-
The variety of devices in the network, the use of external employees and new approaches such as Bring Your Own Device make it increasingly necessary to monitor access to the network and resources in the company. At the same time, a high degree of flexibility should be achieved for users and end devices. Securing network access with the help of 802.1X is becoming increasingly important. This course offers a practice-oriented and vendor-independent approach to the entire topic, including all peripheral areas such as RADIUS servers, certificates & PKI and domain controllers & LDAP. With the help of a comprehensive practical laboratory, all training content is deepened with exercises.
-
Course Contents
-
- IEEE 802.1X - The concept
- EAP protocol and methods in detail (Labs: MD5, FAST, PEAP, TLS)
- RADIUS protocol and server (Labs: Cisco ISE and MS NPS)
- 802.1X and VoIP, Windows authentication, WoL, MAB, etc.
- 802.1X in WiFi (Labs: Cisco WiFi AP & Controller)
- Tips for an 802.1X network: Authentication Order, Low-Impact Mode, etc.
- Weaknesses of 802.1X - MACSec
- Certificates in an 802.1X environment, structure and function of a PKI (Lab: MS Ent. CA)
- Connection to a directory service via LDAP (Lab: MS ADDS)
- Special features of Active Directory (group scopes, attribute formats, etc.)
- Clients for 802.1x (Labs: MS native & Cisco AnyConnect)
- Further aspects (NAC, NAP, Secure Group Tagging, etc.)
The detailed digital documentation package, consisting of an e-book and PDF, is included in the price of the course.
Premium Course Documents
In addition to the digital documentation package, the exclusive Premium Print Package is also available to you.
- High-quality color prints of the ExperTeach documentation
- Exclusive folder in an elegant design
- Document pouch in backpack shape
- Elegant LAMY ballpoint pen
- Practical notepad
The Premium Print Package can be added during the ordering process for € 150,- plus VAT (only for classroom participation). -
Target Group
-
This course is suitable for anyone who wants to deal with the topics of authentication and authorization in LAN and WLAN from a technical perspective.
-
Knowledge Prerequisites
-
You should have basic knowledge of Ethernet and WLAN and feel at home in the IP world. Familiarity with Microsoft operating systems is helpful, but not essential.
-
This event is recognized as further training as part of the T.I.S.P. recertification: T.I.S.P. recertification - eligibility for recognition.
1 | Sicherheit im LAN und WLAN |
1.1 | Klassische LAN Security |
1.1.1 | Device Hardening |
1.1.2 | Sicherung der Infrastruktur |
1.2 | Spoofing |
1.3 | Port Security – der Klassiker |
1.4 | DHCP Snooping |
1.5 | Dynamic ARP Inspection |
1.6 | IP Source Guard |
1.7 | uRPF gegen IP Spoofing |
1.8 | Private VLANs |
1.9 | Stateless Packet Filter |
1.10 | Port-gebundene Access-Listen |
1.10.1 | Router Access-Listen (RACL) |
1.10.2 | VLAN Access-Lists (VACL) |
1.11 | Identity Based Network Services |
