So, yeah, let's move.
Now the configuration is set just exactly like yesterday.
The first thing you need to make sure that our R4 and five.
These are two different sites.
Of the same company.
Right.
Two different sides, same company connected to the Internet, making sure first of all, our four.
Camping.
151 .2.2 which is the VPN server R5.
The other site can also ping 20 dot.
Communication is done.
I need to configure the server now.
I'll call it.
I server.
Right.
What is the configuration?
Let's go.
Starting from step one.
Crypto scam.
Policy ten.
Encryption.
Three days authentication.
Please hashed MD5.
Remember MD5 and group.
Modify because the client does not support QA, then he don't need.
No reader key, right.
I would require a isochem configuration group.
But in the group I need to specify a key and a pool.
So I need to specify here first.
IP pool.
I'll call it sales pool.
Then I'll give it an address.
1932168. ten dot ten.
21922168.1..
I don't think there's a tool here.
Done?
Said.
Third is the group name and key.
How crypto.
I use a client configuration to whatever sales, then the key is going to be the pool that is supposed
to be pushed down is the sales.
Done.
Then step four You already know crypto.
Transform hypertext transforms.
He set?
BSP leaders.
BSP.
Five.
To step five.
Now I've done everything I need to push it down.
To push it down, I need to first authorize the guy.
How do I authorize the guy to triple a new model?
triple-A.
Authorization network.
Whatever local.
All right.
So I'm saying that basic authorization of whoever comes in should be checked against the local database,
not the not a triple A server should be locally done, which I've configured here.
This part.
Then step six is crypto dynamic map.
Like anything Quinten said.
Transform set to set.
Also if you want reverse.
None.
Finally, step seven is finding the dynamic map to.
I map ten IPsec Isakmp Dynamic Devi.
Then other crypto map parameters.
Crypto Map iMap Client Configuration Address.
Crypto map I map.
What else do I need to say?
I say camp.
Authorization list.
Interface.
Step eight was interface Fa0 one.
Crypto map.
Correct.
Basecamp is on your VPN server is up.
Now, yesterday.
How did we connect?
We just went to the client, gave the group name and key and it was connected, right?
Here, let's say, for one of the clients.
I say this is site one.
Right here.
You have to do a little configuration.
Not a lot.
It is still easy VPN, It is still easy on the client, but there is a slight difference between the
router as a client and your normal VPN client software.
What is the difference?
Let's have a look at that.
Now what is going to happen when he when our four is going to create a connection with R2?
R2 is going to push down an IP address.
Yesterday, that IP address was pushed down.
To what?
To the adapter.
To the Vpn's adapter.
Right.
The adapter which was on the Windows PC today when this address is getting pushed down, which right
now is going to be 192.168.1.1.
Where is it going to be pushed down on?
It doesn't have an adapter, right.
What's going to happen is our four is going to create a new loopback.
This loopback will be loopback 10,000 automatically created.
And this address that you push down will be pushed down to the loopback.
10,000.
Same address, the one which you pushed down yesterday.
It was pushed down to the VPN adapter.
Which was with which comes with the software.
Here it gets pushed down to a loopback.
10,000.
A new loopback is created and it gets pushed down.
Everything else is the same except for certain other things.
We'll see that.
Right.
Also here, when you're creating a connection, you need to specify an inside interface and an outside
interface.
What do I mean by that?
You need to specify.
Okay, this is my outside interface.
Obviously.
Which one do you want to be?
Your inside interface on the router as a client.
See on the VPN client only one person can go to the VPN server.
Right to these devices.
There's only one client which was connected, so you connect.
Only that guy who connects up will be able to reach here on the router.
You have the capability of making sure anybody who's inside can go and access these servers.
So when you specify an inside and an outside outside, you specify for your public address inside,
you specify for which users do you want to be able to access this service.
I'll here.
I'll say ten .4.4.0.
Anybody on the subnet of 10.440 should be able to access whom these servers behind.
Basically the traffic should go through the tunnel.
Right.
I'll explain how the how the mechanics works, how it works along the way, how it encrypts that traffic.
But understand the inside and the outside part.
Anything you specify on the inside should be able to go through the tunnel Outside is your public address
that you'll be using.
