Right.
So easy VPN.
Until now, what we've seen is whichever kind of VPN that we were dealing with until now.
What did we see?
Site to site VPN, VPN, get VPN will do.
All these VPNs have in common.
They connect.
Different sides of your companies.
Off your company are basically two different sites.
Right.
So you have, let's say, three sites or another one right here connected through the Internet or any
private cloud.
VPN gives you protection when Dmvpn gives you protection using a hub and spoke.
Get VPN gives you the same over a private cloud, but you should have end to end connectivity.
Site to site VPN also can be done using normal GRE tunnels.
These are all site to site VPNs.
Now today what we are going to have a look is at a remote access VPN.
What is a remote access VPN?
Remote access VPN is.
I say this is a company.
Connected to the Internet.
Right.
Nowadays this principle is getting very famous.
This phenomenon that people call it work from home.
It doesn't have.
What is work from home?
But the company will do is give you a laptop and they tell you, okay, go home.
And work from there.
Right.
You connect up to your company's network from home and go there.
You don't have to come to office.
Give you a bunch of work and you're supposed to do it.
But let's say for that work, you would require access to these servers.
You require access to these servers, how will you use them on the Internet?
Making sure that your connection is protected.
Making sure no one can spy on these servers while you're connecting and talking to them.
You use something known as remote access.
VPN that can be accessed remotely.
Now, the biggest thing here is until now, when you saw site to site VPN.
The one thing that was common again was that all of them had IPS that were static.
All of them had static IP addresses, right?
Public IP addresses.
Because they were already connected to the Internet.
That is a prerequisite.
Why?
Because you use a set pair command here.
Set pair and the pairs public address.
What is the public address?
Changes tomorrow.
You need to go in here and change that part.
Right.
You need to change the outside header of where to route the packet.
You understand in remote access VPN.
The best part is that the other peer.
Can have a dynamically changing IP address.
So today it has an IP address of 30 dot zero.
Tomorrow you can have 35.5.
Doesn't really make a difference to you, to the server.
Why?
Because the connection will be initiated from the client side.
So it really does not make any difference if this guy is sitting here working from home in Bangalore
or he goes any part of the world, as long as it has connection, connectivity to the Internet, as
long as he can reach this server.
Right can create a tunnel with it as long as reachability.
Layer three reachability is here with the server.
He can create a tunnel with the server.
Do you understand?
How does it all come together?
Now.
Let's name this as the easy server.
Now what we configure on the server, just like we did on your normal gate VPN, is you configure your
policies.
Now, there's a lot of concepts here coming together.
Policies are configured here.
Transform set is configured here.
Write your ACL.
Is configured here just like before.
Right.
And all of them will be what?
Pushed down.
To the client.
You might ask what to do from the client side.
Earlier in VPN, we used what identity number and all those things on the client side right here.
What do I need to do here?
You don't need much, you just need to enter.
We call it group name.
And password.
That's it.
A group name and a password.
This group name can be anything now.
It can be you can have multiple group names on.
On one European server.
So you could have.
Sales.
As one group, we can have marketing.
Has another group.
You can have it as a third group.
And so on and so forth.
You can have as many as you wish.
And then when this guy connects up, if he puts in the name as sales, the policies which are meant
for sales will be pushed down to him.
Policies for sale if it logs in with the username of Mark.
Mark's policies will be pushed down.
Okay.
Do you understand?
Also.
When you connect up, Right.
Who initiates the connection?
The client.
Initiates the connection up there.
What the server does is it also pushes down.
An IP address.
It pushes down an IP address from the tunnel to the device.
Pushes down an IP address from the tunnel through the device.
This IP address is installed.
On an adapter here known as the VPN.
The VPN adapter.
Whenever you connect your tunnel.
An IP address is going to be pushed down from there from the server.
Why is this IP address important?
Let's say this IP address that has been now you configure it, let's say 192 168 .1.0 slash 24.
You configure it as this pool, you give it a pool, you say, okay, the IP address for the client
should be given out from this pool.
Right.
So when the VPN adapter gets the address, what address does it get?
192.168.1..
Let's say one.
Ten.
Why is this address important?
Is because the client now makes the decision based on this address.
Anything that will be sourced from the address of 192 168 10.1 will go through the tunnel.
Yeah.
This is.
Yes.
The IP that you get.
It's not profitable like it's.
See?
Remember earlier?
Any traffic, which is going from 10.111 .121.2.2.2.
It was going through the tunnel.
When I say going through the tunnel, it used to have ESP here and then the public address.
30.32 20.3.
You can reach which server.
Yeah.
Through the tunnel.
Right.
True that this was what we did earlier right here.
What's going to happen is a little different here.
It's not based on source and destination.
So if your packet from the PC is originated, from which IP?
192 168 dot ten dot one.
If it is originated from here, going anywhere does not matter where.
This is known as source based.
If it originated from this address.
From the villain from the adapter.
Doesn't matter where it's trying to go, it will be encapsulated and forwarded out.
Through the.
Whatever is originating at this loopback.
Basically, when I say through the tunnel, I'm talking about this tunnel, which takes me where to
R2 and this will be D capsulated.
Where on R2.
This will be encapsulated on R2.
When I say D capsulated.
It'll be opened up and the decision will be made.
So if you're going to ten, 11, 11, 1 or 10, 11, 11, six, R2 will forward the packet to ten,
11, 11.
The whole concept is your policies will be exchanged between these two public addresses.
They will negotiate on the same policies.
They will negotiate on the same transform set on the same same material.
Nothing will change.
And the tunnel will be created.
