WEBVTT

1
00:00.000 --> 00:01.120 align:middle line:84%


2
00:01.120 --> 00:03.488 align:middle line:90%
It's not too easy to
follow a recipe if you

3
00:03.488 --> 00:04.780 align:middle line:84%
don't have all the ingredients.

4
00:04.780 --> 00:06.550 align:middle line:90%
So in this video, I'd
like to talk about a few

5
00:06.550 --> 00:07.967 align:middle line:90%
of the ingredients
that we will be

6
00:07.967 --> 00:12.760 align:middle line:90%
putting into our remote access
VPNs using FlexVPN and IKEv2.

7
00:12.760 --> 00:15.760 align:middle line:90%
So for our planning, we're going
to need to have a certificate

8
00:15.760 --> 00:16.300 align:middle line:84%
authority.

9
00:16.300 --> 00:18.850 align:middle line:84%
Let's use a local CA here on R1.

10
00:18.850 --> 00:20.770 align:middle line:90%
So we're going to
basically tell R1

11
00:20.770 --> 00:22.470 align:middle line:84%
it's a certificate authority.

12
00:22.470 --> 00:25.130 align:middle line:90%
And then we'll have it go
ahead and authenticate itself,

13
00:25.130 --> 00:26.750 align:middle line:90%
which means it will
get its own-- it

14
00:26.750 --> 00:29.272 align:middle line:90%
will trust its own certificate
as a root certificate.

15
00:29.272 --> 00:30.730 align:middle line:90%
And then we'll go
ahead and enroll,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.272 --> 00:30.730 align:middle line:90%
And then we'll go
ahead and enroll,

16
00:30.730 --> 00:32.897 align:middle line:90%
which means it'll also have
an identity certificate.

17
00:32.897 --> 00:34.180 align:middle line:84%
I'll walk you through that.

18
00:34.180 --> 00:37.375 align:middle line:90%
And that will help us not have
to go to an external CA just

19
00:37.375 --> 00:40.450 align:middle line:90%
to get this lab working,
because with AnyConnect,

20
00:40.450 --> 00:43.990 align:middle line:90%
connecting to a FlexVPN
hidden router operating IOS,

21
00:43.990 --> 00:48.100 align:middle line:90%
this has to be using RSA
signatures for authentication.

22
00:48.100 --> 00:49.390 align:middle line:84%
Otherwise, it won't work.

23
00:49.390 --> 00:53.530 align:middle line:90%
Also, for AAA, authenticating
a user as they come in, let's

24
00:53.530 --> 00:56.310 align:middle line:90%
specify all AAA
methods are going

25
00:56.310 --> 00:58.970 align:middle line:90%
to be ultimately referring
to the local database.

26
00:58.970 --> 01:02.140 align:middle line:90%
So we'll specify a local
user in the running config.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.970 --> 01:02.140 align:middle line:90%
So we'll specify a local
user in the running config.

27
01:02.140 --> 01:03.640 align:middle line:90%
And we'll call up
on that when we're

28
01:03.640 --> 01:06.490 align:middle line:90%
doing the authentication of the
user who's trying to connect.

29
01:06.490 --> 01:08.740 align:middle line:90%
For the pool of addresses,
when this guy does connect,

30
01:08.740 --> 01:14.750 align:middle line:90%
let's use 10.67.83.51
through 100.

31
01:14.750 --> 01:17.950 align:middle line:90%
Now, this one user won't
need all those addresses.

32
01:17.950 --> 01:20.590 align:middle line:90%
But it'd be good to have
at least enough addresses

33
01:20.590 --> 01:24.520 align:middle line:90%
for the expected amount of VPNs
clients who will be connecting.

34
01:24.520 --> 01:27.070 align:middle line:90%
Also, let's do a split
tunnel policy that

35
01:27.070 --> 01:31.100 align:middle line:90%
says traffic going to the 10 is
going to go through the tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:27.070 --> 01:31.100 align:middle line:90%
says traffic going to the 10 is
going to go through the tunnel.

36
01:31.100 --> 01:34.900 align:middle line:90%
Let's also specify a DNS server
if we have an internal DNS

37
01:34.900 --> 01:37.870 align:middle line:90%
server we wanted to use
while his VPN tunnel is up.

38
01:37.870 --> 01:39.640 align:middle line:90%
So we can specify a
DNS server as well.

39
01:39.640 --> 01:42.940 align:middle line:84%
Let's use 10.5.5.5.

40
01:42.940 --> 01:45.620 align:middle line:90%
So what should happen
when the VPN tunnel is up,

41
01:45.620 --> 01:48.490 align:middle line:90%
we should have in our routing
policy that 10 anything would

42
01:48.490 --> 01:51.400 align:middle line:90%
go over the tunnel, and also
the IP address of the DNS server

43
01:51.400 --> 01:52.580 align:middle line:84%
would go over the tunnel.

