal mode, there is enterprise\nmode.

This is the mode that uses 802.1X with an\nauthentication server.

I introduced a few EAP methods and they are\n

So, all EAP methods are supported, such as\nPEAP or EAP-TLS.

Now let’s look at WPA, WPA2, and WPA3.

The first WPA certification was developed\n

it includes the following protocols.

TKIP, which as you know is based on WEP, provides\n

Authentication can be provided by 802.1X and\n

But WPA didn’t last very long.

After more secure protocols and hardware were\n

CCMP is used to provide encryption and MIC.

And again, authentication can be done via\n

And finally in 2018 WPA3 was released.

It uses GCMP for encryption and integrity.

And once again supports 802.1X based or PSK\n

In addition to that, it offers several additional\n

There is a feature called PMF, protected management\nframes.

It protects 802.11 management frames from\n

Actually this was available as an optional\n

Also, SAE, simultaneous authentication of\nequals.

It protects the four-way handshake when using\n

The last example I’ll give is forward secrecy.

It prevents data from being decrypted after\n

This protects against attacks in which an\n

tries to decrypt them later to read the contents.

Okay, that’s all I’ll say about the WPA\ncertifications.

Basically, they take the various security\n

those protocols into standard sets.

Hardware is then tested and certified to make\n

Okay, here’s what we covered in this video.

I’d say the content of this video was quite\nwide but shallow.

You got a general overview of a lot of different\n

Make sure you know the difference between\n

Also know which protocols are included in\nWPA, WPA2, and WPA3.

And make sure to watch until the end of the\n

Software’s ExSim for CCNA, the best practice\nexams for the CCNA.

Now let’s go to quiz question 1.

What does GMAC provide to a secure wireless\nconnection?

Pause the video now to select the best answer.

Okay, the best answer is B, MIC, message integrity\ncheck.

GMAC is used as part of the GCMP protocol\n

GCMP is part of the WPA3 certification.

Okay, let’s go to quiz question 2.

Which of the following are part of the 802.1X\n

(select three) Okay, pause the video now to\n

The answers are A, supplicant.

D, authenticator, and E, authentication server.

These are the three entities involved in 802.1X\nauthentication.

In an 802.11 wireless network, the wireless\n

the authenticator, and a server such as a\n

Okay, let’s go to question 3.

Which of the following encryption and integrity\n

Pause the video now to select the best answer.

These protocols were developed in the order\n

If your hardware supports it, it is recommended\n

Okay, let’s go to question 4.

Which of the following AES methods requires\n

Pause the video now to select the best answer.

Okay, the answer is D, EAP-TLS.

Both PEAP and EAP-TLS involve digital certificates\n

that the AS has a certificate.

EAP-TLS, on the other, uses certificates to\n

so they both need a certificate.

Okay, let’s go to question 5.

Which of the following WPA3 security features\n

personal mode authentication?

Pause the video now to select the best answer.

SAE is simultaneous authentication of equals,\n

during authentication using personal mode.

Okay, that’s all for the quiz.

Now let’s try a bonus question from Boson\n