Okay.
These two things.
That's it.
Everything else is the same.
Let's go ahead and see how to do it on the side.
Now, the command that you use is Crypto IPsec Client, a VPN.
To the loopback.
10,000.
Yes, that'll be from the CPU.
Crypto IPsec client, easy VPN, you name it anything.
This name does not matter locally.
Significant, I'll say easy.
Here.
Address.
What is the address?
One 51.20.
Just like yesterday.
We had a dress and group name and key here.
Also, you specify the same things right here.
Address Group.
What is the group name?
What is the key?
Cisco.
It was caps.
She was caps.
Salesforce gaps.
Crypto IPsec client is an easy.
Group.
Sales key.
Cisco one.
Right.
And I also need to give my sales.
And this there's a command called connect.
Do you want to connect automatically manually or through an SQL?
Connect Auto means this client will keep on trying to connect and connect and connect and connect.
So if something is wrong, if you have misconfigured it, you'll see a lot of messages coming in because
it'll try to keep on connecting every.
You'll see a lot of messages coming in.
It will not stop Manuel.
Means you have to enter another command for it to try and create that connection.
Just like yesterday to connect.
We used to double click, right?
So it was up to us.
The control was up to us here.
If you do auto, the control will not be up to you.
It will try to go and connect automatically.
Right.
Let's keep it, Manuel.
Right now.
What else do I have?
Do I need anything else right now?
No.
By default, the mode is client but just to make sure.
Mode.
You have these three modes that we have that we are going to be having a look at mode, client mode,
network extension and mode network plus.
Here.
What is the mode I'm using?
I'm using router as a client.
Right.
So let's have a look at the client side.
Crypto.
IPsec client.
Easy VPN.
Call it anything easy.
Then.
Connect.
Manuel Perez one 5122.
Group.
Sales, He says, Go on to three.
Nothing special.
More.
But then you just specify the inside and the outside.
Zero zero is Crypto IPsec Client.
Easy VPN, Easy.
Outside.
Interface loopback zero is.
Crypto.
IPsec Client.
Easy VPN.
Easy.
Inside.
Okay.
Simple.
Interface F00.
Crypto IPsec Client VPN Easy outside interface loopback zero Crypto IPsec Client is easy and easy.
That's it.
The moment you do this, your easy VPN client is up, your ISO cam goes up.
It also in the running configuration, if you check your zero zero.
You'll see that you will not see the outside command here because that is the default.
If you just write crypto IPsec client an easy that also acts as what.
Outside inside you should see.
Inside.
You should see.
Now.
Connection is what?
Connection is manual, so I have to use another command.
If it was auto, it would have already tried to create a connection with the European server.
But since it's manual I have to enter another command to connect.
I start.
How to do it.
Crypto in not in the global config.
Do not go to the global config to do that because this command will not work.
Then you will get confused because you'll be going into the sub configuration mode.
Crypto IPsec Client VPN.
What do you think is the command?
Connect.
The moment you use the Connect command, it will try to go and connect.
With whom?
With the VPN server.
And you'll see your client is.
Up.
The client is.
Now.
Easy VPN does not use your main mode.
Do you remember the main mode?
Main mode had how many packets?
Six.
Hazekamp had nine main mode has six six plus three.
Three of quick mode.
This has three.
This aggressive mode only has three.
Main mode had six.
Aggressive has three.
Why three?
Remember what was the first and the second packet?
Second policies.
Third and the fourth.
--.
What they said was they said, why do we need all of this in two separate packets?
Let's combine them together.
So instead of just sending the policies, you send policies plus in the first packet and the return
packet is also policies plus the.
So at the end of the second packet, encryption starts with to begin.
Again.
Third and fifth and sixth packet was Pre-shared key being sent from both sides.
Right.
So they thought, why both sides?
What if $0.05 to six If six accepts it, quick mode should begin.
Six accepts it.
Quick mode should begin.
So that's how if you see.
Your wireshark right now.
You have your aggressive mode and aggressive mode.
Only three packets.
One, two and three.
Then this is the transaction because configuration is being pushed down, a lot of configuration is
being pushed down.
So these are just transaction messages then you have.
Click one.
