WEBVTT

1
00:00.000 --> 00:00.812 align:middle line:84%


2
00:00.812 --> 00:02.270 align:middle line:90%
In this video, I'd
like to walk you

3
00:02.270 --> 00:05.720 align:middle line:90%
through the configuration for
FlexVPN on a Cisco IOS router

4
00:05.720 --> 00:08.360 align:middle line:84%
to support remote access VPNs.

5
00:08.360 --> 00:11.930 align:middle line:90%
Now, a word of caution,
there are a lot of commands.

6
00:11.930 --> 00:13.640 align:middle line:90%
And my anticipation
is not that you

7
00:13.640 --> 00:16.290 align:middle line:90%
memorize all these commands,
because you can look those up.

8
00:16.290 --> 00:19.160 align:middle line:90%
But what I would like to do
is share with you the concepts

9
00:19.160 --> 00:21.950 align:middle line:90%
behind each one, and
also reinforce the idea

10
00:21.950 --> 00:25.520 align:middle line:90%
it's called FlexVPN because it's
very flexible with the pieces

11
00:25.520 --> 00:28.260 align:middle line:90%
and parts that we use based on
what we want to have happen.

12
00:28.260 --> 00:29.480 align:middle line:90%
Do you want to do
site-to-site tunnels?

13
00:29.480 --> 00:30.050 align:middle line:84%
Great.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.480 --> 00:30.050 align:middle line:84%
Great.

14
00:30.050 --> 00:31.490 align:middle line:90%
Do you want to do
remote access VPNs?

15
00:31.490 --> 00:31.990 align:middle line:84%
Great.

16
00:31.990 --> 00:35.780 align:middle line:90%
Do you want to use a DMVPN-like
environment with IKE version 2?

17
00:35.780 --> 00:36.500 align:middle line:84%
Great.

18
00:36.500 --> 00:38.220 align:middle line:84%
FlexVPN supports all that.

19
00:38.220 --> 00:40.860 align:middle line:90%
So as we go through
these configs together,

20
00:40.860 --> 00:43.080 align:middle line:90%
I would like you to focus
on the bigger picture.

21
00:43.080 --> 00:45.950 align:middle line:90%
And then if you ever need
to deploy this at the CLI,

22
00:45.950 --> 00:49.070 align:middle line:90%
I would recommend going to some
design guides or some config

23
00:49.070 --> 00:51.667 align:middle line:90%
examples from Cisco, and
then just copy-pasting

24
00:51.667 --> 00:53.000 align:middle line:84%
and modifying the path you need.

25
00:53.000 --> 00:55.370 align:middle line:90%
Also, as software-defined
networking

26
00:55.370 --> 00:59.270 align:middle line:90%
becomes more and more prevalent,
it's less and less likely

27
00:59.270 --> 01:01.250 align:middle line:90%
that we're going to
have to implement
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.270 --> 01:01.250 align:middle line:90%
that we're going to
have to implement

28
01:01.250 --> 01:04.080 align:middle line:90%
at the CLI remote access VPNs
because of the other tools

29
01:04.080 --> 01:04.580 align:middle line:84%
to do it.

30
01:04.580 --> 01:07.850 align:middle line:90%
Now, having said that, whether
the configuration is pushed

31
01:07.850 --> 01:11.630 align:middle line:90%
through APIs, or a
GUI, or at the CLI,

32
01:11.630 --> 01:14.060 align:middle line:90%
it's important to understand
how those pieces work,

33
01:14.060 --> 01:15.990 align:middle line:84%
and also how to troubleshoot it.

34
01:15.990 --> 01:18.690 align:middle line:90%
So we're going to take a look at
those pieces as well coming up.

35
01:18.690 --> 01:21.080 align:middle line:90%
So for now, let's take
a look at the typology,

36
01:21.080 --> 01:22.640 align:middle line:84%
and then go straight to the CLI.

37
01:22.640 --> 01:24.480 align:middle line:90%
And I'll walk you
through the config.

38
01:24.480 --> 01:25.850 align:middle line:84%
So here is our topology.

39
01:25.850 --> 01:27.620 align:middle line:90%
And our work is going
to be primarily done

40
01:27.620 --> 01:29.480 align:middle line:90%
in this video right
here on R1, who's

41
01:29.480 --> 01:31.560 align:middle line:90%
going to be acting as
our head end device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.480 --> 01:31.560 align:middle line:90%
going to be acting as
our head end device.

