WEBVTT

1
00:00.000 --> 00:01.562 align:middle line:84%


2
00:01.562 --> 00:03.020 align:middle line:90%
In the previous
set of videos where

3
00:03.020 --> 00:06.650 align:middle line:90%
we looked at IKEv2 and FlexVPN
with site-to-site VPNs,

4
00:06.650 --> 00:10.280 align:middle line:90%
we discovered there's a few more
configuration items with IKEv2.

5
00:10.280 --> 00:13.220 align:middle line:90%
Including proposals, and
policies, and profiles.

6
00:13.220 --> 00:15.930 align:middle line:90%
We also took a look at how
those are nested together.

7
00:15.930 --> 00:19.790 align:middle line:90%
Now with remote access VPN, we
have some more stuff going on.

8
00:19.790 --> 00:22.800 align:middle line:90%
Meaning, we have-- we're going
to need digital certificates

9
00:22.800 --> 00:24.197 align:middle line:84%
for remote access VPNs.

10
00:24.197 --> 00:26.030 align:middle line:90%
We're going to validate
who that server is--

11
00:26.030 --> 00:29.000 align:middle line:90%
the headend device, the
router, with RSA signatures,

12
00:29.000 --> 00:30.150 align:middle line:84%
with digital certificates.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.000 --> 00:30.150 align:middle line:84%
with digital certificates.

13
00:30.150 --> 00:31.550 align:middle line:84%
So we need to make that work.

14
00:31.550 --> 00:34.440 align:middle line:90%
Also we need to validate who
the user is when they come in.

15
00:34.440 --> 00:36.270 align:middle line:90%
So there's some
AAA commands there.

16
00:36.270 --> 00:38.810 align:middle line:90%
So I'd like to give you a
high-level picture of some

17
00:38.810 --> 00:40.820 align:middle line:90%
of the additional
components that we

18
00:40.820 --> 00:44.000 align:middle line:90%
are going to need to put in
the recipe for our FlexVPNs

19
00:44.000 --> 00:45.200 align:middle line:84%
with remote access.

20
00:45.200 --> 00:46.640 align:middle line:90%
And then what we'll
do after we've

21
00:46.640 --> 00:49.140 align:middle line:90%
looked at the parts and the
new pieces, in the next video,

22
00:49.140 --> 00:50.870 align:middle line:90%
we'll make a design
regarding how

23
00:50.870 --> 00:52.790 align:middle line:90%
we want to implement--
or follow it up

24
00:52.790 --> 00:54.710 align:middle line:90%
by actually implementing
the solution

25
00:54.710 --> 00:56.272 align:middle line:84%
and then verifying that design.

26
00:56.272 --> 00:57.230 align:middle line:84%
So here, let's do this.

27
00:57.230 --> 01:01.820 align:middle line:90%
For IKEv2, we are going
to have everything
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:57.230 --> 01:01.820 align:middle line:90%
For IKEv2, we are going
to have everything

28
01:01.820 --> 01:03.920 align:middle line:90%
that we had for
site-to-site tunnels,

29
01:03.920 --> 01:08.102 align:middle line:90%
including the proposals, and
the profile, and the policy.

30
01:08.102 --> 01:10.560 align:middle line:90%
And we're going have to do that
again for the remote access

31
01:10.560 --> 01:12.770 align:middle line:90%
so this user can build
a VPN tunnel here.

32
01:12.770 --> 01:14.575 align:middle line:84%
That also is true for IPSec.

33
01:14.575 --> 01:15.950 align:middle line:90%
We'll have at
least as much as we

34
01:15.950 --> 01:20.300 align:middle line:90%
did for the site-to-site tunnel,
including the IPSec transform

35
01:20.300 --> 01:23.210 align:middle line:84%
set, and also the IPSec profile.

36
01:23.210 --> 01:24.720 align:middle line:90%
And with IKE version
2, which we're

37
01:24.720 --> 01:26.990 align:middle line:90%
going to be leveraging
here with FlexVPN,

38
01:26.990 --> 01:29.090 align:middle line:90%
we can use a lot of the
defaults if we want to,

39
01:29.090 --> 01:30.172 align:middle line:84%
if they meet our needs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.090 --> 01:30.172 align:middle line:84%
if they meet our needs.