2 | IEEE 802.1X – Portbasierte Authentisierung |
2.1 | IEEE 802.1X – Das Grundkonzept |
2.1.1 | Komponenten |
2.1.2 | Protokolle |
2.2 | Das Extensible Authentication Protocol (EAP) |
2.3 | EAP-Methoden |
2.3.1 | EAP-MD5 – Der Ablauf |
2.3.2 | PEAP – Der Ablauf |
2.3.3 | EAP-TLS |
2.3.4 | EAP-FAST |
2.3.5 | EAP-Vergleich |
2.4 | Komponenten von 802.1X |
2.4.1 | Supplicants |
2.4.2 | Switches |
2.4.3 | RADIUS-Server |
2.5 | Die Probleme |
3 | RADIUS |
3.1 | Radius – Zentrale Zugangskontolle |
3.1.1 | RADIUS – Der Ablauf |
3.1.2 | RADIUS und EAP |
3.1.3 | RADIUS – Change of Authorization (CoA) |
3.1.4 | RADIUS und EAP-MD5 |
3.1.5 | RADIUS und PEAP |
3.1.6 | RADIUS und EAP-TLS |
3.1.7 | RADIUS und MAC Bypass |
3.1.8 | RADIUS und Encryption Keys |
3.2 | RADIUS Accounting |
3.3 | Externe Datenbanken |
3.4 | RADIUS-Redundanz |
3.5 | Network Access Control |
3.6 | Network Policy Server – Microsoft |
3.7 | FreeRadius – Open Source |
3.8 | Cisco’s Identity Service Engine |
4 | IEEE 802.1X – Advanced |
4.1 | MAC Address Bypass |
4.2 | Dot1x im WLAN |
4.2.1 | WLAN Controller |
4.2.2 | IEEE 802.11i |
4.2.3 | WLAN und RADIUS |
4.2.4 | Gastzugänge |
4.3 | Multiple Hosts |
4.4 | IEEE 802.1x-2010 (MACsec) |
4.5 | VLAN-Zuweisung |
4.5.1 | Guest und Failure VLAN |
4.5.2 | Critical VLAN |
4.6 | Low-Impact Mode |
4.7 | Monitor Mode |
4.8 | Authentisierungs-Arten |
4.8.1 | Computer-Authentisierung |
4.8.2 | Benutzer-Authentisierung |
4.8.3 | Zweistufige Authentisierung |
4.8.4 | Authentication Chaining |
4.9 | Wake on LAN und 802.1x |
4.9.1 | Preboot Execution Environment |
4.10 | VoIP und 802.1x |
4.10.1 | Phone Authentication |
4.10.2 | VLAN Provisioning |
4.10.3 | Device Authentication |
5 | Public Key Infrastructure |
5.1 | Zertifikate ausstellen |
5.1.1 | Gültigkeits Zeitraum |
5.1.2 | Antragsteller |
5.1.3 | Key Usage & Enhanced Key Usage |
5.1.4 | Key Store |
5.2 | Authentifizierung |
5.3 | Verschlüsselung |
5.4 | Certificate Revocation List |
5.4.1 | CRL Security |
5.4.2 | Laufzeit |
5.4.3 | Delta CRLs |
5.4.4 | Autorisierung |
5.4.5 | Verfügbarkeit |
5.4.6 | Verfügbarkeit, ff. |
5.4.7 | Critical |
5.4.8 | Sperrgrund |
5.4.9 | Speicherorte |
5.5 | Infrastruktur |
5.5.1 | Path Validation |
5.5.2 | Path Discovery |
5.5.3 | Veröffentlichungspunkte |
5.5.4 | Online Certificate Status Protocol |
5.5.5 | Lebenszyklus |
5.6 | Microsoft CA Typen |
5.7 | Simple Certificate Enrollment Protocol |
5.8 | Public PKI |
5.9 | Checkliste |
6 | Verzeichnisdienste |
6.1 | Was ist ein Verzeichnisdienst? |
6.2 | Active Directory Domain Services |
6.2.1 | Domänen und Vertrauensstellungen |
6.2.2 | Active-Directory-Datenbank |
6.2.3 | Kerberos |
6.2.4 | Functional Level |
6.2.5 | Organisationseinheiten |
6.2.6 | Benutzer und Computer |
6.2.7 | Gruppenrichtlinien |
6.2.8 | Zuweisen von Gruppenrichtlinien |
6.3 | Authentisierung & Autorisierung |
6.4 | Distinguished Names |
6.5 | LDAP-Attribute |
6.5.1 | msNPAllowDialin |
6.5.2 | userAccountControl |
6.5.3 | Kennwörter |
6.5.4 | accountExpires |