To give you connectivity between.
Now, the thing is, what do you use as a client?
What do you use as a client?
First of all, we have two things for the client.
One is your VPN is a VPN client.
Cisco's VPN client so you can connect up using this client.
Other one is a router.
You can actually convert a router into an easy VPN client.
Which gives you more options, which we will see later.
It gives you many more options to configure stuff.
Now you can actually convert it later into a site also.
But generally you can have either a router as a client or the VPN client as a client.
Right now for this to work.
Make sure when you're configuring, when you're adding this.
You use?
Our VMware Workstation.
Do not do it with the loopback.
It doesn't work properly with the loop.
It will connect, but the traffic will not go through because it has too many adapters to make the decision
with.
So it's best if you just use, let's say, net zero here.
Put it in the same address range.
151 .3..
Now check what I'm trying to do.
What I'll do is I'll first configure this.
R2 will be the server.
I will configure the server first.
I will configure the server and we'll see each step one step at a time.
What does it do now?
There's nine steps to configure the server.
More than that, actually.
Right.
We'll have to go through each of them and understand what each of them does.
Okay.
Before we do that, let's configure it.
Right.
So before I do anything, I need to check if our phone has connectivity to R2.
How do I do that?
Stepping.
1.2.2 is the server's address, so I do have reachability to the server.
Now we'll go ahead, go to R2.
Let's start with that.
Lazy VPN server.
And then we'll start with steps.
What do you think the first step is?
Step one.
Step one is crypto as a policy.
Then.
Encryption.
Three days.
Authentication.
You can use core server also if you want to.
Cliché hash.
Now remember hashing the VPN client, the one which you have does not support Sha.
It only supports MD5.
Let me write it clear and big so that you don't make this mistake.
It only supports MD5.
The easy VPN client does not support.
Make sure you don't make that mistake.
Make sure it is MD5.
Where they say no, then that time you don't have to share.
You can use RSA signature.
You don't need the key.
Here.
No authentication RSA signature.
I say if you leave it as it is by default, it is RSA.
If you don't put anything.
Right.
So the first step is done.
On the server side.
Step to.
Step.
Step two Now do the question is, do you have a pre-shared key here or not?
We do not use a pre-shared key.
Why?
Because I told you we are doing authentication.
Based on what?
Based on a group.
Name.
Thank.
Yeah.
Sometimes you can do it based on a server.
Also, you can do it.
Yeah, you can.
That's what we'll be doing next.
I'll show you how.
Yes.
So you can check the group name and password from the Ldap server also that the tacacs server will do
for you.
You can do that too.
Right now we'll be doing it locally.
Will be authenticating based on what a group name and a key not appreciate.
But the basics.
I'll show you.
I'll tell you what that is The ones that you need, the one the information that you need.
So the first thing I need to do is before I configure the group name and key, I need to configure a
pool of addresses.
So.
Configure a pool.
Of addresses that will be.
Push down.
To the client.
Our clients.
How do you do it?
Local pool.
You call it anything?
I'll call it sales pool.
And let's say the address is 192 168.
Ten dot ten.
282.168 .1..
That is the pool that I'm creating.
I've not called it anywhere.
Okay.
So I created a pool.
Saying this is the pool for sale.
I have not found it anywhere yet.
Now I need to configure my group name and key.
The way you do it is crypto.
I am.
Client configuration group.
And you name the group.
What is the name of the group?
Sales.
What is the key?
This is the score.
One, two, three.
What is the pool?
That's it.
So after this, the next step is.
Specify.
The group name.
And the key.
Used by the client.
Connect.
Up to the.
So I really do it.
Crypto is a camp client configuration.
Now it's not icy camp key.
Usually used to have crypto key.
Right now it's crypto account client configuration group.
What is the name of that group?
Sales.
The key that he should provide is one, two, three.
If it does provide, the key is one, two, three.
Give him an address from the pool.
Sales.
That guy should be given an address.
From which pool?
The.
Easy until now.
Right?
Nothing different.
Simple stuff.
Step four.
Can you guess?
Transform set.
He said.
DSP three does DSP MD five.
Step five.
Yeah.
I have the transform set.
As the transform set.
I have the pool.
Right.
Have the group name and group key.
I would need see, as said just now that we can do this group name and right now sales and key.
I've stored it where locally.
I have stored it locally.
Locally where?
On the VPN server.
I could also do it on a Ldap server or a tacacs server.
I have to myself go in here and tell him listen, I'm doing it locally.
I have to tell my I can process that the key and the group name is stored where locally on this server.
How do I do it?
For that, you have to enable this new model called the Triple A.
If you're not done it, it's nothing different.
It's nothing special.
It's very simple.
Triple A new model enables those services of triple A, which means authentication, authorization and
accounting from from all of those services you're using authorization.
You're using authorization, you're saying triple A.
Authorization network.
You need to call this list something.
This list has to have a name.
Now, this list can have any name that you want.
I'll call it shock.
Let me show it to you here.
Triple A new model.
Triple A authorization.
And then authorization of what?
Network.
This is known as network authorization.
The group name and key is stored here.
Right.
Plus, I'm also pushing down a pool.
I'm also pushing down the pool.
From where?
From locally, from this server.
So I have to specify that network authorization.
Has to be done based on a name, I'll call it.
It is done based on what?
Server group, which means an Ldap server.
Or is it done locally?
It's done locally.
So is the name.
So it's just a name.
There's no need.
You can use them separately.
What I'm basically saying network authorization means authorization.
What does authorization mean?
It means once a user comes in, once a user comes in, what can he do?
