What I stand for.
PKI Public Key Infrastructure.
Okay.
Until now, what we have seen is let's say I wanted to create a site to site tunnel between R1 and R3,
two different sites connected to the Internet.
Right.
Everything else is public right here.
Since I can.
Everything else is public.
This.
The board.
You know.
Right.
So.
So the Internet, right.
You're connected to the Internet and your job is to do what?
Is to connect the two sides together.
What we've been doing until now.
Right.
Connecting the two sides together.
Across the Internet.
The question is, until now, we were using all but three schedules.
We saw how Pre-shared keys work.
So when they used to authenticate each other in the fifth and the sixth packet of your IPsec Transformed
IPsec exchange, your pre-shared key.
Used to be sent across.
Just a key Cisco from here, Cisco from the other side.
But I'll ask you this question.
Is it scalable?
But is it safe to use a pre-shared key?
Say, for example, tomorrow you are in a public environment where.
But you have something like this.
You have one side.
Okay.
Here.
Then are two.
All three.
After.
At five.
Our six.
Let's say you have seven types.
All connected together.
Using maybe dmvpn.
Right.
If I use a Pre-shared key of Cisco, for example, on all of them.
If one of them gets compromised, right.
If, for example, the guy sitting at this site.
Is fired and he gives out the pre-shared key to someone else.
The guy can come in and go to all of them, right?
He can just create a tunnel with all of those guys, all of these other sites.
Not scalable.
Not feasible.
Right.
So what you would do is you could have different scales for each site.
So for R1 from R1 to R2, I would have a different scale from one to R3, a different scale, a different
one, a different one, a different one.
But again, the scalability problem would come more sites, more complexity to create the tunnels.
Plus what about spoke to spoke communication?
More complexity.
So it is okay.
It's good for a small site or you have 2 or 3 sites, it's fine, but the more you grow.
The more you grow, the more problems it causes the preset.
Unless you're fine with having the same SQL in all your networks, which is again, not safe.
Security is as strong.
As your weakest link.
Right.
If your link is weak anywhere along the chain, for example, think about it as a chain.
Right?
Those cuffs.
If any one small link is weak.
It's all I mean, the whole point is lost.
The same thing here.
You will have IPCC three days running as running triple des everything across the tunnel.
Sha MD5.
If you don't have the key.
And if this gets compromised, your whole security system crashes.
How do we fix this?
We use PCA.
Now, what is PCA?
You'll use this a lot in web VPN, SSL, VPN, so I'll give you a good idea about how it works.
Like, Yeah, it's a certificate authorities, Right.
Let's talk about the bank.
Talk about the bank, a website when you open a website.
You have, for example.
HDFC Bank.
They have a website, right?
When you open their website.
You open their website, you enter your customer details, your password and all that information in
the website.
Do you create a VPN?
Do you by yourself create a VPN?
Do you open a client to connect?
Do you use IPsec parameters?
No, we don't use anything like that.
We don't use anything like that.
Why?
Because this.
This VPN is known as Clientless VPN.
Thin client.
Sorry, not.
Thin client is for client less.
But you use through a browser client list.
We do.
What do we mean by that?
Let's open the website.
Let's open any website out there now.
You.
Yes, exactly.
That's that's what's that's what's is.
It's a secure tunnel.
So when I, let's say, continue to net banking.
The moment you see this green sign here, that means your VPN is connected.
It's a VPN connected.
If you click on it and you go to your connection, it'll show you the connection is encrypted using
a mechanism, plus it uses MD5 for authentication and RSA as the key exchange mechanism.
You didn't do anything.
It connected automatically.
The question is where did the authentication take place?
How?
When did I authenticate?
I did not do anything about authentication.
Right?
It automatically authenticated HDFC bank.com if you check the authentication was done.
Based on a certificate.
As Zfc showed me a certificate, it said, okay, listen, this is my certificate.
My certificate has been assigned to nit bookings.com.
These are the details of the certificate.
Right.
And this is the path where it sold.
It has been signed by VeriSign.
The question is, who is to stop?
Someone else tomorrow from creating an exact same site.
And giving you a certificate.
Who is to stop that?
The sea is a.
Not the server, your browser will stop it.
But let me explain how this works.
Now what happens is.
When you zfc.
And you want to authenticate yourself on the Internet.
Think of the server as an authority.
It is called a certificate authority, but think of it as as a government authority.
As a government.
The best example I could think of is let's say you have license, right?
Driving.
License.
Who signs your driving license?
How do you.
It does, right?
So when you walk, when you're on the field, right, you're riding your bike, cop stops you, you
show him a license.
How does he accept it?
Only if it's signed by the RTU.
If you go if you go home and you print a page, a piece of paper and you write, This is my license,
my name is this, and I'm authorized to drive in India, Will you accept it?
The only reason he accepts it is why.
Because it has been signed by the team.
That is the whole concept behind certificate authorities.
The whole concept.
So what HDFC Bank has to do to register themselves is there are well known case out there, some of
them.
Very sign.
There's Go, Daddy.
Let's go.
Sit.
Some Fed member correctly.
There's many out there, but these are trusted authorities.
These are the ratios of your Internet.
So tomorrow when HDFC Bank comes in.
They want to register themselves.
What the way they do it is HDFC has to create a set of keys.
RSA Keys, a public key and a.
A public and a private.
A set of keys.
Now, the size of this keys key does not matter.
I mean, it's up to them.
The stronger the key, the stronger the encryption, the bigger the key, the better the encryption.
So the HDFC Bank, what it does is it says, okay, since I need to get registered, it takes the public
key.
Gives it to whom?
The is a.
Tell them.
Listen.
I'm HDFC Bank.
This is my public key.
Please sign my public key.
Now, the server doesn't just sign the public key, it will ask HDFC Bank to submit documents, do verification,
and go through all that process where it makes sure that HDFC Bank is HDFC Bank.