6.5.5 | pwdLastSet |
6.5.6 | logonHours |
6.6 | Gruppen |
6.6.1 | Group Scope |
6.6.2 | Gruppen & Backlinks |
6.7 | DC vs. GC |
6.7.1 | Attribute des GC |
6.7.2 | Unterschiedliche Forests |
6.8 | LDAP-Autorisation |
6.9 | LDAP-Filter |
6.10 | Kerberos, LDAP & RADIUS |
6.11 | Checkliste |
7 | 802.1X in der Praxis – Übungen |
7.1 | Vorbereitungen |
7.1.1 | Das Testlabor |
7.1.2 | Switch:ISE Installation |
7.1.3 | Switch-Grundkonfiguration |
7.1.4 | Globale 802.1X Authentisierungs-Parameter |
7.1.5 | 802.1X Switchport-Konfiguration |
7.2 | Übung 1: EAP-MD5 |
7.2.1 | Authenticator konfigurieren |
7.2.2 | Benutzer anlegen |
7.2.3 | Authentisierung-Methode einrichten |
7.2.4 | AnyConnect als Supplicant |
7.2.5 | 802.1X mit EAP-MD5 testen |
7.2.6 | VLAN Provisioning |
7.2.7 | Globale Autorisierungs-Parameter |
7.2.8 | Autorisierung testen |
7.2.9 | Sperren des Benutzers |
7.3 | Übung 2: Mac Address Bypass |
7.3.1 | Switch-Konfiguration |
7.3.2 | Authentication |
7.3.3 | Benutzer anlegen |
7.3.4 | Authorization |
7.3.5 | MAB testen |
7.3.6 | MAC Adresse Ändern |
7.4 | Übung 3: WiFi |
7.4.1 | Authentisierungs-Methode hinzufügen |
7.4.2 | WiFi Autorisierung |
7.4.3 | WLAN Controller Konfiguration |
7.4.4 | Supplicant Konfiguration |
7.4.5 | 802.1X mit EAP-FAST testen |
7.5 | Übung 4: PEAP (MSCHAPv2) |
7.5.1 | Certification Authority |
7.5.2 | Root Zertifikat in der ISE importieren |
7.5.3 | Certificate Signing Request generieren |
7.5.4 | Zertifikat beantragen |
7.5.5 | Zertifikat importieren |
7.5.6 | Benutzer anlegen |
7.5.7 | Gruppe anlegen |
7.5.8 | Identity Store hinzufügen |
7.5.9 | Client der Domäne hinzufügen |
7.5.10 | Windows Supplicant konfigurieren |
7.5.11 | 802.1X mit PEAP(MS-CHAPv2) testen |
7.5.12 | Benutzer das Dial-in Recht entziehen |
7.6 | Übung 5: EAP-TLS |
7.6.1 | Network Policy Server |
7.6.2 | RADIUS Zertifikat beziehen |
7.6.3 | RADIUS Client einrichten |
7.6.4 | Einrichten einer Gruppe |
7.6.5 | Network Policies |
7.6.6 | NPS Logging |
7.6.7 | Certificate Validation |
7.6.8 | Zertifikatsvorlage erstellen |
7.6.9 | Sperrlisten konfigurieren |
7.6.10 | Autoenrollment einrichten |
7.6.11 | Windows Supplicant via GPO konfigurieren |
7.6.12 | 802.1X mit EAP-TLS testen |
7.6.13 | Zertifikat zurückziehen |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Hybrid training
- Hybrid training means that online participants can additionally attend a classroom course. The dynamics of a real seminar are maintained, and the online participants are able to benefit from that. Online participants of a hybrid course use a collaboration platform, such as WebEx Training Center or Saba Meeting. To do this, a PC with browser and Internet access is required, as well as a headset and ideally a Web cam. In the seminar room, we use specially developed and customized audio- and video-technologies. This makes sure that the communication between all persons involved works in a convenient and fault-free way.
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.