42
01:31.560 --> 01:34.160 align:middle line:90%
So here is our router
from our previous video

43
01:34.160 --> 01:36.470 align:middle line:90%
on getting it set up with
a certificate authority

44
01:36.470 --> 01:38.390 align:middle line:84%
and a digital certificate.

45
01:38.390 --> 01:42.960 align:middle line:90%
And here are the configs
we're about to deploy.

46
01:42.960 --> 01:44.990 align:middle line:90%
So let's talk about
them in groups.

47
01:44.990 --> 01:46.730 align:middle line:84%
And then we'll put them in.

48
01:46.730 --> 01:49.760 align:middle line:90%
So aaa new-model, we're going to
need to do some authentication

49
01:49.760 --> 01:50.600 align:middle line:84%
authorization.

50
01:50.600 --> 01:51.590 align:middle line:84%
So we turn that on.

51
01:51.590 --> 01:54.800 align:middle line:90%
And we're creating two method
lists here, one for logins--

52
01:54.800 --> 01:56.900 align:middle line:90%
we'll use that to log in
Bob when he comes in--

53
01:56.900 --> 01:59.540 align:middle line:90%
and one for network
authorization.

54
01:59.540 --> 02:01.610 align:middle line:90%
And so these names
I pulled straight
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.540 --> 02:01.610 align:middle line:90%
And so these names
I pulled straight

55
02:01.610 --> 02:04.770 align:middle line:90%
from the example at Cisco in
a document I was looking at.

56
02:04.770 --> 02:07.640 align:middle line:90%
But effectively, this method
list for login authentication

57
02:07.640 --> 02:10.039 align:middle line:90%
and this method list for
network authorization

58
02:10.039 --> 02:12.510 align:middle line:90%
are both going to rely
on the local database.

59
02:12.510 --> 02:15.035 align:middle line:90%
So I'm not going out to a
AAA server or an ISE server

60
02:15.035 --> 02:16.160 align:middle line:84%
on Radius or anything else.

61
02:16.160 --> 02:18.803 align:middle line:90%
I'm just going to do it all
based on the local config.

62
02:18.803 --> 02:21.220 align:middle line:90%
Next, if we're authenticating
based on the local database,

63
02:21.220 --> 02:22.970 align:middle line:90%
we probably should
have somebody in there.

64
02:22.970 --> 02:25.957 align:middle line:90%
So I'm just creating
a user with Cisco!23,

65
02:25.957 --> 02:27.790 align:middle line:90%
capital C at the
beginning, as the password.

66
02:27.790 --> 02:30.980 align:middle line:90%
I'm also going to specify
a local pool called ACPOOL.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:27.790 --> 02:30.980 align:middle line:90%
I'm also going to specify
a local pool called ACPOOL.

67
02:30.980 --> 02:32.360 align:middle line:90%
And this is the
pool of addresses

68
02:32.360 --> 02:34.550 align:middle line:90%
we're going to assign
to Bob and other users

69
02:34.550 --> 02:35.760 align:middle line:84%
as they build a VPN tunnel.

70
02:35.760 --> 02:38.313 align:middle line:90%
Or I guess in this
case, it'll be admin,

71
02:38.313 --> 02:39.980 align:middle line:90%
because we're using
local authentication

72
02:39.980 --> 02:41.220 align:middle line:84%
as we build the VPN tunnel.

73
02:41.220 --> 02:43.340 align:middle line:90%
They'll be assigned one
of these IP addresses

74
02:43.340 --> 02:46.160 align:middle line:90%
logically via their
AnyConnect client.

75
02:46.160 --> 02:48.110 align:middle line:90%
Also, I want to create
a split tunneling list.

76
02:48.110 --> 02:49.230 align:middle line:84%
So we can do it this way.

77
02:49.230 --> 02:50.272 align:middle line:84%
We create an access list.

78
02:50.272 --> 02:52.710 align:middle line:90%
This specifies the networks
that are interesting to us.

79
02:52.710 --> 02:55.870 align:middle line:90%
So the wildcard mask here
says only match on 10.

80
02:55.870 --> 02:58.880 align:middle line:90%
And we can use this access
list called a split tunnel

81
02:58.880 --> 03:02.280 align:middle line:90%
as part of an authorization
policy, which is right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:58.880 --> 03:02.280 align:middle line:90%
as part of an authorization
policy, which is right here.

82
03:02.280 --> 03:04.510 align:middle line:90%
So in this authorization
policy for IKEv2,

83
03:04.510 --> 03:05.840 align:middle line:84%
we're specifying the pool.

84
03:05.840 --> 03:08.090 align:middle line:90%
That's where we're going to
assign the addresses from.

