WEBVTT

1
00:00.000 --> 00:00.305 align:middle line:84%


2
00:00.305 --> 00:02.430 align:middle line:90%
In this video, I'd like to
chat with you about some

3
00:02.430 --> 00:04.097 align:middle line:90%
of the common protocols
that we'll often

4
00:04.097 --> 00:07.470 align:middle line:90%
find in methods that are used
when implementing remote access

5
00:07.470 --> 00:10.360 align:middle line:90%
VPNs, including in
a Cisco environment.

6
00:10.360 --> 00:12.060 align:middle line:90%
So let's start off
with this topology.

7
00:12.060 --> 00:14.010 align:middle line:90%
We've got a user that
says Bob down here,

8
00:14.010 --> 00:17.220 align:middle line:90%
and let's use R1 as
a head-end device.

9
00:17.220 --> 00:19.680 align:middle line:90%
And this would give me the
corporate side of our VPN

10
00:19.680 --> 00:21.060 align:middle line:84%
tunnel right here, R1.

11
00:21.060 --> 00:22.920 align:middle line:90%
So as far as the
technologies to protect

12
00:22.920 --> 00:25.905 align:middle line:90%
the traffic for our
VPNs, we could use IPSec.

13
00:25.905 --> 00:27.030 align:middle line:84%
That's certainly an option.

14
00:27.030 --> 00:32.400 align:middle line:90%
We can also use the TLS flavor,
which is SSL/TLS, TLS being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.030 --> 00:32.400 align:middle line:90%
We can also use the TLS flavor,
which is SSL/TLS, TLS being

15
00:32.400 --> 00:33.810 align:middle line:84%
the more secure option there.

16
00:33.810 --> 00:37.977 align:middle line:90%
But both of these can be
used for remote access VPNs.

17
00:37.977 --> 00:39.810 align:middle line:90%
Now if we were making
a list of those things

18
00:39.810 --> 00:41.857 align:middle line:90%
that we would like, a
wish list for those things

19
00:41.857 --> 00:44.190 align:middle line:90%
that we'd like to be able to
do with a remote access VPN

20
00:44.190 --> 00:47.100 align:middle line:90%
from our perspective, from the
administration perspective,

21
00:47.100 --> 00:48.880 align:middle line:90%
it would be a great
idea if we could push.

22
00:48.880 --> 00:50.130 align:middle line:84%
What do you mean, Keith, push?

23
00:50.130 --> 00:53.320 align:middle line:90%
If we could push policy
down to the VPN client.

24
00:53.320 --> 00:56.460 align:middle line:90%
So when they connect, of course,
we would authenticate them,

25
00:56.460 --> 00:58.620 align:middle line:90%
make sure we know who
they are, before we just

26
00:58.620 --> 00:59.700 align:middle line:84%
build a VPN with anybody.

27
00:59.700 --> 01:01.350 align:middle line:90%
But once we
authenticate them, it'd
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.700 --> 01:01.350 align:middle line:90%
But once we
authenticate them, it'd

28
01:01.350 --> 01:04.170 align:middle line:90%
be great if we could push
policy down regarding routing.

29
01:04.170 --> 01:05.650 align:middle line:84%
And here's what I mean by that.

30
01:05.650 --> 01:08.660 align:middle line:90%
If we have over here the
10 network behind R1,

31
01:08.660 --> 01:11.540 align:middle line:90%
and this is our VPN server,
and this device here

32
01:11.540 --> 01:13.470 align:middle line:90%
would be our VPN
client, referring

33
01:13.470 --> 01:15.720 align:middle line:90%
to the device like
Bob's computer,

34
01:15.720 --> 01:17.700 align:middle line:90%
if we want to protect
the traffic between Bob's

35
01:17.700 --> 01:21.072 align:middle line:90%
computer and the 10 networks, we
could push down routing policy

36
01:21.072 --> 01:22.530 align:middle line:90%
and say, you know
what, if you need

37
01:22.530 --> 01:24.270 align:middle line:90%
to reach the 10
anything network,

38
01:24.270 --> 01:26.940 align:middle line:90%
go ahead and send that
traffic over the tunnel.

39
01:26.940 --> 01:29.340 align:middle line:90%
And we could push
that policy down.