40
01:30.172 --> 01:31.880 align:middle line:90%
But if we don't want
to use the defaults,

41
01:31.880 --> 01:34.490 align:middle line:90%
we need to create those
individual components.

42
01:34.490 --> 01:35.990 align:middle line:90%
So let me focus on
what we are going

43
01:35.990 --> 01:40.310 align:middle line:90%
to add in addition to the
basics of IKEv2 and IPSec

44
01:40.310 --> 01:42.220 align:middle line:90%
that we did in our
site-to-site video.

45
01:42.220 --> 01:46.340 align:middle line:90%
We are going to add some AAA
methods, including how are we

46
01:46.340 --> 01:48.060 align:middle line:84%
going to authenticate the user?

47
01:48.060 --> 01:51.170 align:middle line:90%
So instead of using a
nice server with radius,

48
01:51.170 --> 01:53.870 align:middle line:90%
we'll go ahead and do local
authentication right here

49
01:53.870 --> 01:55.100 align:middle line:84%
on the headend device.

50
01:55.100 --> 01:57.260 align:middle line:90%
Also because when
the user connects,

51
01:57.260 --> 01:59.840 align:middle line:90%
they're going to need to
authenticate this device based

52
01:59.840 --> 02:02.110 align:middle line:84%
on a digital certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.840 --> 02:02.110 align:middle line:84%
on a digital certificate.

53
02:02.110 --> 02:04.880 align:middle line:90%
One of the-- let me bring
the big screen for this.

54
02:04.880 --> 02:07.040 align:middle line:90%
One of the challenges I
found is that as people

55
02:07.040 --> 02:10.580 align:middle line:90%
are trying to lab this up and
get their head around this,

56
02:10.580 --> 02:12.230 align:middle line:84%
if you have to bring in all--

57
02:12.230 --> 02:15.140 align:middle line:90%
I know I need a CA Server, and
you bring in a Windows Server,

58
02:15.140 --> 02:17.140 align:middle line:90%
and you get that all
configured, and then enroll

59
02:17.140 --> 02:19.098 align:middle line:90%
and everything else, I
thought, let me do this.

60
02:19.098 --> 02:21.470 align:middle line:90%
We do need to have some
certificates involved

61
02:21.470 --> 02:23.690 align:middle line:90%
for the headend device,
Cisco iOS running

62
02:23.690 --> 02:26.540 align:middle line:84%
FlexVPN for remote access VPNs.

63
02:26.540 --> 02:28.490 align:middle line:90%
So what that we do
is let's go ahead

64
02:28.490 --> 02:32.090 align:middle line:90%
and have the router
itself be a CA Server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.490 --> 02:32.090 align:middle line:90%
and have the router
itself be a CA Server.

65
02:32.090 --> 02:34.820 align:middle line:90%
And then we'll have the router
itself say, I trust myself,

66
02:34.820 --> 02:37.250 align:middle line:90%
and I'll get my own identity
certificate for myself.

67
02:37.250 --> 02:38.750 align:middle line:90%
And that way, we
don't have to bring

68
02:38.750 --> 02:41.057 align:middle line:90%
in a third device in
a lab environment,

69
02:41.057 --> 02:42.890 align:middle line:90%
like a Windows Server
or something else just

70
02:42.890 --> 02:44.240 align:middle line:84%
for a CA Server.

71
02:44.240 --> 02:46.500 align:middle line:90%
We'll do that locally
on the router itself.

72
02:46.500 --> 02:48.740 align:middle line:90%
So local authentication
for the user.

73
02:48.740 --> 02:52.123 align:middle line:90%
We'll also do a local
certificate authority.

74
02:52.123 --> 02:53.540 align:middle line:90%
And as far as
pushing policy down,

75
02:53.540 --> 02:55.190 align:middle line:90%
if we will say,
Hey, only encrypt

76
02:55.190 --> 02:57.680 align:middle line:90%
and send traffic over the
tunnel for the 10 networks,

77
02:57.680 --> 03:00.780 align:middle line:90%
we're also going to need
some authorization policies.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:57.680 --> 03:00.780 align:middle line:90%
we're also going to need
some authorization policies.