85
03:08.090 --> 03:10.760 align:middle line:90%
We're going to assign routes,
which is this access that's

86
03:10.760 --> 03:11.940 align:middle line:84%
called split tunnel.

87
03:11.940 --> 03:13.580 align:middle line:90%
So for our split
tunneling policy,

88
03:13.580 --> 03:18.170 align:middle line:90%
any traffic going to 10 and any
DNS request going to 10.5.5.5

89
03:18.170 --> 03:19.410 align:middle line:84%
would go through the tunnel.

90
03:19.410 --> 03:21.860 align:middle line:90%
And as we scroll down here,
we have an IKEv2 proposal,

91
03:21.860 --> 03:24.560 align:middle line:90%
very similar to what we had
in our site-to-site VPNs

92
03:24.560 --> 03:27.890 align:middle line:90%
with IKEv2 with the
encryption and the hashing

93
03:27.890 --> 03:30.310 align:middle line:90%
and the Diffie-Hellman group
that we're going to use.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:27.890 --> 03:30.310 align:middle line:90%
and the Diffie-Hellman group
that we're going to use.

94
03:30.310 --> 03:33.050 align:middle line:90%
And then we have an
IKEv2 policy that says

95
03:33.050 --> 03:34.380 align:middle line:84%
what proposal we want to use.

96
03:34.380 --> 03:37.100 align:middle line:90%
Now, we could have used the
defaults for the proposals

97
03:37.100 --> 03:38.870 align:middle line:90%
and also for the
policies, but if we

98
03:38.870 --> 03:40.010 align:middle line:90%
don't want to use
the defaults, we

99
03:40.010 --> 03:42.260 align:middle line:90%
could create them, which
we're going to do right here.

100
03:42.260 --> 03:44.060 align:middle line:90%
And then we have
an IKEv2 profile.

101
03:44.060 --> 03:45.470 align:middle line:84%
And this is just a name.

102
03:45.470 --> 03:47.660 align:middle line:90%
AnyConnect referring to
the AnyConnect client dash

103
03:47.660 --> 03:50.420 align:middle line:90%
EAP for Extensible
Authentication Protocol,

104
03:50.420 --> 03:52.670 align:middle line:90%
which is going to be used
for the authentication.

105
03:52.670 --> 03:54.590 align:middle line:90%
And for the match,
in site-to-site

106
03:54.590 --> 03:59.240 align:middle line:90%
we matched on the other device's
IP address for the identity.

107
03:59.240 --> 04:01.580 align:middle line:90%
And here we're matching
identity remote key-id
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.240 --> 04:01.580 align:middle line:90%
And here we're matching
identity remote key-id

108
04:01.580 --> 04:04.640 align:middle line:90%
*$AnyConnectClient$ with the
asterisk and the dollar symbols

109
04:04.640 --> 04:05.600 align:middle line:84%
in front and behind.

110
04:05.600 --> 04:08.240 align:middle line:90%
And that's a special
variable representing

111
04:08.240 --> 04:11.150 align:middle line:90%
this client is coming in
via an AnyConnect client.

112
04:11.150 --> 04:13.010 align:middle line:90%
And then for
authentication, the client's

113
04:13.010 --> 04:15.830 align:middle line:90%
going to authenticate the
server using RSA signatures.

114
04:15.830 --> 04:17.959 align:middle line:90%
And the remote device
is going to authenticate

115
04:17.959 --> 04:19.183 align:middle line:84%
using AnyConnect EAP.

116
04:19.183 --> 04:20.600 align:middle line:90%
And then it's going
to be followed

117
04:20.600 --> 04:23.420 align:middle line:90%
by this keyword aggregate,
which if you don't put it in,

118
04:23.420 --> 04:24.898 align:middle line:84%
it won't allow you to continue.

119
04:24.898 --> 04:25.940 align:middle line:84%
You have to put it there.

120
04:25.940 --> 04:27.440 align:middle line:90%
And then you could
also follow it up

121
04:27.440 --> 04:29.640 align:middle line:90%
with another authentication
method as well.

122
04:29.640 --> 04:31.790 align:middle line:90%
So you could have
multi-factor authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:29.640 --> 04:31.790 align:middle line:90%
So you could have
multi-factor authentication.

123
04:31.790 --> 04:33.840 align:middle line:90%
And the aggregate would
allow you to use both.

124
04:33.840 --> 04:35.660 align:middle line:90%
Then it's specifying
the pki trustpoint.

125
04:35.660 --> 04:38.960 align:middle line:90%
That's the local trustpoint
that we configured on R1.