Because if tomorrow it doesn't it's not I mean, it is realized that it's not actually HDFC Bank.
The server is going to get into trouble.
So it's their job to verify whoever they're giving out the certificates to are valid people.
Correct.
So that's what we do with the public key.
Go to the CA server.
The server will sign it.
The private key of HDFC Bank remains with it doesn't give it out.
Private key.
Always remember, always stays.
It's never thrown out.
The private key will always remain.
The only thing that was given out was the public key.
Now, if we have that, how does the K sign it?
That is the question.
How does the server sign this certificate?
The server has also a set of.
Private and.
Public.
It has its own set of private and public.
Right.
So when you come with your public key.
It's not just the public key you're going in.
With.
And I see an identity certificate.
Which includes your public key and your name saying I am HDFC.
Back and maybe your interface address or certain other information which you want, but usually it's
just the name saying, okay, this is my public key and I'm HDFC bank.com.
You just don't throw away the public key.
You present it right.
In an ache with your name and everything saying, this is from me.
Please sign this.
When the moment this icy reaches the CA, what the CA does, he says okay.
First he verifies you.
Once you are verified, it will write here on this icy.
Say signed by VeriSign.
It will write its own name, but this name will not be available.
This name will be encrypted.
Encrypted.
Using what?
The private key.
Of whom?
The CSM.
This name will be encrypted using the private key of the.
You might ask why?
I'll explain why.
Right.
And he gives it back.
Anybody in the middle can also act as excuse anybody can just create a certificate.
And on that certificate.
Right.
Very sign.
So what we're saying does is it writes VeriSign but encrypts it using its own private key.
Let's see how that is useful now.
HDFC Bank has what?
An I see.
We call it an icy identity certificate.
When you go and create a connection tomorrow with it.
I'm sitting here when you go and create a connection with it, right?
You try to create that SSL connection with it.
It presents to you.
What?
This is.
He has received it, right?
It presents to you This I.
Now it's your job.
Do you accept this?
I see.
Or do you not?
You might have seen.
Sometimes when you're trying to create a connection, you get that red mark saying, Please proceed.
Please click okay or please proceed at your own risk.
Right.
It's not Https, it's with the cross.
That's because the certificate that company is showing you is not verified.
And we'll see in a moment what that means.
What has not verified itself.
Let's see how now, when it presents to you the certificate.
Right.
You need to verify.
Is this actually coming from the RTU?
Is it actually coming from VeriSign or GoDaddy or all of those people?
How will you know that?
The CIA.
Why?
Why are these people known?
Why is VeriSign, GoDaddy and GoDaddy?
Go search all of these people, all of these CEOs.
Why are they famous?
First of all, they are famous.
They are there.
They are.
The car's registered keys.
Since they are the keys, what your browsers have done.
If you go to your browser settings.
And you go to your SSL section.
In your root certificates, you will see.
A lot of certificates out there.
There's a very sign.
That is secure trust.
Globalsign Geotrust is their globalsign Is there a lot of them?
These are all trusted authorities on the internet.
What you have here.
Can you guess what this is?
These are the public keys of all the keys.
Everybody already has them.
Everybody in the world, every browser in the world will have the public key of the.
And that's what helps you right now.
What you have here is we call this trusting the car.
What you have here already is what?
Public.
Off the CSL.
So when you get the certificate, what what do I do with the public key?
I tried to decrypt the name.
I tried to decrypt the name of the guy who signed the certificate.
The only one way I can open this up is if it was signed by a.
That's the only way I can sign it.
I can see it.
Right.
We don't have to go to the car.
We just get the certificate.
If I can open it.
The only one way I can open it, if it is signed by the private or the.
Anybody in the world who signs it, I won't be able to open it because I have the public of the sea.
Public from policy is actually.
It's actually.
From this.
It's not an icy.
It's its an icy with the name on it inside.
That is the key.
But you can also see it is a.
Exactly similar to the.
You can see the key if you go in here.
Any key.
Let's click on it.
Go to the details to see the public key.
So you have a public key, plus you have more information in the certificate.
These are also certificates which you have installed publicly.
Of whom?
The server installed on you so as a review.
What you do is as a review.
As will go with its public key.
To whom?
The server.
The server will sign it.
Using what?
The private.
Gives it back to HDFC Bank.
Now HDFC goes to anybody in the world.
Everyone has the public of this year.
They'll be able to open it.
How does it protect you from the intruders?
They will never be signed by VeriSign.
They will never be signed by Geotrust.
They will never be signed by Globalsign.
That's how you're protected in Islam.
So when they show you the certificate, whatever is whoever signed their certificate, you don't have
the public key of that.
So you're not able to open it.
The public key.
You mean you're talking about the intruder?
Yeah.
To decrypt it.
Usually you have a certain you have it written.
Usually very sign is also written somewhere else.
So it tries to open it using VeriSign.
The sign, the actual sign signature, he has to open the signature, but it's also specified in the
oh or something.
Somewhere along the way it's written that it's actually very simple.
Then he tries to open it.
If it cannot open it, that that signature that is coming through, then it doesn't accept it.
Even if it says it's very sign, it will not accept it.
Right.
There you can see it now when you open Zfc and you click here.
Connection The identity of HDFC Bank Limited at whatever address is written here, has been verified
by VeriSign Class three Extended SSL, CA.
Certificate authority.
And whatever this certificate authority is, I do have its public key.
That means it's valid.
This is HDFC bank.com.
So whenever you see this green mark.
You're safe.
You know that this is a trusted.
Basically.
You are the police officer.
This is the guy showing you the arc and you're making sure that it is signed by the.
Right.
Do you understand how the intruders cannot come now?
I'd ask you a question then.
What if you wanted to create your own server and you have hundreds of people in your company and you
want to host that server in there, but you need to create SSL connection to it.
The problem is whenever they try to connect, they get that message that it's not safe and they need
to click and proceed anyway.
