WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.200 align:middle line:90%
In this video, I'd
like to introduce you

3
00:02.200 --> 00:06.010 align:middle line:90%
to the idea of IPsec VPNs
implemented using a technology

4
00:06.010 --> 00:10.030 align:middle line:90%
called DM, Dynamic
Multipoint VPNs.

5
00:10.030 --> 00:12.830 align:middle line:90%
So let's imagine that we
have a few more locations.

6
00:12.830 --> 00:17.500 align:middle line:90%
So we have R2 at site 2, we
have, let's say, R3 at site 3

7
00:17.500 --> 00:20.470 align:middle line:84%
and let's put R4 at site 4.

8
00:20.470 --> 00:22.930 align:middle line:90%
If we want a secure
connectivity and so as we

9
00:22.930 --> 00:24.970 align:middle line:90%
all have connectivity
here to the internet

10
00:24.970 --> 00:28.210 align:middle line:90%
or some other untrusted network,
if we want full connectivity

11
00:28.210 --> 00:31.090 align:middle line:90%
we could do site
to site VPN tunnels
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.210 --> 00:31.090 align:middle line:90%
we could do site
to site VPN tunnels

12
00:31.090 --> 00:33.550 align:middle line:90%
between the headquarter
site R1 and R3,

13
00:33.550 --> 00:35.800 align:middle line:90%
another site to site
between R1 and R2,

14
00:35.800 --> 00:37.400 align:middle line:84%
another one between R1 and R4.

15
00:37.400 --> 00:39.280 align:middle line:90%
Now, whether we use
crypto maps for that

16
00:39.280 --> 00:41.870 align:middle line:90%
or we use VTIs for that,
either way it would work.

17
00:41.870 --> 00:43.560 align:middle line:84%
But it's kind of a hassle.

18
00:43.560 --> 00:45.880 align:middle line:90%
It's a lot of VPNs
setup and what

19
00:45.880 --> 00:48.790 align:middle line:90%
if a site 3 device
like Bob over here

20
00:48.790 --> 00:51.780 align:middle line:90%
needs to communicate
down to site 4.

21
00:51.780 --> 00:53.920 align:middle line:90%
That traffic, if it has
to go through the tunnel

22
00:53.920 --> 00:56.980 align:middle line:90%
to the headquarters then back
over the tunnel back to R4,

23
00:56.980 --> 00:58.060 align:middle line:84%
that's a dual trip.

24
00:58.060 --> 01:01.510 align:middle line:90%
So if we wanted to have direct
spoke to spoke connectivity,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.060 --> 01:01.510 align:middle line:90%
So if we wanted to have direct
spoke to spoke connectivity,

25
01:01.510 --> 01:02.523 align:middle line:84%
that'd be awesome.

26
01:02.523 --> 01:04.690 align:middle line:90%
And while the technologies
that allows us to do that

27
01:04.690 --> 01:09.250 align:middle line:90%
is referred to as DM, Dynamic
Multipoint VPNs and this

28
01:09.250 --> 01:11.000 align:middle line:84%
uses IPsec.

29
01:11.000 --> 01:12.850 align:middle line:90%
And the cool part is
that it dynamically

30
01:12.850 --> 01:14.330 align:middle line:84%
builds the tunnels for us.

31
01:14.330 --> 01:16.720 align:middle line:90%
So we configure R1
as the head in device

32
01:16.720 --> 01:20.410 align:middle line:90%
and then we have all these
spokes site 3, 2 and 4,

33
01:20.410 --> 01:22.240 align:middle line:90%
we have them
registering check in.

34
01:22.240 --> 01:24.140 align:middle line:90%
And so these devices
all check in and say,

35
01:24.140 --> 01:27.520 align:middle line:90%
here I am, and R1 says,
I'm so glad to see you.

36
01:27.520 --> 01:28.930 align:middle line:84%
Thanks are shown up.

37
01:28.930 --> 01:31.540 align:middle line:90%
And it dynamically
builds those tunnels.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.930 --> 01:31.540 align:middle line:90%
And it dynamically
builds those tunnels.

38
01:31.540 --> 01:34.090 align:middle line:90%
We don't have to manually
configure the specific for each

39
01:34.090 --> 01:35.050 align:middle line:84%
of the spokes.

