WEBVTT

1
00:00.000 --> 00:10.810
Let's begin our discussion by talking about what a virtual private network or a

2
00:10.810 --> 00:12.160
VPN actually

3
00:12.160 --> 00:13.620
is.

4
00:13.620 --> 00:18.350
If you were to believe all the advertisement out there from various VPN

5
00:18.350 --> 00:19.560
providers, you

6
00:19.560 --> 00:24.840
would believe that a VPN is the end-all be-all of all network security, it will

7
00:24.840 --> 00:25.440
completely

8
00:25.440 --> 00:30.000
protect your computer and if you don't have a VPN, you're at risk.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:30.000 --> 00:34.200
Well, the fact of the matter is of course, that's just not true.

10
00:34.200 --> 00:39.400
A VPN can provide a part of our network security, but of course, it's not going

11
00:39.400 --> 00:40.800
to protect us

12
00:40.800 --> 00:44.360
from things like viruses and malware and so on.

13
00:44.360 --> 00:50.450
What a VPN does do is it allows us to send private traffic over a public

14
00:50.450 --> 00:51.960
network, such

15
00:51.960 --> 00:55.560
as of course, the most common, the internet.

16
00:55.560 --> 01:01.440
Now that in and of itself does not necessarily provide security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:55.560 --> 01:01.440
Now that in and of itself does not necessarily provide security.

17
01:01.440 --> 01:06.370
There are many types of VPNs that we'll discuss in this video that actually don

18
01:06.370 --> 01:07.040
't provide

19
01:07.040 --> 01:09.280
any security whatsoever.

20
01:09.280 --> 01:14.570
They're simply tunneling the traffic between two sides of a private network

21
01:14.570 --> 01:15.200
over a public

22
01:15.200 --> 01:16.360
network.

23
01:16.360 --> 01:21.190
They're not worried about protecting that traffic as it goes through the tunnel

24
01:21.190 --> 01:21.240
.

25
01:21.240 --> 01:27.680
Of course, a very common type of VPN is an IPsec VPN.

26
01:27.680 --> 01:32.240
When you add IP security to it, well then of course, it does protect the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:27.680 --> 01:32.240
When you add IP security to it, well then of course, it does protect the

27
01:32.240 --> 01:33.080
traffic.

28
01:33.080 --> 01:38.030
But we're going to be taking a look at an example in this video where we're not

29
01:38.030 --> 01:38.400
going

30
01:38.400 --> 01:42.080
to provide any protection, but it's still a VPN.

31
01:42.080 --> 01:46.280
So let's go ahead and jump in, take a look at some details and then get our

32
01:46.280 --> 01:46.920
first VPN

33
01:46.920 --> 01:51.000
up and running between two routers.

34
01:51.000 --> 01:53.320
So let's get more into that question.

35
01:53.320 --> 01:55.760
What is a VPN?

36
01:55.760 --> 02:01.890
Well the fact of the matter is many companies and that includes Cisco, define a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:55.760 --> 02:01.890
Well the fact of the matter is many companies and that includes Cisco, define a

37
02:01.890 --> 02:02.440
VPN or

38
02:02.440 --> 02:08.480
a virtual private network as an encrypted connection over the internet.

39
02:08.480 --> 02:12.720
It's a pretty simple explanation, but a lot of companies just go right ahead

40
02:12.720 --> 02:13.480
and include

41
02:13.480 --> 02:16.320
the fact that it's encrypted.

42
02:16.320 --> 02:20.400
Now the fact of the matter is they are very commonly encrypted because again we

43
02:20.400 --> 02:21.120
're sending

44
02:21.120 --> 02:25.600
this traffic potentially over the internet where it could be intercepted and we

45
02:25.600 --> 02:25.920
want

46
02:25.920 --> 02:32.320
to make sure that the data integrity and the confidentiality of that data are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:25.920 --> 02:32.320
to make sure that the data integrity and the confidentiality of that data are

47
02:32.320 --> 02:33.360
protected.

48
02:33.360 --> 02:35.960
So it will very commonly be encrypted.

49
02:35.960 --> 02:39.200
However, that's not by definition.

50
02:39.200 --> 02:44.160
Strictly speaking, encryption is not a required attribute.

51
02:44.160 --> 02:50.110
There are several technologies that are in fact VPNs, but they don't directly

52
02:50.110 --> 02:50.800
provide

53
02:50.800 --> 02:52.200
encryption.

54
02:52.200 --> 02:57.110
Now we are very carefully using the word directly because of course most of

55
02:57.110 --> 02:58.040
these can't have

56
02:58.040 --> 03:00.240
encryption added to them.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:58.040 --> 03:00.240
encryption added to them.