How do you prevent that from happening?
Inside the public key of whoever signed that certificate on all the pieces.
Install the public key on all the PCs.
Once that is installed, whatever certificate they get, they will accept it.
So this part here.
This right here.
Very dangerous.
If you install a public key there, it's very dangerous because anything signed by that private key
of the same public key, you'll accept it.
I'll show you.
I'll show you how to.
But dangerous.
Right.
Not recommended.
Unless you know that it's a controlled environment, unless you know it's your lab environment or it's
your own company.
The users are controlled.
It's fine.
Let's see.
We'll see that again.
Now, the question is, this was just about a basic idea of how it works with SSL.
We'll have a we'll have more detailed look about it with SSL VPN.
For now, how does it work here?
In site to site VPN.
Simple.
I have a CI CD server now instead of R1 sending the SRC.
What I'll do is I'll register R1, create a set of keys, public and private.
Take the public key.
To whom?
The server and.
Get the.
I see.
May I see?
Signed by whom?
The server.
When I present my certificate to R3, will he accept it?
What is the only one way that it will accept that certificate?
First, I have to install the public key of this PKI server on both of them.
First, the public key has to be installed on both of them.
Once you install that public key, then when r one presents its certificate to r three.
It's signed by the PCA server.
It will accept it because it's signed by the server which you already trust.
Same thing from the other side when I present my IC to the other side.
Our one has to trust the PCA.
When I say trust, it should have the public key so that it can decrypt the whatever is written.
On the other side.
Any questions?
Is it clear?
Here.
Right.
We'll see how it we'll see how it's done.
Now, the public key.
You're not using for anything, by the way, right now.
Not for encryption, not for decryption.
It's only used.
For what?
Identification.
That's it.
This I see is not used for anything else.
Just identification that.
Okay?
Yes.
This belongs to my company.
And R3 says I belong to this company.
That's it.
That is the only one reason.
How is it scalable?
Now you have 100 sites.
They do not require a scale.
Now all you need to do is first time go and register with the CA.
Done forever.
Whoever they create the tunnels with, they'll just present their ISIS.
The only thing that should match is who signed you.
Who signed this.
I see.
Who signed that?
I see.
If it's the same server that all of them are trusting, it's okay.
They don't need anything else.
Right.
Let's go into more details of it.
Now, the address that I'm going to be using is right here.
I'm going to also.
Given a host species.
Connect it to the loopback.
Sorry.
Yeah.
Yes, obviously a lot of money.
Lot of money.
It's expensive.
To get an Https connection is expensive.
Plus verifications and all that takes time.
What?
Hope it works.
Now, what I'm going to do is I'm going to create the certificate here, right?
The public key public and the private.
I'm going to export it to the host.
So I'll show it to you how it looks like on the PC.
I'm going to create this guy into the PKI server and that's your job.
That's how you are going to do it.
Create a PKI server, right?
And then trust everybody and then create ISIS after that.
Before we move any further, let's just configure this.
Which interface is this?
F0 one.
Interface f0 one IP addresses 192168.
Let's say two dot 20 or 2 dot 25.
That's what I was afraid of.
Then mine it.
Try the blue back.
Go to the loopback.
So I can read the loopback.
I can read the host PC.
We'll use it later.
Just keep it here for now.
This.
Configure the rest of the stuff.
Okay.
Right.
Let's check if everything is okay.
R1 should be able to reach all of them.
So let's go to our one thing.
151 dot 20 4.4, which is the server can 23.3 is our three.
I can 25.5 is the Http server.
You might ask the question why do we need the Http server?
Now why is right now the routers have what time?
The clock time.
The system.
Time is there configured with when you when you bring them up.
It's somewhere in 2000 to March 2002.
When you create the certificate here, the certificates are usually valid for 3 to 5 years.
Some are valid for three years, some are valid for five years.
There is a huge possibility that when you create that certificate, the times are not synchronized.
Right?
This will be valid from 2002 to 2007 and your clients.
Will already be at a different date or a different time.
So it's recommended that all of them.
Synchronize themselves with respect to what?
The.
Right.
So all of them have the same time only because the certificates when they are issued.
Right, so that it falls into the same time.
You can you can you can configure the server as the Http server.
But I'm talking about if we're talking about real life scenario, right, where you have a separate
Http server, a separate PKI server, and then two different sites.
Right.
So what I'll do is I'll go to the Http server.
I will obviously not use it, but just to show you how it works.
Master to clock.
Let's set.
Right now is.
16.
And all the others.
I'll point them to where NDB server is.
151 .25..
Now we'll do the other stuff and let's see if it gets synchronized.
It does take time.
It's.
Synchronized with itself.
Let's check others.
I'm sure that they're not.
Oh, there it is.
That's interesting.
They all have the same time.
Right.
So that's fine.
Clock synchronization is there.
Now we go ahead.
To whom?
The PCI server and start configuring the real stuff.
The actual stuff.
The first thing that you need to make sure when you're doing a PCA server is what?
What do you need?
A set of keys.
You need a set of keys, right?
Just like before.
You require a set of keys.
Now, either you can create a domain name if you want to.
Or you could just create keys.
And label them so any one of the two will work.
Right.
So I can call it cats.
Nonetheless, let's make it 10243.
Done.
I have the keys.
Right.
So.
Can do it here.
Step one is empty.
Synchronization.
Step two is what?
Generate the set of RSA keys.
Don't.
Generate power.
Modulus.
024.
Doesn't label them.
If you're not if you don't have a domain name, then you need to.
Otherwise the domain name will automatically give it to.
And a.
Suitable means you are taking keys from here and making some other guy the server using the same keys.
Don't have to do that.
You only have one CSF, right?
The other thing that you need to make sure that you do is IP http server.
A lot of people forget this.
Right, Because it's a very simple stuff.
Stuff.
Why do you need it?
Because all the certificate requests will be coming on port number 80.