You have straight up quick mode now.
But first, check out the size of the first packet.
1179.
This is from the client to the server.
Why is this so big?
Remember on the on my easy VPN client, have I specified any crypto policies?
So which policies?
When he sends out his packet, which policies does he send?
That is the question.
Let's check.
Not default if you check.
He sends all combinations of policies that it can use.
The client will send all combination of policies that it can use to the server.
Three days md5 des md5 des sha des MD5 three days MD5 with 1024 bit with group five.
Group to all the possible combinations are sent to whom to the VPN server.
Then the server decides the server you already chosen chosen what policies to use.
So he chooses one of them.
And to make this process a little smaller, what you could do is on the client side, you could also
specify the policies so those policies would be sent.
But yeah.
Which policies?
Yeah.
We don't need to specify.
Yes.
If you specify, the first packet, size will decrease.
Right now it's 1200 bytes.
It will decrease.
But again, it's just one packet.
Here all the supported policies by the client?
Yes.
By the VPN client.
The router has a client, right?
Not second third because has to be exchanged both sides.
Right.
So first packet.
First packet.
My second packet.
Your public third packet encrypted.
The.
With what will.
Yeah.
Here will not be appreciated.
Right.
Group.
Key group name and key.
In this case, only group naming from my end.
After that, the server starts sending.
What other stuff?
Information and all of that after the quick mode is exactly the same.
Obviously in this case it will be more from the server side because the client doesn't know anything.
Everything will be pushed down after that.
Right now I'm not sent any traffic show IP interface brief.
What do you what should you see in IP interface brief.
Blue back.
10,000.
I did not create it.
10,000 loopback.
What is the address that has been pushed down?
192 168. ten dot ten.
Check out your show Crypto Campuses.
Schmeidl already show Crypto IPsec.
It's here.
From the client side, Is it source based or destination based?
The tunnel.
Right source based right from the client side, anything coming from that source will be encrypted.
If you see the IPsec right now, anything coming from 192, 168, 10.10, going anywhere else will go
through the tunnel.
Just a quick recap.
Yesterday when we were talking about this, I said, okay, an address will be pushed down.
So 192 168 .1. ten will be pushed down from the server side.
Anything going to 192 168.
10.10 will go through the tunnel.
From the server, from the client side.
Anything coming with this source?
Right?
Anything using the source of 192 168 10.10 will go through the tunnel.
Yesterday the problem was what was the client a PC on the PC?
There was no way for you to choose the source.
Any packet coming out from the PC was always coming out using the source of 192 168 10.10.
Why?
Because the virtual adapter was given a higher priority than the physical adapter on a PC on a router.
It's your choice.
Why?
Because when you ping, you can choose your source.
Whence I'm getting the address from the server.
We are getting.
Yes companies private.
Graphical interface.
Yes.
How can you access the computer?
See?
I'll explain.
That's a good question.
He says, okay, if I have a Http server here and I'm using router as a client, what is the whole point
of it?
What is the point of having the server?
Because what do I want to do?
Ping it.
On the router.
What you have is capability of letting all these users who are behind you to be able to access this
server.
Not only are four will be able to even ten .4.4 network will be able to access it.
Now these ten dot four can be PCs, separate PCs.
Which will be able to access these devices.
Right.
We'll see in a moment how first of all, tell me now, if I go to R4 and I ping ten, 11, 11.1, will
it work?
If I ping it like this, will it work?
It will not work.
You, you.
You.
You, you.
If I ping ten, 11 11.1 with the source of.
10.10 or loopback.
10,000 should work.
It works, I can reach the server also.
10.1.
Point one 11.1.
I should also be able to reach 1011 11.6.
Using the source of 192 168 .1. ten Show Crypto IPsec should show me encryption and decryption is happening.
Okay.
From the server side, if I go from the server side show IP route, I should be able to see a static
route installed because reverse route injection is on towards the public address.
Us whoever registered to me.
Right.
So I should be also able to send traffic to one and 2168.1..
From the.
So what do you have to make sure?
What you have to understand is when you create a tunnel with the server.
When you create a tunnel with the server.
Your traffic gets encapsulated at the server wherever the server can go.
You can go.