40
01:29.340 --> 01:31.840 align:middle line:90%
And as long as that VPN's up,
he'll follow his instructions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.340 --> 01:31.840 align:middle line:90%
And as long as that VPN's up,
he'll follow his instructions.

41
01:31.840 --> 01:34.290 align:middle line:90%
So traffic to the 10 network
would go over the tunnel,

42
01:34.290 --> 01:38.013 align:middle line:90%
whereas traffic that's like
for Netflix or something else

43
01:38.013 --> 01:39.180 align:middle line:84%
wouldn't go over the tunnel.

44
01:39.180 --> 01:41.100 align:middle line:90%
The destination
address would be 10.

45
01:41.100 --> 01:44.130 align:middle line:90%
And as a result, that computer
with the VPN client software

46
01:44.130 --> 01:46.800 align:middle line:90%
running would simply
forward it out naked and not

47
01:46.800 --> 01:47.800 align:middle line:84%
send it over the tunnel.

48
01:47.800 --> 01:51.990 align:middle line:90%
Now that's referred to as a
concept of split tunneling.

49
01:51.990 --> 01:54.120 align:middle line:90%
And most companies are
using some flavor of that.

50
01:54.120 --> 01:54.660 align:middle line:84%
Why is that?

51
01:54.660 --> 01:57.293 align:middle line:90%
Because there's too much
traffic to send everything

52
01:57.293 --> 01:57.960 align:middle line:84%
over the tunnel.

53
01:57.960 --> 02:01.500 align:middle line:90%
If we wanted Bob to
do a full tunnel,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:57.960 --> 02:01.500 align:middle line:90%
If we wanted Bob to
do a full tunnel,

54
02:01.500 --> 02:04.320 align:middle line:90%
if he's going to Netflix while
the VPN happens to be up,

55
02:04.320 --> 02:06.900 align:middle line:90%
his traffic for Netflix would
go to the corporate server,

56
02:06.900 --> 02:08.139 align:middle line:84%
encrypted.

57
02:08.139 --> 02:10.919 align:middle line:90%
The server would flip that
around and send it out

58
02:10.919 --> 02:13.440 align:middle line:90%
naked out to the
internet, to Netflix.

59
02:13.440 --> 02:15.858 align:middle line:90%
That traffic would have to go
back to the head-end device,

60
02:15.858 --> 02:18.150 align:middle line:90%
and then back encrypted
through the tunnel back to Bob.

61
02:18.150 --> 02:18.720 align:middle line:84%
No.

62
02:18.720 --> 02:20.140 align:middle line:84%
Nobody asked for that.

63
02:20.140 --> 02:23.217 align:middle line:90%
So split tunneling is the way
to go for most implementations.

64
02:23.217 --> 02:25.800 align:middle line:90%
If he had some kind of a really
high secure environment, where

65
02:25.800 --> 02:27.270 align:middle line:90%
everything has to be
sent through the tunnel

66
02:27.270 --> 02:29.830 align:middle line:90%
for inspection and so forth,
that might be a business case.

67
02:29.830 --> 02:32.455 align:middle line:90%
But most companies are going to
be doing split tunneling, based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:29.830 --> 02:32.455 align:middle line:90%
But most companies are going to
be doing split tunneling, based

68
02:32.455 --> 02:33.910 align:middle line:84%
on pushing routing policy down.

69
02:33.910 --> 02:36.900 align:middle line:90%
We can also push down
policies such as firewalls

70
02:36.900 --> 02:38.490 align:middle line:84%
and other restrictions.

71
02:38.490 --> 02:40.770 align:middle line:90%
So that while the VPN
client is running,

72
02:40.770 --> 02:43.200 align:middle line:90%
it can enforce those policies
that have been pushed down

73
02:43.200 --> 02:44.530 align:middle line:84%
from the VPN server.

74
02:44.530 --> 02:46.530 align:middle line:90%
Now in a Cisco environment,
the primary software

75
02:46.530 --> 02:50.560 align:middle line:90%
we're going to use as a VPN
client is the Cisco AnyConnect

76
02:50.560 --> 02:51.060 align:middle line:84%
client.