All your certificate requests.
For enrollment use a protocol called Sep Simple Certificate Enrollment Protocol.
Which the packets will come on TCP port number 80.
So you need to open that port number here.
On this.
If you don't do it, your certificate server will not come up.
Will not come up.
Okay.
Make sure you do that then.
The PKI server.
Call it anything that you want.
Just a name here has no significance whatsoever.
I'll give it a.
Third step was what?
Enable.
Http services.
On the.
Right.
So you need to name it anything.
Right?
This is up to you.
You can name it whatever you want.
The quality.
Today is Tuesday, right?
Right.
Then you have certain commands.
The first thing that you always use is database URL.
Where do you want to save these certificates?
The certificate that you generate the public key where you want to store it, I'll say store it in.
So in the certificate I see.
Will be generated.
It'll be stored where?
In the flash.
So I can remove it from flash and then install it wherever I want to install it.
Export it basically.
The public part will be stored private.
You won't see the private.
When this key pair is generated, you won't see the private part.
You'll see the public certificate.
You can remove it and place it anywhere else.
You could also change the format if you wanted to.
I'll leave it as the default.
What else do I have?
I've done this.
I need to do.
Grant.
I need to say Grant.
Now there's two ways of granting it.
One is none means do not grant any certificates.
The other one is Manuel.
I'll show you how, Manuel.
Manually.
You can do it.
Now what is Grant?
Manuel is when the guy comes in, right?
When R1 comes and registers itself.
Do I just grant him the certificate?
I don't do that.
I keep it in a cube.
It will stay in a queue, right?
Because when he comes, his public key will come in and stay in a queue and then he'll have to present
his documents and do everything and then I can accept it.
On the Microsoft server.
That's how you do it.
On this router, you cannot do it because it doesn't work properly.
It gets stuck.
You have to restart the certificate services.
Then it works.
So the best way to do it here is what.
Grant Auto, whoever comes registers.
Give him certificate automatically.
It's good.
In our case, because we know that all the routers are ours.
And this is our server.
I'm not going to grant it to anybody else.
Once everybody is granted, I'll shut down the granting.
I'll say Grant.
None.
After that.
Whenever I need it, I'll turn it on.
Whenever I don't need it, I'll just turn it off.
Making sure that only the people, only the routers which are connected are registered to.
Okay, Grand Auto.
You can choose the algorithm.
That you wish to use in the certificate?
Not really important in our case.
Why?
Because we are using it only for.
I see only for identification.
So we don't really need an hashing mechanism.
This is important.
This is everything.
It's showing me.
Now.
Have you ever heard about the x509 way of writing the issuer name and everything?
You might have seen it.
It's a standard.
If you open any certificate out there, you'll see it follows a standard.
This is the standard.
CN You have to write CN in certificate name.
OU is called organizational unit.
Organizational unit.
O is your organization.
C is your country.
That's our sign.
The certificate, the car, the name of the car is mentioned like that.
CN.
Right then.
Oh, you organizational unit.
This is VeriSign, Class three.
Ooh, is VeriSign.
Trust Network Organization is VeriSign, Inc.
And country is the same way.
When you have to write it, you write it the same way.
Is your name is CN.
I'll call it.
But were assigned something for us.
Something with respect to our car.
Say, for example, my car.
Right.
So I could say.
Give me a.
This is anything.
This is just a name.
This is just the name of a company, any company that you want.
Brown bears.
Dot Brown bears.
That's it.
Organizational unit is, let's say.
Training organization.
Is it?
Country is a UAE.
The certificate server resides in UAE.
And this is the organizational unit.
This is the name of the company Brown Bears and organization, is it?
That's it.
Just to see this latest so we can verify that this is the certificate that we created.
Remember this because this is how you will identify your certificate.
Okay.
And the last thing that you have to do is.
By default, it's shut.
You need to.
No.
Also lifetime.
Lifetime.
There's two lifetimes.
You have lifetime of a certificate.
Lifetime of a CA certificate.
What do they mean?
What is the difference between the two?
When I grant certificates to whoever is coming to me.
How how often how long is it going to be valid for?
That is certificate C, A certificate is my public key.
How long is that going to be valid?
My default is five years and three years.
You can change it to one year or two years depending upon your own self.
Now this.
The certificate is not up to you.
When you become a CA, you also get it from someone else, right?
You go to an authority and sign your papers.
You want to be a CA so they will let you know how much is the lifetime of your root certificate?
Somebody is about about the public, you will be the same for five years.
And we said.
Private key will always be with the certificate server.
Cannot see last time.
Remember?
How long did it take for to break that this is the same encryption.
What I showed you the video where to break that encryption billions and billions of years to break this
key.
This is the same key.
The same public key.
That was the video that I was talking about.
They wanted you to come and that was the ad they wanted to come and register with them because their
key is not breakable.
Right.
They wanted choice of where they wanted to.
You choose them instead of Versailles.
This marketing going on there too.
Same.
Yeah, the algorithms are the same.
No, this is RSA.
These are public and private keys.
A set of keys.
Then asked the Shah and all of those things, those are used later.
Here is triple des.
Those will be used by your which your SSL VPN for encryption and decryption here.
I'm not using any encryption decryption here, I'm just using this for identity.
They will not.
They will not in the next update.
And the next update, they will update themselves.
Usually what they would do is they would use the same public key next time also.
The case, they'll use the same public key.
But even if they have to change it, the next update of the browser will have that information.
Yeah.
Length of RSA depending upon how you choose it.
Right now, I chose it as 102 for.
The public is right now the ones which you are getting are not less than 2048.
Zero for it usually.
Right.
So no need this for now.
I'll just say no.
Shut the moment you say no.
I'll ask you for a password.
This password is used to locally.
Locally only encrypt your private key.
Locally.
Right.