-
The variety of devices in the network, the use of external employees and new approaches such as Bring Your Own Device make it increasingly necessary to monitor access to the network and resources in the company. At the same time, a high degree of flexibility should be achieved for users and end devices. Securing network access with the help of 802.1X is becoming increasingly important. This course offers a practice-oriented and vendor-independent approach to the entire topic, including all peripheral areas such as RADIUS servers, certificates & PKI and domain controllers & LDAP. With the help of a comprehensive practical laboratory, all training content is deepened with exercises.
-
Course Contents
-
- IEEE 802.1X - The concept
- EAP protocol and methods in detail (Labs: MD5, FAST, PEAP, TLS)
- RADIUS protocol and server (Labs: Cisco ISE and MS NPS)
- 802.1X and VoIP, Windows authentication, WoL, MAB, etc.
- 802.1X in WiFi (Labs: Cisco WiFi AP & Controller)
- Tips for an 802.1X network: Authentication Order, Low-Impact Mode, etc.
- Weaknesses of 802.1X - MACSec
- Certificates in an 802.1X environment, structure and function of a PKI (Lab: MS Ent. CA)
- Connection to a directory service via LDAP (Lab: MS ADDS)
- Special features of Active Directory (group scopes, attribute formats, etc.)
- Clients for 802.1x (Labs: MS native & Cisco AnyConnect)
- Further aspects (NAC, NAP, Secure Group Tagging, etc.)
The detailed digital documentation package, consisting of an e-book and PDF, is included in the price of the course.
Premium Course Documents
In addition to the digital documentation package, the exclusive Premium Print Package is also available to you.
- High-quality color prints of the ExperTeach documentation
- Exclusive folder in an elegant design
- Document pouch in backpack shape
- Elegant LAMY ballpoint pen
- Practical notepad
The Premium Print Package can be added during the ordering process for € 150,- plus VAT (only for classroom participation). -
Target Group
-
This course is suitable for anyone who wants to deal with the topics of authentication and authorization in LAN and WLAN from a technical perspective.
-
Knowledge Prerequisites
-
You should have basic knowledge of Ethernet and WLAN and feel at home in the IP world. Familiarity with Microsoft operating systems is helpful, but not essential.
-
This event is recognized as further training as part of the T.I.S.P. recertification: T.I.S.P. recertification - eligibility for recognition.
1 | Sicherheit im LAN und WLAN |
1.1 | Klassische LAN Security |
1.1.1 | Device Hardening |
1.1.2 | Sicherung der Infrastruktur |
1.2 | Spoofing |
1.3 | Port Security – der Klassiker |
1.4 | DHCP Snooping |
1.5 | Dynamic ARP Inspection |
1.6 | IP Source Guard |
1.7 | uRPF gegen IP Spoofing |
1.8 | Private VLANs |
1.9 | Stateless Packet Filter |
1.10 | Port-gebundene Access-Listen |
1.10.1 | Router Access-Listen (RACL) |
1.10.2 | VLAN Access-Lists (VACL) |
1.11 | Identity Based Network Services |