78
03:00.780 --> 03:03.320 align:middle line:90%
Now I know it sounds like when
you think of an authorization

79
03:03.320 --> 03:06.347 align:middle line:90%
policy, whether
it's IKEv2 or AAA,

80
03:06.347 --> 03:08.430 align:middle line:90%
authorization sounds like,
Oh, it has permissions.

81
03:08.430 --> 03:09.740 align:middle line:84%
I'm allowed to do this.

82
03:09.740 --> 03:11.360 align:middle line:90%
However, the
authorization policy

83
03:11.360 --> 03:13.710 align:middle line:90%
is also instructing,
in our case,

84
03:13.710 --> 03:15.690 align:middle line:84%
the VPN client what to do.

85
03:15.690 --> 03:17.680 align:middle line:90%
So if we wanted to
train this VPN client,

86
03:17.680 --> 03:20.180 align:middle line:90%
the AnyConnct client that was
connecting that it should only

87
03:20.180 --> 03:22.430 align:middle line:90%
do split telling
based on a 10, that

88
03:22.430 --> 03:24.550 align:middle line:90%
be done through an
authorization policy.

89
03:24.550 --> 03:27.408 align:middle line:90%
Another element we'll need
to plan on is addresses.

90
03:27.408 --> 03:29.450 align:middle line:90%
You might say, Keith, what
do you mean addresses?

91
03:29.450 --> 03:32.510 align:middle line:90%
This guy has an address,
the server has an address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:29.450 --> 03:32.510 align:middle line:90%
This guy has an address,
the server has an address,

92
03:32.510 --> 03:34.580 align:middle line:84%
but when this VPN is built--

93
03:34.580 --> 03:37.370 align:middle line:90%
if we want to hand this client
a virtual IP address that they

94
03:37.370 --> 03:39.920 align:middle line:90%
could use for its
journey on this network,

95
03:39.920 --> 03:42.260 align:middle line:90%
we need to identify
a range of addresses

96
03:42.260 --> 03:43.260 align:middle line:84%
we want to use for that.

97
03:43.260 --> 03:49.970 align:middle line:90%
So let's imagine that we have
an address of 10.67.83.51

98
03:49.970 --> 03:51.020 align:middle line:84%
through 100.

99
03:51.020 --> 03:52.670 align:middle line:90%
We can assign that
as the range of IP

100
03:52.670 --> 03:54.620 align:middle line:90%
addresses that when the
VPN client connects,

101
03:54.620 --> 03:57.330 align:middle line:90%
it's logically given
one of those addresses.

102
03:57.330 --> 03:59.840 align:middle line:90%
And then when it communicates
with internal devices,

103
03:59.840 --> 04:02.980 align:middle line:90%
it'll look like it's coming
from one of these IP addresses
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:59.840 --> 04:02.980 align:middle line:90%
it'll look like it's coming
from one of these IP addresses

104
04:02.980 --> 04:04.230 align:middle line:84%
from the internal perspective.

105
04:04.230 --> 04:06.140 align:middle line:90%
And now when the
traffic comes back,

106
04:06.140 --> 04:07.390 align:middle line:84%
the router will now, Oh, yeah.

107
04:07.390 --> 04:08.907 align:middle line:90%
I know who I gave
that address to.

108
04:08.907 --> 04:10.490 align:middle line:90%
And then it can route
the traffic back

109
04:10.490 --> 04:13.670 align:middle line:90%
over the tunnel over to the PC
if that was a response coming

110
04:13.670 --> 04:15.680 align:middle line:84%
from a server on the inside.

111
04:15.680 --> 04:18.500 align:middle line:90%
So addresses are another
element that we need to plan on.

112
04:18.500 --> 04:20.899 align:middle line:90%
Another magic trick
that this hidden device

113
04:20.899 --> 04:23.617 align:middle line:90%
is going to pull off is
called a virtual template.