Locally encrypt the private so that if someone even opens your, you know, flash or wherever it's stored
and he cannot see what's there, it's encrypted already to see that you have to enter the private key.
Yeah.
You'll be prompted whenever you install this anywhere.
Now you'll be prompted for a password.
You install it on a browser, you install it anywhere you need.
That certificate server has been enabled.
If I check my flash, what will I find?
Not even to.
They need to.
What is this in the flash?
Remember database URL?
I kept it as flash.
What does that mean?
Save the public key in the flash so I can export it from there.
Before I do that, let me write down the command so we are on track.
I said crypto.
Bcci server.
What do you call it?
Then I said database.
URL should be flash.
Save it in flash.
Grant.
Issuer name was the important part.
I said.
Is.
Brown bears.
For you is.
Or is it?
She is.
And then I said no.
You can also specify hashing mechanism lifetime.
Those are.
That's up to you.
Okay, let's copy this.
First of all, let me see if my FTP server is.
Started.
Copy from Flash.
Do the FTP server.
Source file name.
Then when you do.
25.
Destination file name the same.
Need to bind it to the.
I don't have enough.
What is he talking about?
Now another one.
Your strip is not working.
Was already copied.
So if we go right now to the E drive.
You should see.
Dot.
Take it to the rest stop.
Double click on It says, Do you want to import it or not?
Don't do it from here.
You import it from your SSL.
In the route authorities you click on import.
File name.
All types.
Thank you.
Click on next.
What is the password?
Remember the password for the private key?
Cisco.
One, two, three.
Led.
Next place it.
Yes, please.
And click on finish.
Check out this message.
This is very important.
It says Brown bears with organizational unit of training, organization of T and C of UAE is trying
to install its root certificate.
Windows cannot validate that this is actually from brown bears.
Right.
You should confirm its origin by contacting brown bears wherever this is, the following number will
assist you.
This is the thumbprint.
Thumbprint off this certificate.
So you go to them.
Tell them this is the thumbprint.
Tell me, what is this guy?
Which certificate is this?
So he'll give you more information about.
It's a shop.
It's a hash value of the certificate.
Right now it's using shower one, right?
We didn't change it.
We kept it as shower.
This is the one thing which is important.
If you install this, windows will automatically trust any certificate that has been issued by this.
Anything that the CIA will issue from now on.
Windows will trust it.
Right.
Installing a certificate with unconfirmed.
Unconfirmed.
Thumbprint is a security risk.
Please click Yes.
Only if you acknowledge this risk.
I'll say.
Yes.
Right.
The import was successful.
You should see it.
Somewhere right here.
Valid from 2015 to 2018.
Details.
Brown bears training everything the same.
Your public key is right here.
1024 bits.
Your kid, Your subject id everything.
They can.
Right.
I created it.
From where?
From the router.
And not much was done.
Only these few commands that I said save it in flash.
And this is the issuer name.
That's it.
Everything else is by default.
The important part is this is the public key, remember?
And now your browser trusts it.
Now your browser trusts this publicly.
That means anything issued.
By this server.
So now if HDFC Bank comes and registers even to the server.
And then he comes to you creating the connection, you will accept it.
The AC will be accepted.
Any questions?
Any confusion?
Yeah.
FTP is here.
I just copied from here to the host.
Then I put the certificate.
Any questions?
Before.
Before I move further.
Clear.
Everybody.
Can I take a break?
Yeah.
The bill signed is right now, the R1 and R3 will now become the clients of the Cape.
Right now, the server is up.
That means.
No, no.
See, what I've done right now is I've created the server.
Now it has a private key.
And the public key.
The public key will give out to everybody.
Right now.
It has also given the public key.
To whom?
For the P.C.C.
The Kacprzyk is now.
The clients have not registered themselves yet.
Now what?
The clients.
My next objective will be this client.
We'll go and register yourself to the server and get an ice.
That I see will be signed by what this private will be signed.
And this guy will go up get an icy signed by what, same private.
So when they exchange, they're exchanging this.
I see.
Say, I see one and I see two and I see one goes to three.
It will verify it only because it has the public key of this year.
Similarly, when Ic2 goes to R1, it will verify it because it has the.
He's able to open it.
Open It means he can verify.
Verified right now.
The second objective after the break, what we are going to do is.
Right now.
The public key is in the flash here.
Right.
I need to give the public key to this guy.
And the.
This public key should be exported to these two people.
Right now only exported it to the host.
I also need to give it to.
This is known as trust.
Trusting the.
We will.
Copy paste.
No, that was.
That was different.
He can't do it here.
If you do copy paste, you're copying pasting the whole private and public.
No.
That you copy or paste the whole thing.
And it has to store it in a specific location.
That one is not stored where you want it to be stored with the cut and copy.
That would mean you're creating an exportable.
It's not feasible.
Distance imaging.
This is a digital signature.
This is exactly what it is.
They come with you?
The same exact same concept.
You go to a car, he signs your signature.
So whenever you present that signature to anybody else, he will only validate it if it is a trusted
guy who signed you.
So a sign or all those people they will sign, right?
So they'll sign your digital signature.
So tomorrow when you show someone your signature because they already trust their sign, they'll trust
you.
Going to open that channel.
The sea.
Names information will be signed by.
No, not everything.
Not.
Not everything.
Apart from everything else will be not not everything else, but a big portion of it will be signed
by will be signed by the private.
A very big portion of it.
Right.
As.
So what is the next thing?
Resistor themselves.
Trust the CIA.
That's it.
The first criteria for the for the clients is that they should be able to reach the CIA, which they
can.
They can reach this here.
Right now, what I want to do is enroll.
There's two things.
One is authenticate.
The other is called enroll.
Authenticate means trust.
What does trust mean?
To get the certificate.
The public certificate.
Right.
Let's do that.
How Crypto.
Now you can do it two ways.
Either you can do it based on crypto or you can just use crypto.
It depends on it does not make a difference.
Both are the same.