Is he allowed full access of the network?
Is he allowed half?
Right.
Those features are configured where?
Here.
I'm saying when this user comes in with the user name of group.
Give him this pool.
Later I can add another ACL there.
I can say, okay, when he comes in, give him this ACL.
Do not let him a full access to the network given this ACL so he can only access this part of the network.
That is authorization of authorization.
I'm authorizing the client.
That's why here I'm saying, okay, the authorization of the list will be done locally.
I have not applied this anywhere.
Wherever I apply this Sha, that authorization will be done locally.
We'll see how.
Right now I just created a list with the list says wherever I applied I will do the authorization.
How?
Then.
Correct?
Right.
Once you do this.
Once this part is done.
Now you need to create a crypto map because you apply it to the interface.
Now, there's two ways of doing this either using crypto maps or we have something known as virtual
tunnel interfaces.
Either using crypto maps or what we are doing now.
What we are going to do now is crypto maps.
Now first of all, you tell me.
When you have a crypto map applied, right?
Crypto map.
Let's say I.
What is the first command that you use?
Match.
Address.
Then what set up here?
Can I use set pair here?
I cannot use that.
Period.
Why?
Because this IP.
I don't know.
I don't know this I.
Giving.
What?
This guy?
No, this guy.
I don't have any control over this guy.
I only have control over the server.
That is the pool.
So it doesn't matter what the public IP is, the pool is always be pushed down.
I only have control over my pool.
Doesn't matter who comes and registers.
If he uses the same key and password, I will give him the pool.
That's what I'm saying.
Anybody can come and register.
Anyone can come, any address out there will come and register for me.
The thing with me is I don't know who's going to come.
Any public address.
The pool, if you if you see the pool that I use, the pool is a private address.
You'll see how this is used.
It will come together.
Right now.
The question is the VPN client cannot come up to me.
It will come up to me.
I don't know what address is he going to come up with.
So here I cannot use a static crypto map.
I cannot use the static.
I'll use something called a dynamic format.
Why dynamic?
Because I will not use the set command.
I will not use it.
How will I to use?
How will you get the spear from the guy who comes up and registers?
Yeah.
First.
You always hit this.
After the physical address of this guy, then he can do routing and then through routing he can go and
yeah, the first one is the easy VPN server.
After that, there can be a proxy server here, there can be another server here, another server here.
So you can go through that will be done purely based on routing from our three.
Your job is to hit home.
The server.
Right.
So my job right now is to configure the server.
Do you understand the problem of crypto maps?
I don't have the pier, so I'll use a dynamic crypto map.
How will it work when R4 comes and registers itself for this tunnel?
He'll use the set pair as 150 .1.4.4 because R4 came up with that address When.
When the PC comes up and registers, I will use the set pair as 150 .1.3.3.
So I'll keep on changing that dynamically.
Based on the pier.
A different pier, A different address.
No, no, no.
They will know.
The clients will know the address.
When you connect up to your company's network, you know the public IP.
The client.
See when you go here.
The server doesn't know the client segments.
The client knows the server's address because the connection will be initiated from the client.
In remote access VPN.
The connection is always initiated from the client.
The server is just waiting for someone to come.
The moment someone comes, he takes the source address.
You are my SAT peer.
He takes the source address from here you are my SAT peer.
When you create this map on your VPN server, the way you do it is crypto.
Dynamic map.
Call it anything.
And then again an entry just like crypto map I map ten, 20, 30, stuff like that.
In here you have many different things that you can do.
The only thing that you do is set, transform.
Set.
Do you give an ACL?
No.
Do you give a set peer command?
No.
This is the only thing that you give, right?
Set.
Transform.
Set.
Anyone can come and register.
Yes.
Anyone can.
They know they need group name and password.
They just.
If they don't have the group name.
They cannot come up.
Right.
So created the dynamic crypto map.
The problem with dynamic crypto maps is they cannot be applied directly to interfaces.
You have to apply when you apply a dynamic crypto map.
You have to bind it to what?
A static crypto.
Otherwise you won't be able to apply them.
So you do have to create what?
I mapped it still again.
You have to create one.
Dynamic.
You bind them together.
The crypto map I mapped ten IPsec Isakmp.
Dynamic.
So you're binding the two together?
How?
Might know.
Step six.
The step six.
You say crypto.
Dynamic map.
Call it d y n ten.
Then you say set.
Transform set.
Said.
And then you bind it to a static entry.
Crypto Map iMap ten IPsec Isakmp Dynamic.
The name is De.
By.
This is not enough, though.
You still have not bound other things to the crypto map.
I've only said Set.
Transform.
Set.
Have I bound the group?
Have I bound the pool?
The authorization list?
No.
If you look at it, these are two separate modules.
I've just created a crypto map where I set, set, transform, set.
That's it.
Have I bound it to all these steps?
I have not.
I have to bind it to them.
The way you do it is what?
It's simple.
We have never tried this part before.
But if you look here.
In iMap, you have something known as.
Isaac.
So you could say a.
Then you have authorization list.
What is the name of that list?
I'm seeing my ice camp, which will begin from this crypto map.
That ice camp should be authorized based on what Sha sha means.
What?
Local.
I pointed it to the local database earlier.
Right.
If you remember Sha Sha was pointing to the local database.
So here, I'm not saying anything special, I'm just saying crypto.
Map.
Whenever I apply, I map whatever I see.
Camp is initiated from there.
It should be authorized.
Based on the list.
She is pointing where to the local database.
So I'm saying authorization for Isakmp should be done based on the local database.
Do you understand this?
But this is the only thing.