114
04:23.617 --> 04:25.950 align:middle line:90%
And the way this works is
that when this client connects

115
04:25.950 --> 04:27.867 align:middle line:90%
and authenticates, the
router is going to say,

116
04:27.867 --> 04:30.050 align:middle line:90%
Well, I need to keep track
of this remote access
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:27.867 --> 04:30.050 align:middle line:90%
Well, I need to keep track
of this remote access

117
04:30.050 --> 04:31.040 align:middle line:84%
VPN that's coming in.

118
04:31.040 --> 04:32.840 align:middle line:90%
And it will take this
virtual template,

119
04:32.840 --> 04:34.730 align:middle line:90%
and it will
effectively clone it,

120
04:34.730 --> 04:38.420 align:middle line:90%
and make itself a new logical
interface for that VPN

121
04:38.420 --> 04:42.063 align:middle line:90%
connection from the VPN client
coming into the headend device.

122
04:42.063 --> 04:43.980 align:middle line:90%
And that's can be based
on a virtual template.

123
04:43.980 --> 04:45.810 align:middle line:90%
So in that virtual
template, we're

124
04:45.810 --> 04:48.130 align:middle line:84%
going to specify an IP address.

125
04:48.130 --> 04:50.600 align:middle line:90%
And instead of specifying a
unique IP address for each one,

126
04:50.600 --> 04:53.630 align:middle line:90%
we can use a technique
called IP unnumbered.

127
04:53.630 --> 04:56.900 align:middle line:90%
So we get like an interface
loopback 1 or 100,

128
04:56.900 --> 05:00.512 align:middle line:90%
and we give an IP
address of 1.1.1.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:56.900 --> 05:00.512 align:middle line:90%
and we give an IP
address of 1.1.1.1.

129
05:00.512 --> 05:02.220 align:middle line:90%
And then we get an
virtual template mode,

130
05:02.220 --> 05:04.200 align:middle line:90%
we can say, IP
address unnumbered

131
05:04.200 --> 05:06.390 align:middle line:84%
and specify loopback 1.

132
05:06.390 --> 05:09.450 align:middle line:90%
So basically this
new logical interface

133
05:09.450 --> 05:13.020 align:middle line:90%
would have the same address
as loopback 1 in this case.

134
05:13.020 --> 05:16.440 align:middle line:90%
All it is, is just a placeholder
for this new logical interface

135
05:16.440 --> 05:18.390 align:middle line:90%
that has been
created dynamically

136
05:18.390 --> 05:19.700 align:middle line:84%
from the virtual template.

137
05:19.700 --> 05:22.432 align:middle line:90%
So the configuration
for remote access VPN

138
05:22.432 --> 05:24.640 align:middle line:90%
is pretty steep because
there's so many moving parts,

139
05:24.640 --> 05:26.550 align:middle line:90%
but here's what we can
do to make it easier.

140
05:26.550 --> 05:28.290 align:middle line:90%
In the next video,
let's put together

141
05:28.290 --> 05:32.590 align:middle line:90%
a plan regarding what we want
to use for the IP addresses
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
05:28.290 --> 05:32.590 align:middle line:90%
a plan regarding what we want
to use for the IP addresses

142
05:32.590 --> 05:34.560 align:middle line:90%
and for the pool, and
what we want to use

143
05:34.560 --> 05:35.790 align:middle line:84%
for the split telling policy.

144
05:35.790 --> 05:37.590 align:middle line:90%
We'll put those
details in place,

145
05:37.590 --> 05:40.020 align:middle line:90%
and then we'll follow it up
by doing the configuration

146
05:40.020 --> 05:41.250 align:middle line:84%
to implement it.

147
05:41.250 --> 05:43.200 align:middle line:90%
And then we'll
verify it together.

148
05:43.200 --> 05:45.420 align:middle line:90%
So we'll continue that
journey, including the design

149
05:45.420 --> 05:46.630 align:middle line:84%
in the very next video.

150
05:46.630 --> 05:48.670 align:middle line:90%
And I hope to see you
there in just a moment.

151
05:48.670 --> 05:51.030 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

152
05:51.030 --> 05:54.170 align:middle line:90%
and I'd like to thank
you for viewing.