WEBVTT

1
00:00.000 --> 00:00.553 align:middle line:84%


2
00:00.553 --> 00:02.220 align:middle line:90%
In this video, we're
going to kick it up

3
00:02.220 --> 00:05.260 align:middle line:90%
a notch by taking a look
at the concept of VTI,

4
00:05.260 --> 00:09.270 align:middle line:90%
virtual tunnel interfaces,
and why frankly they rock.

5
00:09.270 --> 00:12.780 align:middle line:90%
So, the concept of VTIs is
to use a tunnel interface

6
00:12.780 --> 00:13.920 align:middle line:84%
and let's start there.

7
00:13.920 --> 00:16.590 align:middle line:90%
If we want to create a tunnel
interface you go to a router

8
00:16.590 --> 00:19.230 align:middle line:90%
and say interface
tunnel and then

9
00:19.230 --> 00:22.410 align:middle line:90%
you give it a number like
0 or 1 or 2 or 50 or 1,000.

10
00:22.410 --> 00:24.360 align:middle line:90%
And then as part of that
tunnel configuration

11
00:24.360 --> 00:26.830 align:middle line:90%
you're going to specify
the source of the tunnel.

12
00:26.830 --> 00:29.910 align:middle line:90%
So, in this case we could
specify it's gig 0/1 or 15.

13
00:29.910 --> 00:32.159 align:middle line:90%
1.1.1, whatever
your type address is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.910 --> 00:32.159 align:middle line:90%
1.1.1, whatever
your type address is

14
00:32.159 --> 00:34.650 align:middle line:90%
and we can specify
the destination of R2,

15
00:34.650 --> 00:38.940 align:middle line:90%
which would be y-- and I'll
put arrows there, bonk, bonk.

16
00:38.940 --> 00:40.860 align:middle line:90%
This is from R1's
perspective and then

17
00:40.860 --> 00:42.880 align:middle line:90%
the default encapsulation
is going to be GRE.

18
00:42.880 --> 00:44.880 align:middle line:90%
We don't have to specify
that, the generic route

19
00:44.880 --> 00:47.730 align:middle line:90%
encapsulation, but
here's the trick.

20
00:47.730 --> 00:50.970 align:middle line:90%
Instead of using generic root
encapsulation what we can do

21
00:50.970 --> 00:53.360 align:middle line:84%
is we can say tunnel mode IPsec.

22
00:53.360 --> 00:57.950 align:middle line:90%
In the case of IPv4 we could
say tunnel load IPsec for IPv4

23
00:57.950 --> 01:00.990 align:middle line:90%
and then we can specify the
IPsec profile, the tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.950 --> 01:00.990 align:middle line:90%
and then we can specify the
IPsec profile, the tunnel

24
01:00.990 --> 01:03.150 align:middle line:90%
protection profile, that
we want to use with it.

25
01:03.150 --> 01:05.567 align:middle line:90%
Also what we'd want to do is
we want to go out and give it

26
01:05.567 --> 01:06.280 align:middle line:84%
an IP address.

27
01:06.280 --> 01:09.000 align:middle line:90%
So, let's imagine that between
R1 and R2 we want to create

28
01:09.000 --> 01:14.850 align:middle line:90%
this logical tunnel and we'll
call at 10.12.12.0/24 and maybe

29
01:14.850 --> 01:16.723 align:middle line:90%
we use 0.1 for R1
and 0.2 for R2.

30
01:16.723 --> 01:18.390 align:middle line:90%
And then once this
is all up and running

31
01:18.390 --> 01:20.590 align:middle line:90%
we have this logical
network between them.

32
01:20.590 --> 01:23.400 align:middle line:90%
See one of the problems
with crypto maps

33
01:23.400 --> 01:27.030 align:middle line:90%
is that it was just R3
saying, oh traffic from 10.1.0

34
01:27.030 --> 01:30.697 align:middle line:90%
going to 10.2.0, go ahead and
encapsulate it, ship it over,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:27.030 --> 01:30.697 align:middle line:90%
going to 10.2.0, go ahead and
encapsulate it, ship it over,

35
01:30.697 --> 01:33.030 align:middle line:90%
and then R2 receives it and
decrypts it and forwards it.