44
01:52.580 --> 01:54.580 align:middle line:90%
Now, when the user does
connect to authenticate,

45
01:54.580 --> 01:56.290 align:middle line:90%
we're going to use
a virtual template,

46
01:56.290 --> 01:58.780 align:middle line:90%
and effectively, we're going
to create a logical interface

47
01:58.780 --> 02:00.895 align:middle line:90%
for this user connection
for the VPN tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:58.780 --> 02:00.895 align:middle line:90%
for this user connection
for the VPN tunnel

48
02:00.895 --> 02:03.145 align:middle line:90%
so that we have it in the
routing table and everything

49
02:03.145 --> 02:04.960 align:middle line:90%
else, but that
virtual template, we

50
02:04.960 --> 02:08.320 align:middle line:90%
are going to define as part
of our FlexVPN remote access

51
02:08.320 --> 02:09.910 align:middle line:84%
configuration on the router.

52
02:09.910 --> 02:11.420 align:middle line:84%
So here's what I propose we do.

53
02:11.420 --> 02:15.300 align:middle line:90%
Let's create an
interface loopback 100.

54
02:15.300 --> 02:19.180 align:middle line:90%
And we'll give it the IP
address of 11.11.11.11,

55
02:19.180 --> 02:21.150 align:middle line:84%
the 32-bit mask.

56
02:21.150 --> 02:22.690 align:middle line:90%
And then for our
virtual template,

57
02:22.690 --> 02:24.430 align:middle line:84%
we'll say IP unnumbered.

58
02:24.430 --> 02:26.020 align:middle line:90%
And along with IP
unnumbered, we'll

59
02:26.020 --> 02:27.790 align:middle line:90%
specify use the
IP address already

60
02:27.790 --> 02:29.710 align:middle line:84%
on interface loopback 100.

61
02:29.710 --> 02:33.730 align:middle line:90%
So basically, this template will
be saying, for my IP address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.710 --> 02:33.730 align:middle line:90%
So basically, this template will
be saying, for my IP address,

62
02:33.730 --> 02:36.460 align:middle line:90%
I need to use the IP address
that's already on loopback 100.

63
02:36.460 --> 02:39.348 align:middle line:90%
And then when it spins off
virtual access interface, which

64
02:39.348 --> 02:41.890 align:middle line:90%
is the logical interface it's
going to create for the tunnel,

65
02:41.890 --> 02:46.630 align:middle line:90%
it'll have that same IP
address as well of 11.11.11.11.

66
02:46.630 --> 02:50.620 align:middle line:90%
So that address on the
loopback, the virtual template,

67
02:50.620 --> 02:52.540 align:middle line:90%
and the virtual
access interfaces

68
02:52.540 --> 02:54.530 align:middle line:84%
is going to show quite a bit.

69
02:54.530 --> 02:56.110 align:middle line:90%
And then on this
virtual template,

70
02:56.110 --> 03:00.850 align:middle line:90%
we're also going to specify the
tunnel mode of IPsec or IPv4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:56.110 --> 03:00.850 align:middle line:90%
we're also going to specify the
tunnel mode of IPsec or IPv4.

71
03:00.850 --> 03:04.740 align:middle line:90%
And we'll also specify the
IPsec tunnel protection profile

72
03:04.740 --> 03:05.740 align:middle line:84%
on the virtual template.

73
03:05.740 --> 03:08.090 align:middle line:90%
So when it gets spun
off, logically, you

74
03:08.090 --> 03:10.750 align:middle line:90%
will have this new
virtual access interface

75
03:10.750 --> 03:12.730 align:middle line:90%
that the VPN client
is using, which

76
03:12.730 --> 03:14.142 align:middle line:84%
will have all those properties.

77
03:14.142 --> 03:16.600 align:middle line:90%
So we're going to break this
into smaller chunks, including

78
03:16.600 --> 03:19.010 align:middle line:90%
the certificate authority
piece all by itself.

79
03:19.010 --> 03:20.830 align:middle line:90%
So we'll cover in
the next video how

80
03:20.830 --> 03:23.800 align:middle line:90%
to train R1 to be a certificate
authority to believe

81
03:23.800 --> 03:26.140 align:middle line:90%
its own certificates, and
then get its own identity

82
03:26.140 --> 03:29.980 align:middle line:90%
certificate so it can use it as
part of FlexVPN remote access.

83
03:29.980 --> 03:31.760 align:middle line:90%
And we'll do that
in the next video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:29.980 --> 03:31.760 align:middle line:90%
And we'll do that
in the next video.

84
03:31.760 --> 03:34.150 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

85
03:34.150 --> 03:37.440 align:middle line:90%
And I'd like to thank
you for viewing.