You can either say crypto trust point or you can say crypto trust point.
Both mean the same thing.
Then you specify the name.
Again, this is local, so I'll say read.
Enrollment URL http.
Now see what I'm doing.
For the certificate request.
Go to which address?
At which port number?
So you go and register itself.
There's also one more thing that I have to show you.
It's called.
Revocation check.
What is a revocation check?
Is it valid right now or not?
See, sometimes what can happen is you go you have a company, right?
It goes and registers itself and creates a public key.
Once it has that public key, right after that, what happens is, say the company shuts down.
But that public key is installed everywhere in the world.
That means anyone can.
Can imitate them.
Right.
So at that time, what what you do is you go to the server and you tell them, listen, revoke this
certificate, please.
My company has been shut down, revoked this certificate.
Whenever that certificate is supposed to be used anywhere, a revocation check is done.
That means the guy will ask the CA is this valid right now or not?
Have you revoked it or not?
That's called revocation check.
In our case, it's not available with the router as a CA, so I'll just say revocation check should
not be done.
Revocation should not be done.
Another thing.
Now, this is all that you need in the beginning to trust it.
Crypto.
We call it CA authenticate.
What was the name?
W.
Check it out.
Three commands only.
I went to the client.
I said.
Crypto.
Press point.
Call it just a name.
Then I said, enrollment will go and you go and enroll yourself to the URL of Http.
151 dot 20 4.4.
Add port number and set revocation.
Check.
Then we use the command crypto key to authenticate.
W.E.B. Authenticate means install the public certificate of this guy.
Go and ask him for the public certificate.
That's the message that you see here.
It's giving you that thumbprint.
Remember, the thumbprint is telling you this is the thumbprint.
Do you really want to accept it or not?
If I accept it, that means I'm trusting him.
Should see the certificate now.
Show crypto CA certificates.
This is the public key, not the public key.
The see.
The issue of whom the CIA installed on you.
Now you trust him.
Any certificate assigned by this guy will be trusted by you.
Makes it tough to keep up.
The public is.
It's stored in the nvram.
This is the full certificate.
It doesn't display the public key.
I guess there is an RSA public key.
1024 bit.
Right.
Doesn't display the full key.
It's stored somewhere.
Somewhere hidden somewhere.
Right.
This is the full key, the full signature that you see on that side.
Right.
I have only what trusted the guy.
I also need to do What?
First.
I trust both of them.
Let's trust both sides.
I have R1 and R3.
I'll do the same thing on R3 crypto.
I'll here use PKI trust coin.
So I'll show you the difference with enrollment.
Is what same?
The address is the same.
Right?
151 dot 20 4.4 Number revocation check is.
There is a crypto here.
It's free trust point authenticate.
Sorry, big guy.
Authenticate.
Here we go.
Please.
Yes.
Get the certificate Trust point Certificate.
Accept it.
Now.
Both of these.
Both R1 and R3 are worth trusting.
Whom?
The server.
So any certificate issued by the PCA server will be trusted by them also.
Now.
I'll go and register myself.
How?
I'll create a set of keys here.
Then I'll take the public part of that key.
Get it signed.
Same thing from this side.
I'll create a set of keys.
Get the public part of that key sign.
By.
I commend all the.
Authenticate is a macro.
It's not a command.
Macro means it's just entered there and it's executed on spot.
It means I'm directing.
I'm telling him to go and get the certificate from the.
It doesn't say in the running config.
This command doesn't say it's just like show run or show commands.
You execute it once it gets executed and then it's lost.
You call it a macro.
Right.
So the first step would be to create that set of keys.
Now, it doesn't have to be large because it's just used for authentication.
So I'll just say generate RSA modulus, I'll keep it as five one, two.
I'll label them, I'll call them key.
Small keys.
Then I'll go back to my trust point.
Trust.
Point.
What was it called?
Wednesday.
Here I have another option, which is called RSA Key Pair.
That is a keeper.
Right.
I'll choose it.
As What was the name of the key?
I'm telling my trust point.
Use this set of keys to get.
Get your eyes.
How crypto CA not authenticate but enroll w id.
It says, Enter the password.
Now this password is used.
I'll tell you.
How do you want to include your router serial number in the in the subject name of your.
I see.
I don't want to do that.
And IP address.
I don't want to do that request.
Yes.
Certificate request succeeded.
So crypto key certificates.
This is your certificate.
So this is the certificate.
This is your certificate.
This.
Is yours valid for one year?
Five and two beds.
And this is your car that was there before.
Again, what are the steps?
Crypto.
Key generate RSA Modulus 51 to label.
Okay.
Again, go back to the thrust point.
And say what?
RSA key pair is.
Then the last command is what?
Libtool, CA.
Enrolled.
And roll means go with your public.
Get it signed by the CIA.
The CIA will grant it, give you the certificate.
Now you have the IC.
Now you have the AC.
I'll go and get the AC for the other guy also.
How?
Even if you don't specify the RSA key pair, it will still work.
See crypto.
CA certificate from here and roll wd.
Generated its own new bit.
Three, five and two key pair.
If you don't specify it, it will do it automatically.
You create a set of keys and go and register it with the.
Earlier I specified it using the RSA key pair here.
I didn't so automatically.
No, no.
Yes.
So crypto.
Is.
So crypto certificate.
Again.
This is your first key.
Five one, two bits, finger print, and everything is right here.
And then you see, Now both of you have what And I see now when I create my I see camp tunnel I do not
require.
Appreciate I have an knack for identification.
That's all I would require.
R3 is registered now.
R3 is registered, right?
Yeah.
We have commands.
I agree.
We have more commands than earlier.
See, first of all, on the client side, how many commands do you have?
One, two, three and four.
On the client side.
But why is it scalable?
Is because my business.
Now, tomorrow another guy comes in.
Another guy comes in, he doesn't need a separate key with this guy.
Separate key with this guy?
No.