40
01:35.050 --> 01:36.880 align:middle line:90%
Now, to pull this off
on the interfaces,

41
01:36.880 --> 01:38.672 align:middle line:90%
we're still going to
use tunnel interfaces,

42
01:38.672 --> 01:42.040 align:middle line:90%
but we are going to use
what's referred to as a MGRE,

43
01:42.040 --> 01:45.400 align:middle line:90%
a multipoint GRE
tunnel interface.

44
01:45.400 --> 01:47.350 align:middle line:90%
And on those multipoint
GRE interfaces,

45
01:47.350 --> 01:50.010 align:middle line:90%
we're going to implement
an IPsec profile.

46
01:50.010 --> 01:51.940 align:middle line:90%
And that way we can use
one tunnel interface

47
01:51.940 --> 01:55.660 align:middle line:90%
for here R1 that logically
allows the VPN to all

48
01:55.660 --> 01:56.770 align:middle line:84%
the remote sites.

49
01:56.770 --> 01:59.860 align:middle line:90%
And if R3 needs to reach
network over here, let's

50
01:59.860 --> 02:04.185 align:middle line:90%
say this is 10.4.0.0, when R3
goes to reach that network it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.860 --> 02:04.185 align:middle line:90%
say this is 10.4.0.0, when R3
goes to reach that network it

51
02:04.185 --> 02:06.310 align:middle line:90%
can go ahead and get a
message from the hub saying,

52
02:06.310 --> 02:09.639 align:middle line:90%
Oh, you know what, dear Mr
R3, that network of 10.4

53
02:09.639 --> 02:11.860 align:middle line:84%
is reachable by R4.

54
02:11.860 --> 02:14.290 align:middle line:90%
And R1 can educate
R3 on dynamically

55
02:14.290 --> 02:16.400 align:middle line:90%
educate them on what
the reachable addresses.

56
02:16.400 --> 02:19.690 align:middle line:90%
And then R3 can dynamically
build a spoke to spoke VPN

57
02:19.690 --> 02:22.240 align:middle line:84%
tunnel using IPsec over to R4.

58
02:22.240 --> 02:24.370 align:middle line:90%
And that's the magic
of dynamic multipoint

59
02:24.370 --> 02:28.990 align:middle line:90%
VPN using a technology called
NHRP, Next Hop Resolution

60
02:28.990 --> 02:29.530 align:middle line:84%
Protocol.

61
02:29.530 --> 02:33.160 align:middle line:90%
And I've got a separate
video set just on DMVPN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.530 --> 02:33.160 align:middle line:90%
And I've got a separate
video set just on DMVPN

62
02:33.160 --> 02:35.770 align:middle line:90%
if you want more details
on how that's configured,

63
02:35.770 --> 02:37.620 align:middle line:90%
how to set it up,
and how to verify it.

64
02:37.620 --> 02:40.725 align:middle line:90%
Check out that sort of
videos as well on DMVPN.

65
02:40.725 --> 02:42.850 align:middle line:90%
So in this video, I want
to make sure you are aware

66
02:42.850 --> 02:45.100 align:middle line:90%
that that option
exists regarding DMVPN

67
02:45.100 --> 02:47.710 align:middle line:90%
and that can be implemented
with either IKE version

68
02:47.710 --> 02:49.498 align:middle line:84%
1 or IKE version 2.

69
02:49.498 --> 02:51.040 align:middle line:90%
If we're doing it
with IKE version 2,

70
02:51.040 --> 02:53.248 align:middle line:90%
it's going to use that
technique that Cisco refers to

71
02:53.248 --> 02:54.490 align:middle line:84%
as FlexVPN.

72
02:54.490 --> 02:56.710 align:middle line:90%
And while we're at
it, in the next video

73
02:56.710 --> 02:59.080 align:middle line:90%
let me introduce you
to the world of FlexVPN

74
02:59.080 --> 03:01.330 align:middle line:90%
as well to make sure you
understand the basics of what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.080 --> 03:01.330 align:middle line:90%
as well to make sure you
understand the basics of what

75
03:01.330 --> 03:02.513 align:middle line:84%
it means and what to expect.

76
03:02.513 --> 03:04.180 align:middle line:90%
I'll see you in the
next video for that.

77
03:04.180 --> 03:06.700 align:middle line:90%
Meanwhile, I hope this has
been informative for you

78
03:06.700 --> 03:09.900 align:middle line:90%
and I'd like to thank
you for viewing.