This this part is the only thing where people get confused.
You understand this?
It doesn't give out a pre-shared key, the client, the client.
When you're asked for authentication, right, the client will just give a group name and a key.
That's it.
In the beginning, you have extended authentication.
That's later.
You won't do that now, right?
We are doing the basic bare minimum that we need for the tunnel to come up.
He will give it out.
To whom?
To the server.
The server will check it now it needs to know does it check it against the local database?
Does it check it against the.
Against a Ldap server.
How does he do it?
You've already specified it.
You said.
Okay, listen, based on this crypto map, because the first thing that it hits is the crypto map.
You're saying authorization of this should be done based on Sha?
And where is Sha pointing to?
So it should be done locally, basically.
That's what you're saying.
Group name key and the pool and everything that is going to be pushed down should be done.
How locally?
Where is that local?
You've already configured it local.
If you had a different server.
If you had a different server, what you would do is this pool and all of this would be configured on
that server.
On a different server and your list would be pointing to that server.
Do you understand the difference between the two?
You'll be pointing to that server and all these configuration group key and everything will be configured
on that server.
Yes, five different groups.
So all those five groups would be created where?
On that server.
Now, that's how you usually do it because you don't have one group.
You have a lot of groups.
As many as you can.
As long as you have the enough addresses in the.
Of all the users in this group.
At maximum, you can have as many addresses as you have specified.
Ten at one time.
Right, because address will be pushed down from the pool.
Now check it out.
I've done this.
There's also one more command that I need to.
It's called crypto map iMap client configuration.
Address this.
Why is this by default?
By default.
I told you the server is going to push down a pool.
Right?
He's going to push down an address from the pool.
By default, it does not have the authorization to do that.
You have to use this command to enable that feature.
Basically what you're saying is when the client asks for an address, respond, give him an address.
Okay, so what is the command?
Crypto client.
Little Matt by Matt.
Client configuration.
Address.
So what you're basically saying is when the client asks for an address, do respond.
If you don't use this command, the pool will not be pushed down.
Okay.
One last.
Let's have one last review of this from the beginning of what what did we do in all the steps?
Step one.
Policies.
Step two configure a pool of addresses which will be pushed down.
Step three is what?
The group name, the key and the pool that is supposed to be pushed down.
How Crypto client configuration group.
And then you specify the key and the pool that should be pushed out.
You.
And as the server, you will not use a pre-shared key here.
That's it.
That's the only difference.
Cisco.
One, two, three.
Even this even the group name and key even that you will not use this.
You will have it configured here, but from the client side, you will present to you a certificate.
Right?
You will not present a username password.
He will not write down a group name or key.
It will be taken from the certificate, the certificates, or you will be taken as the group name and
key.
You have to specify.
You'll have an option.
Choose an option.
Right.
No, actually not.
You don't have to specify the key.
Even the key is for X or you just have to present the certificate with the same group name.
Because it's a certificate, right?
It's already verified.
If you verify the certificate, then it goes to only group names should match.
If group name is the same as the organizational identifier unit for you, it will go through.
We'll see that you have to do that with the AC.
RSA token you could use with here.
Also you can use it, you could use the RSA token here.
Then the client configuration group, you will be doing it where authorization based on the RSA Securid
server.
So it'll be pointing to the secure ID server and the configuration will be done there.
It's a useful piece.
It's something like that, but mostly used for it's mostly used for RSA tokens.
Access Control server does not support Https For that.
To support OTP, you have to link it to Microsoft servers, then create OTP from there.
But secure server gives you OTP functionality.
By default.
Not here.
You wouldn't be using that.
You'll be hooking it up to that server.
Using what?
Authorization list.
Give the server's address in a network list pointing to that server.
Everything will be done that the authorization part will be done from the server.
Okay, Now if this is done.
Then what did we do next?
We can figure this.
Then we said, okay, this is the transform set that should be pushed down.
Right.
I just created the transform set then.
Step five, I created a network list which was pointing to the local database.
I did not apply it anywhere.
I just created the network list which is pointing to the local database.
Then I went down to my crypto dynamic dynamic map.
Why?
Because the peer's address?
I don't know.
So I said a dynamic map transform set.
I bound it, he said.
Then I said okay.
This dynamic map should be statically bound to crypto map.
Map because on an interface you can only apply a static map.
The last two commands.
First, I bind my camp to the list, which is pointing to the local database.
So binding all of this from top to bottom together.
Also one more command which says which enables my crypto map to push down the IP address.
Otherwise it will not be able to push down the.
That is all you need to do on the server side in crypto maps.
And you're using.
Now we'll go with side.
The client side.
Let's see what to do on the client.
Another thing.
The most important part was what?
Interface.
56780001, I think.
Crypto map.
Applied to the.
Right.
Let's go.
XP should be up by now.
I have a VPN client here already installed.
Would I go there?
Let's see if.
I can communicate.
151 .3. 25.
150 .1.3. 20.
The Internet.
Colors.
Kidnapping.
The Detroit.
Should be able to do.
Let's check if it is bound to be zero.
Let me check my addresses.
Here's one 51.30.
I just need to bind the XP also to pm0.
Now.
It should work.
Then I should also be able to go where?
20.2, which is important.
Rented out to why that is my easy VPN.
So.
So my client can reach the VPN server.
If it can reach the VPN server on layer three.
It should be able to create the connection with these.
And we remove.
These are from the old ones.
Now.
Check.
Check out.
What do you do on the VPN client?
You create a new connection.
The entry here does not matter.
I can call it sales anything.
This is just a name.
Host address.