126
04:38.960 --> 04:41.810 align:middle line:90%
And then for the authentication
of the user when they connect,

127
04:41.810 --> 04:44.620 align:middle line:90%
it's going to use this
method list that we created.

128
04:44.620 --> 04:46.170 align:middle line:84%
And let me scootch this over.

129
04:46.170 --> 04:48.140 align:middle line:90%
For authentication, this
is our AAA method list

130
04:48.140 --> 04:49.460 align:middle line:84%
for authorization.

131
04:49.460 --> 04:52.490 align:middle line:90%
And this is our IKEv2
authorization policy

132
04:52.490 --> 04:53.750 align:middle line:84%
previously defined.

133
04:53.750 --> 04:56.240 align:middle line:90%
And then if that all matches
up and they're successfully

134
04:56.240 --> 04:59.050 align:middle line:90%
authenticated, then we're
going to use virtual template

135
04:59.050 --> 05:02.260 align:middle line:90%
100, which hasn't been created
yet, because we'll create it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
04:59.050 --> 05:02.260 align:middle line:90%
100, which hasn't been created
yet, because we'll create it

136
05:02.260 --> 05:03.560 align:middle line:84%
right down here.

137
05:03.560 --> 05:05.360 align:middle line:90%
So we'll get to that
in just a moment.

138
05:05.360 --> 05:07.300 align:middle line:90%
Here's an IPsec transform
set similar to what

139
05:07.300 --> 05:11.140 align:middle line:90%
we had in our site-to-site
VPN tunnels with FlexVPN.

140
05:11.140 --> 05:14.960 align:middle line:90%
Here is the IPsec profile that
calls on that transform set.

141
05:14.960 --> 05:16.930 align:middle line:90%
It's also still specifying
the IKEv2 profile

142
05:16.930 --> 05:20.082 align:middle line:90%
to use, which is this
bad boy right there.

143
05:20.082 --> 05:22.540 align:middle line:90%
And then we're going to create
a loopback interface of 100.

144
05:22.540 --> 05:23.870 align:middle line:84%
We could use any number we want.

145
05:23.870 --> 05:25.090 align:middle line:84%
We just give it an IP address.

146
05:25.090 --> 05:26.110 align:middle line:90%
The reason we're
going to use that

147
05:26.110 --> 05:27.490 align:middle line:90%
is that we are
going to associate

148
05:27.490 --> 05:29.290 align:middle line:84%
that with our virtual template.

149
05:29.290 --> 05:31.390 align:middle line:90%
So we don't have to use
the same exact number,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:29.290 --> 05:31.390 align:middle line:90%
So we don't have to use
the same exact number,

150
05:31.390 --> 05:32.860 align:middle line:84%
like this could loopback 5.

151
05:32.860 --> 05:34.720 align:middle line:90%
This could be
virtual template 68.

152
05:34.720 --> 05:35.660 align:middle line:84%
It doesn't matter.

153
05:35.660 --> 05:38.302 align:middle line:90%
But in this virtual template,
it's specifying IP unnumbered.

154
05:38.302 --> 05:40.510 align:middle line:90%
Just go ahead and borrow
the same IP address it's on,

155
05:40.510 --> 05:41.560 align:middle line:84%
loopback 100.

156
05:41.560 --> 05:43.360 align:middle line:90%
And that's what this
is specifying here.

157
05:43.360 --> 05:45.520 align:middle line:90%
ip mtu, just like
site-to-site VPNs,

158
05:45.520 --> 05:47.520 align:middle line:90%
we're going to have some
overhead, because we're

159
05:47.520 --> 05:50.038 align:middle line:84%
going to do ESP encapsulation.

160
05:50.038 --> 05:51.580 align:middle line:90%
And we don't want
to have to fragment

161
05:51.580 --> 05:53.000 align:middle line:84%
after we do the encapsulation.

162
05:53.000 --> 05:56.470 align:middle line:90%
So by doing an ip mtu here,
we're helping to avoid that.

163
05:56.470 --> 05:59.170 align:middle line:90%
This is specifying that instead
of using the default GRE

164
05:59.170 --> 06:03.470 align:middle line:90%
mode for the tunnel, we're
going to use IPsec IPv4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
05:59.170 --> 06:03.470 align:middle line:90%
mode for the tunnel, we're
going to use IPsec IPv4.

165
06:03.470 --> 06:06.220 align:middle line:90%
And then we're applying the
tunnel protection profile

166
06:06.220 --> 06:08.800 align:middle line:90%
that specifies what
IPsec protection to do,

167
06:08.800 --> 06:11.870 align:middle line:90%
which kicks off all the other
IKE version 2 stuff as well.