All he needs to go and register with this.
Yeah, he's done.
Another guy comes in.
Another guy.
If you have 1000 people coming in.
The only thing that they need to do is what?
Register themselves with the key.
They don't need a separate key for this guy or for this guy or for nothing like that.
No configuration.
All they need to do is register with the key to get their certificate done.
They can communicate.
Right.
Let's create the tunnel.
Do you remember the steps?
Crypto.
Encryption.
Authentication.
I do not require it by default.
It's RSA sig, but also specified RSA sig means CA RSA signatures.
Digital signatures.
Right then hash the size group to.
Do I need the second part?
I don't need the key.
Don't need the key.
Step three is the IPsec.
Transform said.
He said.
ACL would require.
Access list 101 permit IP going from ten.
410.
One one.
Winning.
Two, ten 330.
Crypto.
Crypto map, map and PC.
Said beer.
150 .1.13.2.
Match.
Address one.
Said comes from said.
Today.
Then interface fast Ethernet zero zero.
Remember, no key.
I have not specified any key.
Making sure it is fast.
Zero zero.
Yes, it is going to are three.
Need to do the same exact thing.
The only thing that changes is.
As it gets shifted.
And here becomes.
Given.
Violin.
Use the private.
Even use 100.
Why?
Because here privates cannot go on the public cloud.
If ten not one is encapsulated as 10.1, it will not go to the cloud.
The cloud will stop it because it's the Internet there.
It was not the Internet.
It was a man connection.
So you're not doing any.
With that's actually done.
But the way we configure it, we tell him that the outside pair should be one 5123 Right.
That means the outside header should be one 5123.
Then we don't use a set pair.
You can give the loopback if you want, but you should have loop, reachability reachability.
Sure, if you have reachability from this loopback to.
Yes.
To which direction new track appears as.
Static.
Isaac.
It doesn't matter, but it matters.
Every second matters.
Is that.
We'll have a look at it.
Show it to me.
My wireshark is running.
Right.
I'll send a ping to.
Ten 111 with the source of.
Ten.
Three, three, three.
Goes through.
Check it out.
One and two.
Three and four.
Four and five.
Check out the sizes.
638 and 606.
Why?
The AC.
I see these are getting exchanged now.
Not the BSC.
BSC was small.
Now full ices are getting transferred.
So I'm sending you my I.
You're sending me your.
I see.
You will only accept my.
I see.
If you trust the server, I will only accept your.
I see if I trust the server.
Make sure you understand that part right.
If the other guy trusts him, then only he will accept me.
If I trust him, then only I will accept the other guy's.
Yes.
Obviously everything, everything starting from back at four onwards is encrypted using the session.
Did.
Good, right?
This is your server.
Any questions with the configuration and everything?
Any questions?
Let me ask you a question.
What if?
What?
This is one server.
The Smtp server here is not an Smtp server, it's another PCI server.
Let's have two PKI servers now right here and right here.
One.
Gets his AC from this server.
R3 gets its AC from.
It would will have to make it work.
Great.
And export the keyword.
So you need R1.
To trust whom?
Both.
Both the servers.
Or one should be trusting both the servers.
Our three should be trusting both the servers.
So because when our one gives him the IC, it will only accept it if it's trusting the PCI server here.
When our tree gives out his I our one will only understand it if it trusts whom the other.
So.
Authenticate both the servers enroll Only one enroll means to get the ICI.
ICI will only be from one.
Enrollment should be to both of them.
Using different species.
Cisco crypto thrust point name different names.
W1W ed to enroll only one authenticate both.
So you get two certificates from two different servers.
Right.
And then you create that.
That would be what you will do.
To practice this.
Okay.
Another one thing that I want to ask is.
Right now.
If I wanted to create a tunnel between R1 and the Pi server, is it possible?
And I.
Say the Pi server had another loopback.
Uh, loopback zero.
The address here is ten .4.4.4.
Let's say for the labs sake I want to encrypt traffic going from 10.1 to 10.4.
Is it possible?
Yes.
Message.
I want to tunnel IPsec Tunnel.
What I'll do is I'll go to that site, I'll go to this.
This is, this is what I'll paste on the server.
So I'll say traffic going from ten .4.4.0 going to 10.1 set here is 12.1 and I'll attach the map.
From the server.
Right.
So let's go there.
Before I do that, let me see if it is zero zero.
I'm sure it is.
It is zero zero.
So I'll go to the PCI server.
And I'll paste this.
From R1.
What I'll do is.
I do the same, I'll create another 1 or 2.
Which is from the same thing that we did earlier.
We've done this before from 10.1 to 10.4.
Since I cannot use the same crypto map I need, I can use the same crypto map, different sequence number
here.
This would be 24.4.
Address will be.
This is the same.
Then.
Will this work?
If it will.
Okay.
If it will not, which packet will be stopped?
It will be the first.
If it will not, then will be the five and six.
Understandable because we are doing certificates.
Yeah.
Exactly the PKI server right now.
Does it have an Ike?
Guys.
It doesn't have a nice it has a share.
It has a public and a private key that is used to sign other ISIS.
That is only used for signing.
That is used for signing other certificates.
It doesn't have its own IP, which is signed by himself.
For this to work.
It needs an AC.
Which is signed by himself.
Also, it needs to trust itself.
Right.
It's it needs to install its own certificate in that area in the nvram where it installs the root certificates.
So you need to enroll and trust yourself for this to work.
If I don't, let's see what happens.
Packet number five and six.
Track number five is going, but six is not coming.
Why?
Because I'm sending him the IC.
It's not accepting it because it doesn't trust the car.
It doesn't trust himself, and it doesn't have an IC to send back to me.
So how do I do it?
Very, very simple.
I'll go to the PCA server.
Certificate received from the request failed.
I'll say crypto CA trust point, I'll call it anything but one.
Right enrollment URL.
My own address.