What is the host address?
151 .2.2.
The Router's address the Router's public address so the client does have to know what is the public
address of the server because that's how he creates that connection.
Group name.
Sales.
Password is.
That's it.
That's all you need to do.
That is exactly.
I mean, that's finished.
That's all on the client.
You just double click to create the content.
You are already connected.
Just double click on the VPN client.
That's it.
You're connected.
Your connection is up.
Check this out.
What is this?
VPN adapter.
It was disabled until now.
Now it's enabled.
What address do you think will be enabled here?
From the pool.
He'll be pushed down from the.
192 168 dot 10.10.
Push down to this client.
To this client from where?
From the server through the tunnel.
Now, between them, if you.
If you can.
Capture the traffic.
That's something else.
I'll explain that later.
When you connect through the VPN tunnel, you lose the connectivity to the internet.
You're only connected to your company unless you make certain changes by default.
You're only connected to your company.
The needs.
We call it a split tunnel.
So right now, do you think from here when?
I think.
Ten.
11.
11.1.
Do you think this should go through?
It should, but it's not.
It is.
And two 10.6.
It is.
Let me check if there is a route already installed here.
When it comes back.
So.
Leipzig.
Taking the wrong road.
I choose the server.
Right.
So IP route.
Static route is not installed.
So Crypto IPsec is.
Yeah, it should.
Let me tell you why.
Check this out from the client side.
I told you from the client side, it's a source based.
It's a sauce based on see what's happening now.
So, yeah, we need to install it.
There's another command for that.
That's what I was checking.
Show.
Crypto.
If you check your crypto map, you have iMap.
What peer address are you using?
It's a dynamic market dynamically created.
This is the first dynamic entry which was created.
So 30.25 came up.
Right.
Check this out.
An automatic seal was used, which says traffic going from anywhere to 192 168.1. ten should be encrypted.
Traffic going from anywhere to 190 to 168.
1010.
If you really think about it and you have a look at it here, what I'm what I've done is pretty genius.
I have given out an address.
Which address?
A pool address, which is a private address, and the crypto map is applied over here.
Here I'm saying anything when the traffic hits this crypto map.
If the destination of the packet is 192168.1. ten it should be encrypted.
It should be encrypted.
With what?
Peer address?
Remember crypto maps.
How do they work?
They apply to an interface.
Then when the interesting traffic hits, it gets encrypted.
From the server side, it's destination based.
So if you're going to the destination of 192, 168, 10.10 and you hit.
This guy.
Your traffic is going from x dot x to.
10.10.
You will be encrypted.
Using ESP, What will the outside header be?
Destination will be 30.25.
Source will be obviously your own source, which is 20 point.
So publicly.
You always go where?
30.25 from the guy, Right.
The crypto map.
It was adapted randomly, not randomly chosen.
Who created the tunnel?
Who initiated the tunnel.
What was the public address?
When it comes and registers himself.
What is his public address?
30.25.
This is 30 to 25.
View from the server.
The server can give out any address from the pool of.
This address was given from the pool.
Right?
30.
25.
I configure 25 on this guy.
30 or 25 is whose address is the client's address is Windows Xp's address.
Just so that there's no confusion.
30.25 is this guy's address.
The public address.
1925.
It goes and registers itself.
Now see how the process takes place.
30.
25.
First things first.
It goes and registers itself.
Today, the VPN server, the moment VPN server sees an address, it catches it puts it where in the
crypto market for this address.
Late, then the pool is pushed down.
What address?
192168.1. ten is pushed down.
To whom?
To see one.
To the.
VPN adapter on the client.
It's pushed down, given to the adapter.
Right?
Then from the server side, it's what?
Destination based.
So any traffic from anywhere in this network, if it's trying to go to one and 2.168.1. ten and it hits
this interface, it will be encrypted.
This universe is source based.
Anything from the client side?
That is source from where?
Going anywhere.
We'll be going through where?
Will be encrypted and going to work to the server.
You cannot see it on the client.
But what you can see is I can go to R1, sorry, the VPN server, I could say debug IP packet.
And I'll try to send a pink one.
It is already getting captured.
I can say pink.
Any address?
1.1.1.1.
He received a packet for one 51.22 publicly and 151.30 5.3.
But when he opens it, it doesn't know where 1.1 is.
But the packet is getting encapsulated.
Where?
On the server.
So you'll see that ESP should be going through this.
ESP.
These are esp packets.
Right.
30.2 from 30.25 to 20 dot.
They'll always come through.
Now, the question is, the problem with this scene is can right now can see one thing, the Internet.
Can I ping?
30 dot.
Ten.
30.10.
It should ping, right?
It should because it directly connected.
Right now I have two adapters.
I have two addresses Right now.
This PC has two addresses.
I want to address here, I want to address here.
If I bring like that, it should work.
Logic says it should work, but it doesn't.
Because by default, virtual clients are given a higher preference than physical adopters.
Virtual client.
This is a virtual client, right?
Everything that will be coming out from this PC will be coming out using the source of 192, one 6810.
If it is coming through.
192 168, 1.10.
What is the problem with that?
It gets encrypted and goes where?
To the server.
Do you understand?
Any questions?
Please stop me and ask.
See, when you use your root print, right?
It will show you the root.
How many roots?
How many networks do I have?
Two.
One is 151 .3. 25.
The other is 192.
168.
10.10.
The pool address given to me.
But right now, this PC has two addresses.
What is the physical address?
What is the pool address?
Not only to address.
A public address which is on the physical adapter from where you're connected to the Internet.
One 5120 These are all public address.
Right.