77
02:51.060 --> 02:53.940 align:middle line:84%
And it can support SSL/TLS.

78
02:53.940 --> 02:55.493 align:middle line:84%
It can support IPSec.

79
02:55.493 --> 02:56.910 align:middle line:90%
So we have a profile
letter, which

80
02:56.910 --> 02:58.980 align:middle line:90%
we can create
profiles, and then have

81
02:58.980 --> 03:01.380 align:middle line:90%
our clients go ahead and
use those profiles for,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:58.980 --> 03:01.380 align:middle line:90%
our clients go ahead and
use those profiles for,

82
03:01.380 --> 03:03.900 align:middle line:90%
based on how we want them
to connect for the VPN,

83
03:03.900 --> 03:06.510 align:middle line:90%
whether-- is it
SSL or is it IPSec?

84
03:06.510 --> 03:08.730 align:middle line:90%
And if so, what's the
server IP addresses?

85
03:08.730 --> 03:10.615 align:middle line:90%
Who's our backup
server and so forth?

86
03:10.615 --> 03:12.240 align:middle line:90%
Now VPNs, of course,
are not restricted

87
03:12.240 --> 03:14.090 align:middle line:90%
to using a literal
software client

88
03:14.090 --> 03:15.840 align:middle line:90%
because we might have
some software that's

89
03:15.840 --> 03:18.150 align:middle line:90%
built into the operating
system that could also

90
03:18.150 --> 03:20.010 align:middle line:84%
be used as part of a VPN.

91
03:20.010 --> 03:24.240 align:middle line:90%
So that depends on like
Apple or Windows or a Linux

92
03:24.240 --> 03:26.310 align:middle line:90%
and what their clients
and what their operating

93
03:26.310 --> 03:27.268 align:middle line:84%
systems are capable of.

94
03:27.268 --> 03:29.560 align:middle line:90%
But most of the time, if
you're using a Cisco solution,

95
03:29.560 --> 03:31.620 align:middle line:90%
you're going to use the
AnyConnect client, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:29.560 --> 03:31.620 align:middle line:90%
you're going to use the
AnyConnect client, which

96
03:31.620 --> 03:34.120 align:middle line:90%
integrates really well with
Cisco's head-end devices,

97
03:34.120 --> 03:39.190 align:middle line:90%
including R1 as an IOS router
that's acting as a VPN server.

98
03:39.190 --> 03:41.910 align:middle line:90%
So those are some options that
we have for remote access VPNs,

99
03:41.910 --> 03:44.322 align:middle line:90%
but it doesn't have to be
limited to a router acting

100
03:44.322 --> 03:45.280 align:middle line:84%
as the head-end device.

101
03:45.280 --> 03:47.125 align:middle line:84%
We can also have a Cisco ASA.

102
03:47.125 --> 03:48.750 align:middle line:90%
We could use a
Firepower Threat Defense

103
03:48.750 --> 03:52.560 align:middle line:90%
system that's terminated that
VPN tunnel, Check Point, Palo

104
03:52.560 --> 03:53.880 align:middle line:84%
Alto.

105
03:53.880 --> 03:54.610 align:middle line:84%
The list goes on.

106
03:54.610 --> 03:55.652 align:middle line:84%
There's lots of vendors--

107
03:55.652 --> 03:58.050 align:middle line:90%
Juniper, that support
VPN solutions.

108
03:58.050 --> 03:59.550 align:middle line:90%
So in this video,
we've taken a look

109
03:59.550 --> 04:01.830 align:middle line:90%
at some of the aspects
and options for it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
03:59.550 --> 04:01.830 align:middle line:90%
at some of the aspects
and options for it.

110
04:01.830 --> 04:05.100 align:middle line:90%
In the next video, I'd like to
take a look at using a Cisco

111
04:05.100 --> 04:08.760 align:middle line:90%
router with FlexVPN, and
what's involved there

112
04:08.760 --> 04:10.865 align:middle line:84%
to support remote access VPNs.

113
04:10.865 --> 04:12.490 align:middle line:90%
So I'll see you there
in just a moment.

114
04:12.490 --> 04:14.850 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

115
04:14.850 --> 04:18.020 align:middle line:90%
and I'd like to thank
you for viewing.