57
03:00.240 --> 03:03.680
But some examples here, you have GRE tunnels, which we're actually going to

58
03:03.680 --> 03:04.240
take a look

59
03:04.240 --> 03:06.320
at in just a moment.

60
03:06.320 --> 03:11.190
These are VPNs because they are encapsulating the traffic and sending private

61
03:11.190 --> 03:12.040
traffic over

62
03:12.040 --> 03:17.360
a public infrastructure, but it doesn't provide any kind of protection.

63
03:17.360 --> 03:23.680
Same with for example, MPLS, both layer two and layer three tunnels.

64
03:23.680 --> 03:28.700
These again do not actually provide any form of protection.

65
03:28.700 --> 03:33.920
Same with VXLAN when we're talking about VCs or virtual circuits.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:28.700 --> 03:33.920
Same with VXLAN when we're talking about VCs or virtual circuits.

66
03:33.920 --> 03:39.040
VXLAN is actually very similar to an MPLS layer two VPN.

67
03:39.040 --> 03:45.710
All of these things are in fact VPNs, however, they don't provide any direct

68
03:45.710 --> 03:47.800
form of encryption.

69
03:47.800 --> 03:53.700
So as we've said, at the end of the day, a VPN is simply sending private

70
03:53.700 --> 03:54.880
traffic over

71
03:54.880 --> 04:01.760
some sort of shared access network or a public network, which is often referred
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:54.880 --> 04:01.760
some sort of shared access network or a public network, which is often referred

72
04:01.760 --> 04:02.480
to as the

73
04:02.480 --> 04:09.850
underlay network in VPN terminology, where the VPN itself is referred to as the

74
04:09.850 --> 04:11.000
overlay.

75
04:11.000 --> 04:16.290
This underlay network will very commonly be something like a service provider

76
04:16.290 --> 04:17.960
MPLS infrastructure,

77
04:17.960 --> 04:23.870
maybe legacy frame relay or ATM, of course, most of this kind of infrastructure

78
04:23.870 --> 04:24.720
is retired

79
04:24.720 --> 04:28.320
now, but they were VPNs.

80
04:28.320 --> 04:32.890
And of course, the most common being the internet itself, we use this very
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:28.320 --> 04:32.890
And of course, the most common being the internet itself, we use this very

81
04:32.890 --> 04:34.880
commonly now because

82
04:34.880 --> 04:39.000
we have good forms of encryption to protect our traffic.

83
04:39.000 --> 04:44.650
Something else to be aware of is that there are sort of two major types or

84
04:44.650 --> 04:45.680
categories

85
04:45.680 --> 04:47.880
of VPNs.

86
04:47.880 --> 04:53.890
The first one, which is going to be the main focus of this course is site to

87
04:53.890 --> 04:55.080
site VPNs.

88
04:55.080 --> 05:00.810
This is going to act like a connection or of course, a tunnel between two or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:55.080 --> 05:00.810
This is going to act like a connection or of course, a tunnel between two or

89
05:00.810 --> 05:02.160
more networks.

90
05:02.160 --> 05:05.840
That's the main point here is that it's involving two networks.

91
05:05.840 --> 05:10.500
This is actually treated much like a traditional LAN connection in that it's

92
05:10.500 --> 05:11.400
connecting two

93
05:11.400 --> 05:14.400
islands of a private network.

94
05:14.400 --> 05:18.280
And again, this could be a remote office connecting into headquarters,

95
05:18.280 --> 05:19.560
something along those

96
05:19.560 --> 05:20.800
lines.

97
05:20.800 --> 05:24.080
And this does allow for many to many connections.

98
05:24.080 --> 05:28.020
There's going to be a lot of devices at say, for example, headquarters, and

99
05:28.020 --> 05:28.480
there's going

100
05:28.480 --> 05:32.200
to be a lot of devices, of course, at the remote sites.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:28.480 --> 05:32.200
to be a lot of devices, of course, at the remote sites.

101
05:32.200 --> 05:37.280
So we're talking about multiple devices at each location traversing this same

102
05:37.280 --> 05:37.800
VPN.

103
05:37.800 --> 05:43.920
Sort of the contrasting idea is the remote access VPN.

104
05:43.920 --> 05:49.180
This is generally used to connect one device, something like a remote work

105
05:49.180 --> 05:50.280
station into the

106
05:50.280 --> 05:52.080
corporate network.

107
05:52.080 --> 05:56.170
This would of course often be somebody working from home or maybe somebody

108
05:56.170 --> 05:57.520
traveling connecting

109
05:57.520 --> 06:03.550
in from a hotel or an airport, maybe a coffee shop, something along those lines
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:57.520 --> 06:03.550
in from a hotel or an airport, maybe a coffee shop, something along those lines

110
06:03.550 --> 06:03.600
.