20 or 25 is not there.
I removed it.
That was.
I kept it earlier when I was creating the topology, but then I kept it as 30 because 20 I was already
using on this link by mistake.
I made this also 20 so I removed it and changed it to 30.
Okay.
Now, again, let me explain this again.
Now, this PC has two adapters.
One is the physical one, which is directly connected with and another is the.
When the packet goes out.
The question is which source does it use the physical one or the virtual one?
The priority is always given to the virtual one, so any packet that is coming out from this PC will
be coming out with what source?
Ten, not ten.
So even if you try to connect this directly connected Internet, your packet will not go there.
It will go there.
Because it's coming from the source, right?
If it's coming from the source, it will go through the tunnel.
It'll be encrypted.
Going through the tunnel to where?
Like you want to check?
Basically you do.
Let's ping my directly connected ring.
150 .1.3. ten.
Directly connected to me.
Cannot send.
Even if it's physically right connected to me.
I don't even need a default gateway.
It's right there connected to the other end of the physical link.
Do you understand?
It's connected.
We're directly connected to each other.
On the other end of the physical link, I cannot ping him because whatever packets are coming from me
are coming from its source.
192 168.1.1.
And whatever is coming from that source when it hits the physical interface is going to be encrypted
and thrown away.
To whom?
To the VPN server.
Going to be pushed out over to the VPN.
So.
Right.
Because it's going to be encrypted.
Like what?
Let me draw the packet.
The packet is going to look like 192.168.1. ten.
Going to 150 .1.3. ten which is directly connected to me from here to here.
Since it is here, it will be encrypted using ESP.
Going from 150 .1. 30 dot 25.
Going to 20 dot.
So the routing and everything will be done based on 20.2 and the packet will reach where.
Richard.
Yeah, but when it goes here, right, the sauce will remain.
What?
192 and 68.
Ten.
Does he know where that guy is?
Does it?
It doesn't go to the.
Yeah.
Because it will be decrypted where R2.
Yeah.
Internet will get the packet but see from where.
From the server side it will first go to the server, then the server will see where is 151 .33. ten.
So it bring back the packet.
Where.
Obviously not.
Never knows if it had.
It would work.
The thing would work, but your ping would flow.
Which direction?
Right, Because everything originating from you has to decrypt at this level.
Whatever packets coming from your side will always go where to the VPN server.
But when directed towards the internet, why is it going to.
Because this water is the source that you're using for each packet.
No, the pool.
The world would be changed to the.
That's how the routing will happen.
But you're whenever you're originating any packet.
Now that packet has what source?
192.
161.
Whatever package will be originated from, you will have that source, so you'll be encapsulated.
Yeah, but the sauce will still again be used.
As what?
When I ping the internet, what is my sauce that should be used normally?
151 .33. 25 to 151 .3. ten.
This should have been the normal case.
It doesn't end up using that?
No.
Here the destination is this and source is this.
But since your source is what?
Physical is not given a preference.
Loopback sorry, your loopback adapter is given a more preference.
A virtual adapter.
Your address will be.
It doesn't end up like that.
Why?
Because you have an extra encryption.
Encapsulation again.
ESB And at the outside you have what?
30.25.
Yes.
Going to the destination changes now.
It's, what, 20.2?
20.2.
20.2 is home.
Easy to cancel.
Why is this there?
11.
Ten.
11.
Yes.
Interval between 192.
168?
No, but there is a default route from here pointing towards R2.
So when it replies.
Yeah.
Not a part of the internal where or who knows it.
Yes.
I'm not getting the address from that fool.
I'm getting an address from a completely different address, which is not assigned to any anything.
It's a separate address.
Doesn't make any difference.
Anywhere else.
You'll have a separate subnet for this for the pools so that you can differentiate that these are the
addresses who are coming from the VPN client.
Once you are there in your network, you know that these people have come from the client.
Yes.
In the policy.
I'm not pushing any default.
I have not added any reverse route right now.
The thing is, I'll explain how the packet flow goes from I've not said I've not talked about the packet
going through 1011 one.
Before that, I want you to understand this part.
Do you understand this?
20.
Just like that.
It's always going to the server.
Why is this here?
The question is, why is this here?
Why did they do something like this?
Why?
Why was VPN adapter given a higher preference?
It was done because, say, for example, this is your company.
This is a PC where at your home there.
There's a very high chance that it can have a Trojan.
How does a Trojan work?
The host is here.
The server is sitting somewhere else on the Internet.
And the server controls the Trojan.
If you have the connection up straight to your server.
That Trojan who has control of your server can also control your actual companies because you have access
to all the servers here, right?
So if he has control over your Trojan, that Trojan will have access to what all these devices so you
can gain information about those devices.
So that's why what they said was they said, okay, when you connect up to the Internet, internet connectivity
should not be there.
So even if the Trojan was there, the server was there, the Trojan will not be able to communicate
to its server.
And your connection is safe.
This was created earlier.
Now the question comes, how do you reach ten, 11, 11 one.
I send a ping, How do I go there?
How does the packet look like?
Going to.
11.1.
What is it encrypted using?
Public source of.
30.25 designation of 20.2.
It will go to the internet route based on the outside header route where.
Is the VPN server.
The VPN server will do what the Capsulate this.
Then what does it do?
With this packet.
So it's a destination right?
Whereas it forward this packet to know based on this routing table, you'll see where the ten 1111 network
is from here.
It's a normal routing process.
So he'll see.
Okay, I have access to ten, 11, 11 one.
So it forwards it out to ten, 11.
11.
That's the question.
How does it come back?