2 | IEEE 802.1X – Portbasierte Authentisierung |
2.1 | IEEE 802.1X – Das Grundkonzept |
2.1.1 | Komponenten |
2.1.2 | Protokolle |
2.2 | Das Extensible Authentication Protocol (EAP) |
2.3 | EAP-Methoden |
2.3.1 | EAP-MD5 – Der Ablauf |
2.3.2 | PEAP – Der Ablauf |
2.3.3 | EAP-TLS |
2.3.4 | EAP-FAST |
2.3.5 | EAP-Vergleich |
2.4 | Komponenten von 802.1X |
2.4.1 | Supplicants |
2.4.2 | Switches |
2.4.3 | RADIUS-Server |
2.5 | Die Probleme |
3 | RADIUS |
3.1 | Radius – Zentrale Zugangskontolle |
3.1.1 | RADIUS – Der Ablauf |
3.1.2 | RADIUS und EAP |
3.1.3 | RADIUS – Change of Authorization (CoA) |
3.1.4 | RADIUS und EAP-MD5 |
3.1.5 | RADIUS und PEAP |
3.1.6 | RADIUS und EAP-TLS |
3.1.7 | RADIUS und MAC Bypass |
3.1.8 | RADIUS und Encryption Keys |
3.2 | RADIUS Accounting |
3.3 | Externe Datenbanken |
3.4 | RADIUS-Redundanz |
3.5 | Network Access Control |
3.6 | Network Policy Server – Microsoft |
3.7 | FreeRadius – Open Source |
3.8 | Cisco’s Identity Service Engine |
4 | IEEE 802.1X – Advanced |
4.1 | MAC Address Bypass |
4.2 | Dot1x im WLAN |
4.2.1 | WLAN Controller |
4.2.2 | IEEE 802.11i |
4.2.3 | WLAN und RADIUS |
4.2.4 | Gastzugänge |
4.3 | Multiple Hosts |
4.4 | IEEE 802.1x-2010 (MACsec) |
4.5 | VLAN-Zuweisung |
4.5.1 | Guest und Failure VLAN |
4.5.2 | Critical VLAN |
4.6 | Low-Impact Mode |
4.7 | Monitor Mode |
4.8 | Authentisierungs-Arten |
4.8.1 | Computer-Authentisierung |
4.8.2 | Benutzer-Authentisierung |
4.8.3 | Zweistufige Authentisierung |
4.8.4 | Authentication Chaining |
4.9 | Wake on LAN und 802.1x |
4.9.1 | Preboot Execution Environment |
4.10 | VoIP und 802.1x |
4.10.1 | Phone Authentication |
4.10.2 | VLAN Provisioning |
4.10.3 | Device Authentication |
5 | Public Key Infrastructure |
5.1 | Zertifikate ausstellen |
5.1.1 | Gültigkeits Zeitraum |
5.1.2 | Antragsteller |
5.1.3 | Key Usage & Enhanced Key Usage |
5.1.4 | Key Store |
5.2 | Authentifizierung |
5.3 | Verschlüsselung |
5.4 | Certificate Revocation List |
5.4.1 | CRL Security |
5.4.2 | Laufzeit |
5.4.3 | Delta CRLs |
5.4.4 | Autorisierung |
5.4.5 | Verfügbarkeit |
5.4.6 | Verfügbarkeit, ff. |
5.4.7 | Critical |
5.4.8 | Sperrgrund |
5.4.9 | Speicherorte |
5.5 | Infrastruktur |
5.5.1 | Path Validation |
5.5.2 | Path Discovery |
5.5.3 | Veröffentlichungspunkte |
5.5.4 | Online Certificate Status Protocol |
5.5.5 | Lebenszyklus |
5.6 | Microsoft CA Typen |
5.7 | Simple Certificate Enrollment Protocol |
5.8 | Public PKI |
5.9 | Checkliste |
6 | Verzeichnisdienste |
6.1 | Was ist ein Verzeichnisdienst? |
6.2 | Active Directory Domain Services |
6.2.1 | Domänen und Vertrauensstellungen |
6.2.2 | Active-Directory-Datenbank |
6.2.3 | Kerberos |
6.2.4 | Functional Level |
6.2.5 | Organisationseinheiten |
6.2.6 | Benutzer und Computer |
6.2.7 | Gruppenrichtlinien |
6.2.8 | Zuweisen von Gruppenrichtlinien |
6.3 | Authentisierung & Autorisierung |
6.4 | Distinguished Names |
6.5 | LDAP-Attribute |
6.5.1 | msNPAllowDialin |
6.5.2 | userAccountControl |
6.5.3 | Kennwörter |
6.5.4 | accountExpires |