If the server has reachability to these two devices, you should be able to go there.
If the server has reachability to anybody, wherever the server can reach, because then your decision
will be entirely based on r2's routing table.
When you capsulate here, where you're supposed to go will be entirely based on r2's routing table.
Yes, you also have to make sure that whichever device you're going to it has a reverse path.
All the time.
Even after.
Even after split tunnel.
Yes, it would be one night.
Yes, but only after split tunnel.
We said that only traffic going till 1111 six will use 192 168.
The other ones will use the physical interface.
That was the split tunnel.
Right.
Split tunnel said on the router.
As a client, it said, use the adapter only if you're going to the destination of ten, 11, 11.1.
If you're going anywhere else, this adapter will not be used.
Which adapter will be used?
Why?
Right now, are you?
I will be able to, but not to these devices.
I'll be able to bring these devices with the physical interface.
This is a private network.
Okay.
We won't have connectivity.
I won't have connectivity.
That is the server.
If I was able to, I wouldn't need the VPN server.
Right from the physical interface.
I should be able to.
Yesterday this was not possible.
Yesterday this was not possible because yesterday I did not have an option to choose my source.
Here I have an option to choose my source so I can go anywhere else.
So there's a difference with the client and the server.
Side to side?
Yes.
Easy dependent side to side because it's easier on the client.
We have to configure.
Did you see the configuration that I needed to do here on the slide?
Show run section crypto.
Check out the config that I did here.
That's it.
No policies, no transform set, no ACL, no crypto maps, no applying it on the interface.
Nothing.
Only this.
Plus if I have another site coming in, same configuration on the other side.
My policy is transform set is already configured on the server.
Now anyone can connect up to the server.
If I have 50 sites only this small amount of configuration on the 50 sites and they'll come up and register
to me.
Right.
Fighting the server from one nine.
Plenty to do with the source of loopback.
10,000.
Should.
Should come up.
You should come.
Here it is.
It should.
If we have time, I don't think we will.
But if we have, we'll try it with the client.
We just have to connect the client to the.
Right.
The pink should be successful.
Right?
Yeah.
The pink is successful.
Why is the pink successful?
If pink the public address?
Can anyone guess?
What I did was from R4.
I pinged.
From after I pinged.
151 .23.2 with a source of.
Then not then will it go through the tunnel.
First question.
Through the drummer.
The only criteria to go through the tunnel is what?
The source if you're using the source as 192, 168, ten, ten, it will go through.
That is the only criteria.
Always remember only two criteria.
One on the server.
The server is if it's going to the destination of 192, 168, 10 or 10, it will go through the tunnel
from the client side.
If it's using that source, it will go through the tunnel.
That's the whole point of pushing down the address.
Right now.
It will go through the tunnel.
Right.
When it reaches R2, it Capsulatus.
Does R2 have the right to one Route 192 168 20.2.
It's directly connected to him.
One 5122 is R2's interface.
Yes, but it's not leaving the router, right?
It's on the router routers interface.
No, no.
151 point 20.2.
Who's 20.2?
20.2 is his R2 is interface.
So it sends it to that interface.
R2's Interface replies checks the routing table destinations one 192 168 10.10 goes back through the
tunnel.
So we are pinging the server.
Just only pinging the server From what public IP is it coming from?
After 20.2.
40.2.
Coming from 40.4 to 20 point.
The encapsulation.
The tunnel means going from here to here as public address.
My question to you guys is, okay, this is working.
Everything is fine.
Can.
I do this.
Ten, one, one, 11, 11, 11.
One with the source of ten.
Four, four, four.
It does go through.
That means my ten phone networks can also go to the 1011 networks.
They can also access the Internet, the servers.
How does this work?
Sure.
Crypto IPsec.
3435.
So.
Yes, but if you check your tunnel.
It is only anything coming from the source of 192 168 10.10 should go through the tunnel.
Yeah, it has to come from that.
It has to be in.
If you check your IP interface brief, you'll see you have this interface envy.
What is envy?
What is an NBA net virtual interface?
And means a not virtual interface if you check show IP nat translations.
Before going out by default.
That's why you do the inside and the outside.
Remember that you have to do IP nat inside and IP nat outside.