How does the return packet looks like look like coming from ten, 11, 11.1.
Going to exactly 190 2.1 68.
It will reply to 10.10.
From here right now.
The question is, are one.
Will forward it to R2 based on what?
Default?
Before drought.
It comes here.
The question is, are to does he know where 192 168 10.10 is that is the problem.
He doesn't know that if you do your route he doesn't know where 192 168 addresses.
Here's how we think.
How does it think that is the question?
See, right now.
But he has what?
He has a default route pointing towards where?
The Internet.
Losses.
Losses are the default route.
So what he does with the packet, he says, okay, I don't know where you are.
I don't know where.
1921681.1. ten is.
So it forwards it out.
What is applied here?
A crypto crypto map says anything which is destined to 192 168 10.10 should be encrypted using what
set.
Set pair command.
Said player is 30.25 there and 20.2 is the source.
So it forwards it back to.
But what would be better is if it had a root already.
So instead of going through the default route and going out, if it had a route to 181, 68 and ten,
that would be better.
That would be better for the routing table.
It doesn't have to go through The default.
Default route is a little dangerous.
So for that, whenever you're giving out an address from the pool, right, whenever you give out an
address of 192.168.1. ten, he gives it out to a public address.
25 Whenever you're giving it out, you can install a static route on R2.
You can inject we call it injection.
Inject it out.
This route is known as.
Reverse.
We call it reverse route injection.
Whatever address that I've given up, it'll be pointing towards the see.
Pointing towards the public address.
Yeah, but to have information in your routing table is better.
Why?
Because then you can you can route that.
What you can do with that is you can route that in a routing protocol.
You can say redistribute this statically connected route so it can go all over your network.
Everybody in the network will know that address.
How you do it is in your crypto dynamic map.
Here.
I said set, transform, set.
Another command is.
That's it.
Just set.
Reverse route.
Septimus.
I think it's just a.
Those are the parameters of reverse.
You can set reverse route parameters of it want.
Do you want it to be statically or stuff like that.
So right now I'll go back here.
Even after you create the tunnel again, after it gives out the address Right now, he will not ship
it out.
Right now there is no route.
Right.
But once you go in, clear your tunnel again.
Is connected.
Connected again.
Then.
Then you go to the side.
Do you show IP route?
The address that has been pushed down is what, 192, 168.
1011.
So I have a route for that to say.
Anything going to 192 168 1.5 should be going out from 30.25.
3025 is which interface?
Obviously your F0 one, the one which is pointing to the internet.
It's better.
Why?
Now you can redistribute this in any routing protocol so your whole internal network will know where
192 168 1011 is.
Yeah.
The right.
Now I need a default route.
Why?
Because I only have two devices.
What if I have hundreds?
New IP from the pool because I removed the previous tunnel.
Right.
So that one was used already?
Yeah.
Now it's 11.
If you pare it down and bring it back up again, it'll be 12, 13, 14 like that.
Go back to ten.
Ten, 11, 12.
Keep on cycling.
The question is, why do I need this reverse route?
Right?
It would work without that also.
The question is, right now I only have two devices pointing their default routes to me.
What if I have more devices here?
Not have all of them pointing the default routes.
I have a routing protocol running between them, and in that writing routing protocol, I also need
to tell them what is the IP on the other side.
The AP that has been given to another client is a part of the company now, right?
He's a part of the company using which private address?
So everybody every private address here needs to know that we have another guy, which is 92 and 68,
ten, 11.
My question to you is this.
Can I from our one.
No.
Can I ping 192168.1. 11 right now.
Virtual adapter on the PC.
Can I ping from R1?
192 168.
10.11.
Now, I wouldn't call it a chain of the border.
How did I do it?
Going from.
Can I?
So.
And then get encrypted.
As long as you don't tear it down.
It is going through the tunnel.
The next stop is 1011, 11.2, which is the VPN server.
After that, the only hop is straight.
The final.
Encryption is done based on the restriction.
So if you try right now, if you want to see if it's really going through the tunnel, go to R2, show
crypto, IPsec RSA section caps.
How many?
19 and 64.
Right.
Send another packet.
I sent them.
29 and 74.
How is it going to.
I'll explain it again.
I'll write down the whole thing.
It's coming from ten, 11, 11.1 going to.
10.10.
Right.
It reaches.
What?
I do checks the routing table.
What is the leaving interface?
Hits the crypto map.
Crypto map says what?
What destination are you going to?
Ten.
11.
Are you going to ten?
11?
You can just go as it is.
You have to get encrypted.
Encrypts it using.
Buried at one end.
30 dot four Was it across to the internet to 30.25?
The VPN client decrypts it and the traffic reaches the destination.
From here.
Destination based.
From here.
Source based.
Destination based.
Source based.
We will not do the router as a client today.
Don't want to do too much.
Not.
Not here.
It works almost the same way.
In the same way.
But there it used to be from source and destination used to be defined here from the server side only
the destination is defined from the client side only the source is defined.
If it works.
It works the same.
Looks the same.
Exactly the same.
Another thing that I want to show you, one last thing before we break off is check this out.
You can also check that out here.
We call this tunnel.
Everything.
If you go to statistics and you check your out details, 0000 means everything is going through the
tunnel.
Every traffic that is going through from leaving this router is going through the tunnel.
Right.
I need to change that.
Now I want the Internet to work.
I don't want people to just go to the to come here see what good.
Another good thing is you might want the users to use the Internet at the same time, Right.
And you want extra security.
So what you could do is first let them connect up through the tunnel, then have your own internet running
here.
And apply firewalls.