168
06:11.870 --> 06:14.170 align:middle line:90%
And once again, it's not
reasonable for a person

169
06:14.170 --> 06:16.123 align:middle line:90%
to carry all this
information in their head.

170
06:16.123 --> 06:18.290 align:middle line:90%
But I wanted to go through
the full config with you,

171
06:18.290 --> 06:19.878 align:middle line:90%
explain what the
various parts do,

172
06:19.878 --> 06:22.420 align:middle line:90%
and then when we apply it, and
then once we get to the client

173
06:22.420 --> 06:25.257 align:middle line:90%
and test it, if it's not
working or if there's a problem,

174
06:25.257 --> 06:26.590 align:middle line:84%
we can do the debugs we need to.

175
06:26.590 --> 06:28.840 align:middle line:90%
We can use the show commands
and help troubleshoot it.

176
06:28.840 --> 06:31.720 align:middle line:90%
But for now, let's take
these commands as they sit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:28.840 --> 06:31.720 align:middle line:90%
But for now, let's take
these commands as they sit.

177
06:31.720 --> 06:33.500 align:middle line:90%
And we'll put them
into router 1.

178
06:33.500 --> 06:35.980 align:middle line:90%
So I'm going to go ahead
and copy all of that

179
06:35.980 --> 06:37.630 align:middle line:84%
to my clipboard.

180
06:37.630 --> 06:39.530 align:middle line:84%
Right-click, Copy.

181
06:39.530 --> 06:40.180 align:middle line:84%
Go to R1.

182
06:40.180 --> 06:41.650 align:middle line:84%
We're in configuration mode.

183
06:41.650 --> 06:44.170 align:middle line:84%
And I will paste those in.

184
06:44.170 --> 06:46.570 align:middle line:90%
Also, I'd want to make sure
I'm looking and making sure

185
06:46.570 --> 06:49.420 align:middle line:90%
if I have any errors,
that I address those.

186
06:49.420 --> 06:51.430 align:middle line:90%
Sometimes if we refer
to like keyrings

187
06:51.430 --> 06:53.105 align:middle line:90%
and we haven't created
the keyrings yet,

188
06:53.105 --> 06:54.230 align:middle line:84%
it doesn't take the config.

189
06:54.230 --> 06:55.712 align:middle line:84%
So that's not the case here.

190
06:55.712 --> 06:56.420 align:middle line:84%
But look at this.

191
06:56.420 --> 06:59.620 align:middle line:90%
Here we have virtual template
100 changed state to down.

192
06:59.620 --> 07:00.670 align:middle line:84%
And that's expected.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
06:59.620 --> 07:00.670 align:middle line:84%
And that's expected.

193
07:00.670 --> 07:01.690 align:middle line:90%
That's just the
template that we're

194
07:01.690 --> 07:03.250 align:middle line:90%
going to use so
that when we have

195
07:03.250 --> 07:05.710 align:middle line:90%
clients connect successfully,
that template can

196
07:05.710 --> 07:06.790 align:middle line:84%
be pulled from.

197
07:06.790 --> 07:08.950 align:middle line:90%
It can create a virtual
access interface.

198
07:08.950 --> 07:11.110 align:middle line:90%
And that's what the client's
going to connect on.

199
07:11.110 --> 07:14.410 align:middle line:90%
And it says here that ISAKMP is
on, which is a very good sign.

200
07:14.410 --> 07:16.210 align:middle line:90%
So we won't know if
that's all working

201
07:16.210 --> 07:18.110 align:middle line:84%
or not until we actually try it.

202
07:18.110 --> 07:19.900 align:middle line:90%
So in the next video,
I'd like to talk

203
07:19.900 --> 07:23.530 align:middle line:90%
with you about the AnyConnect
Client Profile Editor,

204
07:23.530 --> 07:25.940 align:middle line:90%
and what that is,
why it's important,

205
07:25.940 --> 07:27.830 align:middle line:90%
and also walk you
through how to use it.

206
07:27.830 --> 07:29.330 align:middle line:90%
And we'll do that
in the next video.

207
07:29.330 --> 07:31.720 align:middle line:90%
Meanwhile, I hope this has
been informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

207
07:29.330 --> 07:31.720 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

208
07:31.720 --> 07:34.500 align:middle line:90%
And I'd like to thank
you for viewing.

209
07:34.500 --> 07:35.000 align:middle line:84%