111
06:03.600 --> 06:07.120
But really anywhere they have a valid internet connection, they should be able

112
06:07.120 --> 06:07.680
to connect

113
06:07.680 --> 06:10.360
in to our corporate network.

114
06:10.360 --> 06:14.360
And from that perspective, this is treated a lot like a land cable.

115
06:14.360 --> 06:17.870
It's going to be the same as if they were in their office connected in to the

116
06:17.870 --> 06:18.480
corporate

117
06:18.480 --> 06:20.240
network.

118
06:20.240 --> 06:24.240
And so, for me, this is a very important thing to do.

119
06:24.240 --> 06:32.120
So, let's jump in and take a look at an example of a site to site VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
06:24.240 --> 06:32.120
So, let's jump in and take a look at an example of a site to site VPN.

120
06:32.120 --> 06:38.000
Specifically, what we want to do is look at something called a GRE tunnel.

121
06:38.000 --> 06:39.640
We mentioned it earlier.

122
06:39.640 --> 06:43.000
This is simply generic routing encapsulation.

123
06:43.000 --> 06:47.960
And it's a VPN that doesn't provide any form of protection.

124
06:47.960 --> 06:52.200
So let's start by taking a look at our diagram and talk about what we're going

125
06:52.200 --> 06:53.040
to be building

126
06:53.040 --> 06:54.800
in our lab.

127
06:54.800 --> 07:01.640
So for this demonstration, we're going to be using IPsec VPN topology one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:54.800 --> 07:01.640
So for this demonstration, we're going to be using IPsec VPN topology one.

128
07:01.640 --> 07:07.280
And what we're going to be focusing on is building a VPN, of course, starting

129
07:07.280 --> 07:07.960
off with

130
07:07.960 --> 07:12.160
GRE between router one and router four.

131
07:12.160 --> 07:16.980
So we're going to be building a tunnel going from router one over here to

132
07:16.980 --> 07:18.160
router four.

133
07:18.160 --> 07:21.360
This is going to be our GRE VPN.

134
07:21.360 --> 07:28.850
And what we're going to be connecting is this island over here of 192.168.10.0

135
07:28.850 --> 07:29.520
to this island

136
07:29.520 --> 07:33.960
over here, 192.168.20.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
07:29.520 --> 07:33.960
over here, 192.168.20.0.

137
07:33.960 --> 07:39.030
And the ultimate goal is we're going to have workstation one and workstation

138
07:39.030 --> 07:39.760
two being able

139
07:39.760 --> 07:41.640
to communicate to each other.

140
07:41.640 --> 07:45.880
However, they'll never see the underlay network.

141
07:45.880 --> 07:50.950
So these 10 addresses down here that are part of the transit network, they

142
07:50.950 --> 07:52.560
should be invisible

143
07:52.560 --> 07:56.520
to workstation one and workstation two.

144
07:56.520 --> 08:00.680
When testing connectivity, we should see the traffic go from workstation one to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
07:56.520 --> 08:00.680
When testing connectivity, we should see the traffic go from workstation one to

145
08:00.680 --> 08:01.040
router

146
08:01.040 --> 08:09.860
one, router one across the tunnel to router four, router four up to workstation

147
08:09.860 --> 08:10.680
two.

148
08:10.680 --> 08:15.890
Now as we jump in, if you've preloaded our configuration, the underlay network

149
08:15.890 --> 08:16.840
is currently

150
08:16.840 --> 08:24.160
running OSPF, specifically OSPF process one, all of the interfaces for the

151
08:24.160 --> 08:25.520
underlay are

152
08:25.520 --> 08:27.920
in area zero.

153
08:27.920 --> 08:34.120
One of the things that we're going to do is configure an IGP on the overlay.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
08:27.920 --> 08:34.120
One of the things that we're going to do is configure an IGP on the overlay.

154
08:34.120 --> 08:37.740
Now we could use a different OSPF process, but just to keep it simple, we're

155
08:37.740 --> 08:38.280
going to

156
08:38.280 --> 08:41.400
totally separate the routing processes.

157
08:41.400 --> 08:50.410
And we're going to run EIGRP, AS100 for the routing protocol on our overlay,

158
08:50.410 --> 08:50.840
just to

159
08:50.840 --> 08:54.080
keep the routing completely separate.

160
08:54.080 --> 08:59.490
Now that we know what our plan is with our GRE VPN between router one and

161
08:59.490 --> 09:00.720
router four,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
08:59.490 --> 09:00.720
router four,

162
09:00.720 --> 09:04.410
let's jump into the next video where we're actually going to configure this and

163
09:04.410 --> 09:04.720
get it

164
09:04.720 --> 09:05.960
up and operational.