Right.
So when the user comes in, he can still connect to the Internet, but not from his Internet through
the company's Internet connection.
So everything that is coming in is coming through the company's Internet.
So you might have a firewall here.
So whenever a Trojan or anything is coming in, it will protect you from that.
Right.
If you want Internet connection for the clients, if it is absolutely necessary that they should connect.
Plus you also need security.
If it's not that important.
But you could also say is you can tune this VPN adapter.
This client.
And tell him exactly this traffic should come through you.
Everything else, let it go when it lets him go.
The other adapter that is left is the physical adapter.
It will go through the physical adapter.
First preference will still be given to whom?
The VPN adapter.
But now you can configure the VPN adapter and tell him Listen, only traffic coming to this network
should come through you.
Nothing else.
I'll do it on the server side and then push it down to the client.
Using an access list.
Now this access list.
Can be a standard one.
Can we extend that one?
I'll say permit ten, 11, 11.
Let's say one.
Summit host.
1011 11.1 is the server.
Now this is reversed, so be careful here.
This is applied reverse.
Here.
I'm saying any traffic which is sourced from ten, 11, 11.1.
But when I push it down, this will be reversed.
So for the client, this will become the destination.
Any traffic going to this destination?
Should we allow?
Right here.
I'm saying anything going from ten, 11, 11.1 to any.
When it was pushed down, it becomes from what?
Any to.
11.1.
Let's see how this is applied so we can have a good idea of how it works.
I'll go to the server.
Right and I'll go to my crypto client config crypto client configuration group sales.
It's called ACL.
What is the name number of the ACL?
Then.
The server.
The server in the client configuration group.
I'm giving out a pool with the pool.
I'm also giving out was an ACL for the VPN client.
I'm telling the client only come to this from the tunnel.
Let's go ahead and disconnect.
And connect back up again.
I am connected.
Statistics.
Should be.
Usually works with the standard ACL, but let's try with the other one.
It doesn't go through the.
How I use correctly.
So access.
No access list and I'll create another one.
Extended one.
Usually, sometimes it does.
But right now it's not working.
So I'll say anything coming from which host.
Permit IP going from which.
Host 1011 11.1.
Going to any.
Same thing, just an extended essay and then apply it where crypto is a client configuration group sales.
Golan Heights 101.
Let's start again now.
What do you see?
Ten.
11.
11.125.
It's a host.
It's closed now.
Traffic when it's coming from here.
Now it also has a VPN adapter whenever traffic is originated from here.
When you think, for example, ten, 11, 11.1 before applying the source, it will check the adapter.
Should it be allowed through the tunnel or not?
It says yes.
If it says yes, it will allow which source?
Ten dot.
If, however, and if this source is applied, obviously it will go through the tunnel because the source
based everything on the client side is source based.
If this source is applied, means it will go through the tunnel.
If you're not going to one 10.1, if you're going to ten dot.
Let's say six.
Will it pass?
Will the adapter let you go?
No.
So it will not use its own source?
What source will you use?
150 that you only have one.
One other option.
The source will not be used at 192 168.1..
That source will not be used.
This source will be used since this source is used, this traffic, is it encrypted?
It's not encrypted.
So it will go to the.
He'll go to the Internet, but it will go to the Internet.
Not meant to the tunnel.
It will not go to 20.2.
It will go to the.
So anywhere else, if you're trying to go, you can go.
But if you're trying to go to 10 or 11.1 since the VPN adapter agrees with that, it will use its own
source.
It will be encrypted and decrypted.
Where on the VPN server you can you can try this and you can verify this now.
If I go to.
Think.
Ten, 11, 11.1.
I can go.
But if I go.
2.6.
Destination.
Unreachable.
Can I go to the Internet?
151 dot 30 dot directly connected.
Right?
Split them.
This is known as Split tunnel.
I can even go to the VPN server.
I can go anywhere on the internet.
For two things.
You saw.
What?
You know, right now it's the only one one time when it will be encrypted is.
That's the only one time it'll be encrypted because you're.
Because your status is.
Any questions, guys?
Retailers in split ACL.
Split ACL is in reverse direction because the way when it supplied.
On the on the server.
It says 1020.
When it goes to the client side, it's reversed.
That's how the protocol is built.
Yes, it's coming from any to ten, but when you specify it on the server side, it should be from.
So swing.
By default, the ACL is 02000.
Means everything that is coming out from the PC is using the source of 192, one 6810, not ten or 11
or 12 or whatever you have right now.
Any confusion, guys?
After all.
Now you can pick anything.
Will it be encrypted?
Correct.
I can bring this over.
Yes.
The What will be the status of what?
No, no, no, it won't be.
The panel is already created.
You're already connected through the tunnel.
Now you have a connection to the server, right?
Now you can send packets also from the other adapter that you have.
You can go anywhere from that adapter.
You can ping the server.
You can ping anywhere else.
But this tunnel is set up.
Only traffic going through this tunnel will be what, to ten, 11, 11 one.
You would whatever package you're sending through the other physical link, it does not affect this
link.
This is already set unless you disconnect it.
Okay.
Let.
Everybody clear?
There with VPN.
This is just the client mode.
Now you have network extension mode.
Network plus mode.
Plus you also have to do.
The same VPN using VPNs virtual tunnel interfaces.
So.
So three more.
Three more implementations of the same thing.
Right based on the VPN client as well as on the server.
So tomorrow what we'll do is we'll do the same thing, but using what router as a client?
LLC network extension.
But before that, do practice this part because tomorrow we'll be going into more advanced features
of VPN.
Let we say.