36
01:33.030 --> 01:36.045 align:middle line:90%
But there's-- you can't forward
broadcasts or multicasts

37
01:36.045 --> 01:38.700 align:middle line:90%
and if there's broadcasts on
this network we don't want

38
01:38.700 --> 01:41.010 align:middle line:90%
the router to take every
single multicast and broadcast

39
01:41.010 --> 01:42.030 align:middle line:84%
and ship it over.

40
01:42.030 --> 01:44.260 align:middle line:90%
So, crypto maps don't
allow that to happen.

41
01:44.260 --> 01:46.230 align:middle line:90%
However, if we have
a tunnel interface--

42
01:46.230 --> 01:48.600 align:middle line:90%
because now we have a logical
network here between R1

43
01:48.600 --> 01:49.590 align:middle line:84%
and R2--

44
01:49.590 --> 01:51.498 align:middle line:90%
if we have a multicast
or a broadcast

45
01:51.498 --> 01:53.790 align:middle line:90%
and it needs to be sent out,
this interface, the tunnel

46
01:53.790 --> 01:54.840 align:middle line:84%
interface, it can.

47
01:54.840 --> 01:58.230 align:middle line:90%
Now, one of the questions
would be, why would

48
01:58.230 --> 02:00.810 align:middle line:90%
we ever want to send a
broadcast or multicast.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.230 --> 02:00.810 align:middle line:90%
we ever want to send a
broadcast or multicast.

49
02:00.810 --> 02:03.900 align:middle line:90%
Maybe we want to use a routing
protocol between those two

50
02:03.900 --> 02:07.080 align:middle line:90%
devices and that way if
we have a logical network

51
02:07.080 --> 02:10.229 align:middle line:90%
with a Virtual Tunnel Interface
we can actually have those guys

52
02:10.229 --> 02:13.500 align:middle line:90%
be [INAUDIBLE] or OSPF
neighbors and they

53
02:13.500 --> 02:16.260 align:middle line:90%
can exchange routing
information over the tunnel.

54
02:16.260 --> 02:17.040 align:middle line:84%
It's awesome.

55
02:17.040 --> 02:19.650 align:middle line:90%
So, that's the concept of
a virtual tunnel interface

56
02:19.650 --> 02:22.403 align:middle line:90%
and this is an example of a
static virtual tunnel interface

57
02:22.403 --> 02:24.570 align:middle line:90%
because we're specifying
the source, the destination

58
02:24.570 --> 02:27.480 align:middle line:90%
of the tunnel, we're
applying the IPsec profile,

59
02:27.480 --> 02:28.440 align:middle line:84%
and we're good to go.

60
02:28.440 --> 02:29.920 align:middle line:84%
Now, another option is this.

61
02:29.920 --> 02:32.190 align:middle line:90%
What if we have a
Windows user that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.920 --> 02:32.190 align:middle line:90%
What if we have a
Windows user that

62
02:32.190 --> 02:35.010 align:middle line:90%
is a remote user that wants
to build a remote access

63
02:35.010 --> 02:37.405 align:middle line:84%
VPN coming in using IPsec.

64
02:37.405 --> 02:39.780 align:middle line:90%
Well, to do that R1's not
going to know where this guy is

65
02:39.780 --> 02:41.447 align:middle line:90%
coming from, I mean
it could be anywhere

66
02:41.447 --> 02:43.540 align:middle line:90%
on the internet, any
publicly routable address.

67
02:43.540 --> 02:45.510 align:middle line:90%
So, another option
with VTIs is referred

68
02:45.510 --> 02:48.038 align:middle line:90%
to as a dynamic virtual
tunnel interface

69
02:48.038 --> 02:49.580 align:middle line:90%
and to do that, we
create a template.

70
02:49.580 --> 02:50.970 align:middle line:90%
And this template
has information

71
02:50.970 --> 02:54.720 align:middle line:90%
such as the IPsec
profile we want to use

72
02:54.720 --> 02:56.670 align:middle line:90%
and the fact that we're
going to use IPsec.