6.5.5 | pwdLastSet |
6.5.6 | logonHours |
6.6 | Gruppen |
6.6.1 | Group Scope |
6.6.2 | Gruppen & Backlinks |
6.7 | DC vs. GC |
6.7.1 | Attribute des GC |
6.7.2 | Unterschiedliche Forests |
6.8 | LDAP-Autorisation |
6.9 | LDAP-Filter |
6.10 | Kerberos, LDAP & RADIUS |
6.11 | Checkliste |
7 | 802.1X in der Praxis – Übungen |
7.1 | Vorbereitungen |
7.1.1 | Das Testlabor |
7.1.2 | Switch:ISE Installation |
7.1.3 | Switch-Grundkonfiguration |
7.1.4 | Globale 802.1X Authentisierungs-Parameter |
7.1.5 | 802.1X Switchport-Konfiguration |
7.2 | Übung 1: EAP-MD5 |
7.2.1 | Authenticator konfigurieren |
7.2.2 | Benutzer anlegen |
7.2.3 | Authentisierung-Methode einrichten |
7.2.4 | AnyConnect als Supplicant |
7.2.5 | 802.1X mit EAP-MD5 testen |
7.2.6 | VLAN Provisioning |
7.2.7 | Globale Autorisierungs-Parameter |
7.2.8 | Autorisierung testen |
7.2.9 | Sperren des Benutzers |
7.3 | Übung 2: Mac Address Bypass |
7.3.1 | Switch-Konfiguration |
7.3.2 | Authentication |
7.3.3 | Benutzer anlegen |
7.3.4 | Authorization |
7.3.5 | MAB testen |
7.3.6 | MAC Adresse Ändern |
7.4 | Übung 3: WiFi |
7.4.1 | Authentisierungs-Methode hinzufügen |
7.4.2 | WiFi Autorisierung |
7.4.3 | WLAN Controller Konfiguration |
7.4.4 | Supplicant Konfiguration |
7.4.5 | 802.1X mit EAP-FAST testen |
7.5 | Übung 4: PEAP (MSCHAPv2) |
7.5.1 | Certification Authority |
7.5.2 | Root Zertifikat in der ISE importieren |
7.5.3 | Certificate Signing Request generieren |
7.5.4 | Zertifikat beantragen |
7.5.5 | Zertifikat importieren |
7.5.6 | Benutzer anlegen |
7.5.7 | Gruppe anlegen |
7.5.8 | Identity Store hinzufügen |
7.5.9 | Client der Domäne hinzufügen |
7.5.10 | Windows Supplicant konfigurieren |
7.5.11 | 802.1X mit PEAP(MS-CHAPv2) testen |
7.5.12 | Benutzer das Dial-in Recht entziehen |
7.6 | Übung 5: EAP-TLS |
7.6.1 | Network Policy Server |
7.6.2 | RADIUS Zertifikat beziehen |
7.6.3 | RADIUS Client einrichten |
7.6.4 | Einrichten einer Gruppe |
7.6.5 | Network Policies |
7.6.6 | NPS Logging |
7.6.7 | Certificate Validation |
7.6.8 | Zertifikatsvorlage erstellen |
7.6.9 | Sperrlisten konfigurieren |
7.6.10 | Autoenrollment einrichten |
7.6.11 | Windows Supplicant via GPO konfigurieren |
7.6.12 | 802.1X mit EAP-TLS testen |
7.6.13 | Zertifikat zurückziehen |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Hybrid training
- Hybrid training means that online participants can additionally attend a classroom course. The dynamics of a real seminar are maintained, and the online participants are able to benefit from that. Online participants of a hybrid course use a collaboration platform, such as WebEx Training Center or Saba Meeting. To do this, a PC with browser and Internet access is required, as well as a headset and ideally a Web cam. In the seminar room, we use specially developed and customized audio- and video-technologies. This makes sure that the communication between all persons involved works in a convenient and fault-free way.
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