24.4 port 80 Revocation check.
Crypto to authenticate raid one to authenticate myself crypto to get an nice.
I still have to tell you what this does.
Yes.
Now.
I have received the certificate.
Right now, when you receive the certificate and you try to do this again.
Now.
It should work.
Right, because now the CIA also has a certificate to give it back to give.
Back to you.
Not.
We won't really do it.
We won't really do it in real time.
So will be kept separately.
But in case if you have, say, ten routers and you are having a problem with the SRC, but you want
all of them to communicate to each other, you can just convert one of them into a CA quickly, real
quick and give the certificates to everybody and it can also communicate at the same time.
It's not like get VPN where the key server has to be different here.
The CSC server as a router can also communicate to the other devices.
Can create tunnels with other devices.
Okay.
Any questions?
It started in Ouroboros.
I see.
Stored in there.
I see.
ICAC has the public key in their eyes.
See Has the subject named everything?
Subject.
Name.
CN.
Organizational Unit OU RSA.
Which type of encryption you're using?
All of that information along with the public key.
Yeah.
Complete the signature thumbprint.
Everything.
Real life.
It's usually Microsoft servers.
That would be.
On Microsoft, we have a graphical user interface.
There is a role, right?
The servers have roles.
DNS role.
The role just like that.
You have PKI role where you just click on it and it gives you a graphical interface of, okay, I'm
a PKI server now.
Now I can give out certificates.
Right.
No, there.
You cannot create a tunnel.
No, you cannot create a tunnel with that.
Ken.
Ken?
Ken.
Can easily.
Can very easily can.
Yeah.
If you have a remote access, any client, you can do it with the.
Who?
Then I don't understand.
What?
It's okay.
And then.
Do you want to have a VPN in the DMZ?
Okay.
You can do that with the PCI server.
Just trust you.
Just see, the thing is.
I'm showing you where this is.
The thing is, with essays, you don't have to do it on the essays.
When you're doing with car, you don't have to do it on the essays.
You have to do it through the essays, through the essay.
Yes.
Transit through the air.
In that case, all you need to know is which ports to open.
500 and you have to open anyways for IPsec.
What else do you need to open here?
Open it.
That's it.
Open.
It'll go through.
When you open it, you'll go through.
IPsec and ISP you have to anyways allow through the.
So.
No, no destination.
It'll be a normal Http connection.
Yes.
Destination 80.
You should probably have it somewhere here.
When it was okay.
I did not register when it was enrolling.
When you're enrolling, you'll see all the requests that are going in.
We'll go to port number 80 because I used Http on the other side.
Right.
Anyway.
Going to port number 80 will go through on the AC.
You don't have to do these things.
The things that are on your syllabus, on the AC.
I'm covering them separately later.
All of them.
Know from from your syllabus point of view.
From the important point of view, the ones which you need.
For example, easy VPN will start tomorrow, but the biggest deployment of easy VPN is from the USA.
They use the ACA for easy VPN a lot.
Up VPN.
Yes.
AnyConnect.
Recovering.
That's essential.
Is it anymore?
Yeah.
Now.
Now this is the.
Yes, yes.
Plus we have what do you call it?
AnyConnect is getting more famous than easy VPN.
The one which you are talking about is getting more famous.
Now Secure mobility agent will be covering that a lot.
It's not in your syllabus, but I will be covering that.
Gwynplaine is gone.
Then we got a stuff.
But in case.
See, in that case, The thing is, you have to understand the whole process of how it takes place.
We'll also be doing tunnels, the VPN and AnyConnect using certificates.
So the PIN files.
So I'll be putting that file on the guide.
If it doesn't have if it doesn't have that file, it won't be able to come up and register to me.
Right.
So when you give the file and you give the file to the GUI, then depends on what you're creating the
tunnel with.
If you're creating it with the RSA, you need to use the debug commands.
He's become Tcpdump or Tcpdump is too much because it shows you a lot of traffic.
Yeah, you cannot stop it once you start it.
So you can use some other logging commands where you can see the whole exchange that is taking.
No checkpoint.
They have amazing logging.
Checkpoint has beautiful logging.
Smart log.
Right.
It's really nice.
It doesn't have anything like that.
But a is lighter.
It gives you more throughput than the checkpoint.
So that's why probably they haven't kept the other stuff in there.
You see.
20.
Think.
A good.
Games.
Yes.
Okay.
It is hopped off by the one in the middle?
Yes.
Yeah.
It does.
But the question is, are you getting stuck in the hops?
Yeah, because.
In.
History books is written.
So but the thing is, as long as there is connectivity from the gateway until that server, it doesn't
matter how many hops in the middle as long as connectivity is there, even through a proxy server,
because proxy server will change the IP address, it uses its own IP address.
Right?
But as long as the proxy server maintains the session, your session until the and then change it,
change it back to the private and move it move you to the private part.
Right.
Move you to as long as the proxy server can maintain the sessions, I don't think that would be a problem.
Yeah.
You'll be load balancing between them.
Yeah.
You have to reconnect again.
That is, the session would be lost because of what?
You have not prompted anything.
Uh.
Yeah, yeah, yeah.
If you don't specify.
Yeah.
Because there will be obviously all these firewalls and all of them do not authenticate.
Your details the first time because the connection is getting through.
Through the proxy and through.
Yeah.
First time.
I think that usually happens a lot.
That usually does happen.
But you get this how this is done, how PCA works again, real life.
You'll use a Microsoft server or any other Linux server.
This is only there so that you get an idea of how it works.
Plus, in a small lab environment, if you really have to do this, if you're running a problem with
SRC, you'll shift quickly to PCA, becomes scalable.
Now all the VPNs that you have done until now, till date, you get VPN, your VPN, your site to site,
VPN, you can do all of them with PCA, you have done it with SRC, you can practice all of them with
the same concept.
Nothing changes.
Concept remains the same.
Okay.
Let us begin.