73
02:56.670 --> 02:59.130 align:middle line:90%
And this tunnel template,
called a virtual template

74
02:59.130 --> 03:01.920 align:middle line:90%
that we can set up, has the
details for what profiles
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.130 --> 03:01.920 align:middle line:90%
that we can set up, has the
details for what profiles

75
03:01.920 --> 03:04.440 align:middle line:90%
we want to use and
for the IP address.

76
03:04.440 --> 03:07.200 align:middle line:90%
Because we might have
dozens or hundreds

77
03:07.200 --> 03:09.450 align:middle line:90%
of actual virtual
interfaces created

78
03:09.450 --> 03:12.310 align:middle line:90%
as a result of this template,
we could use IPN numbers.

79
03:12.310 --> 03:16.890 align:middle line:90%
So, R1 could say, oh I've got
loopback zero, go ahead and use

80
03:16.890 --> 03:19.020 align:middle line:90%
IP address unnumbered
loopback 0.

81
03:19.020 --> 03:22.170 align:middle line:90%
And then all of the new
virtual access interfaces

82
03:22.170 --> 03:24.470 align:middle line:90%
that are dynamically
created on demand

83
03:24.470 --> 03:27.330 align:middle line:90%
would simply use that IP address
associated with that loopback

84
03:27.330 --> 03:28.780 align:middle line:90%
that we specified
in the template.

85
03:28.780 --> 03:30.947 align:middle line:90%
Now, the cool thing about
creating a dynamic virtual
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:28.780 --> 03:30.947 align:middle line:90%
Now, the cool thing about
creating a dynamic virtual

86
03:30.947 --> 03:33.980 align:middle line:90%
tunnel interface-- let me
change that to an I there--

87
03:33.980 --> 03:35.415 align:middle line:90%
a dynamic virtual
tunnel interface

88
03:35.415 --> 03:37.350 align:middle line:90%
is that we can
create the template

89
03:37.350 --> 03:40.230 align:middle line:90%
and then we can have
remote access users connect

90
03:40.230 --> 03:42.250 align:middle line:90%
and dynamically, based
on that template,

91
03:42.250 --> 03:44.640 align:middle line:90%
create a new virtual
access interface

92
03:44.640 --> 03:46.170 align:middle line:84%
for that VPN connection.

93
03:46.170 --> 03:47.820 align:middle line:90%
Or we could have
other remote sites

94
03:47.820 --> 03:51.300 align:middle line:90%
like R6 and R6 could be
configured in such a way

95
03:51.300 --> 03:53.640 align:middle line:90%
that it's coming in
dynamically and when

96
03:53.640 --> 03:55.890 align:middle line:84%
it connects R1 can yet again--

97
03:55.890 --> 03:59.050 align:middle line:90%
based on who's connecting in
and how they authenticate--

98
03:59.050 --> 04:01.620 align:middle line:90%
R1 could yet again
use a virtual template
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.050 --> 04:01.620 align:middle line:90%
R1 could yet again
use a virtual template

99
04:01.620 --> 04:05.945 align:middle line:90%
to create a logical interface
for that VPN coming in from R6.

100
04:05.945 --> 04:07.320 align:middle line:90%
So, now we've
taken a look at how

101
04:07.320 --> 04:09.360 align:middle line:90%
we can use VTIs, virtual
tunnel interfaces,

102
04:09.360 --> 04:11.843 align:middle line:90%
as part of our
implementation of IPsec VPNs

103
04:11.843 --> 04:14.010 align:middle line:90%
and in the next video I'd
like to share with you one

104
04:14.010 --> 04:17.070 align:middle line:90%
of the most creative
methods of implementing VPNs

105
04:17.070 --> 04:21.149 align:middle line:90%
in a dynamic fashion and
that is the idea of DMVPN

106
04:21.149 --> 04:22.300 align:middle line:84%
in the very next video.

107
04:22.300 --> 04:23.620 align:middle line:84%
See you there in just a moment.

108
04:23.620 --> 04:25.980 align:middle line:90%
Meanwhile, I hope this has
been informative for you

109
04:25.980 --> 04:29.240 align:middle line:90%
and I'd like to thank
you for viewing.