What you're basically saying is traffic coming from 10.4.
The moment it hits your router, it will be changed to the source of what?
So let's say the traffic is coming from ten .4.4.4.
When it hits it will be changed to 192168..
The source of the packet will be changed.
What is a private.
Yes.
But I also know at the same time that when it gets translated to this address, it will go through the
tunnel.
In.
On top of that.
Yeah, this is just translation.
I'm going to the address of 1011 11.1.
My source was ten four, four, four.
It got changed to 192168. ten dot ten when it hits the interface.
What happens to this packet?
Encapsulation.
Because the source is 192 168 10.10 encapsulation has the public header and it goes through.
Reaches the.
Again, traffic coming from now you can talk about any guy doesn't have to be.
Talk about this part of the network.
Traffic going from let's say there's a there's a guy sitting here whose address is ten .4.4.4.
It wants to send a packet.
To whom?
Ten, 11.
11 dot.
The moment this traffic hits.
What?
The interface before going out.
What is going to happen to this traffic is this is going to be changed to packet.
Bad thing happens.
So all of all of the people coming in will be patted on to this address.
Now it tries to hit the interface, leave the interface.
But what does the interface see?
The source is 192 168 .1. ten.
The tunnel says anything coming from the source.
ESP going from 40.4 to.
28 public address.
And this part will be.
And.
Right.
So you'll see that your traffic then will flow from.
This part.
To whatever you're trying to go, wherever you're trying to go, it will encapsulate.
It will encapsulate here, R2 it go wherever it wants to go.
When R1 replies, which address does it reply to?
Ten 44192168192168.
It was already patterned?
Yes.
Exactly.
So when it comes back to R2.
R2 will see the destination is 192 168 dot 10.10.
It will do.
What?
Send it back through the tunnel.
It'll come back here.
The moment it comes back here.
Now it comes back here from the source of ten, 11, 11.
One coming to 192, 168, 10.10.
But it will have a port number also associated with it.
Based on that port number, it will change 192 168, 10.10 back to 10.444.
Same port number forward it back to the same client.
That's how the router can act as an easy VPN client.
The flexibility that it gives you is on the easy VPN server.
Sorry, on the easy VPN client.
As the software, you can only have one user connecting up here.
If you do it on a router, everybody behind you will be able to go and use the easy VPN server.
Everyone behind.
One of the software would be required on each of the PCs here.
You just need to do it where the clients don't need a software.
They can just send a ping to ten, 11, 11, one.
It will go through.
Exactly.
But you just have to do it once.
Connection has to be established only once.
Good.
Yeah.
So course the server cannot communicate again.
Good point.
Right now our R2 can go to what with which address.
If R2 wants to ping ten .4.4, can it go?
Can do.
Pink.
Ten .4.4.
Cannot write.
So the side to is a VPN server.
Can I ping?
Ten 444.
I cannot.
Why?
Because I don't know what 10.4 is.
I only know 192.
168.
10.10.
Then not four was known to whom or for when R4 comes to me, he doesn't come as 10.4.
He comes in as a patted address of 1922168 9.10.
And that is the only address the server knows.
Right.
Even in.
Yesterday's situation.
There was no there was no loopback.
Yesterday's service situation.
There was only one address.
Which address?
192 168 .1. ten Yesterday.
Also it was the same.
So I can reach 10.10.
You would be able to ping the physical interface, but the GUI would not reply back.
That's a different case here.
Here.
Yesterday there was no loopback.
Yesterday no one was getting patted here.
Today I want to access all the users who are behind R1.
Yesterday there was no one behind the PC.
Do you understand what I want to do?
The server wants to do what it wants to access all the PCs which are behind R2.
How do I do that?
I need to know that information.
I don't know it.
I only know the address that I pushed down.
The way you do this is pretty simple.
You go to the site.
Crypto IPsec client is an easy.
Mode, not client, but network extension.
A network extension mode.
It will not ask for an address from the server.
An address will not be pushed down.
The client goes down.
Right.
Loopback 10,000 removed.
Show IP interface Brief.
No.
Look back.
10,000.
It goes back to normal show IP route.
Charles the crypto IPsec client is VPN easy.
Sorry.
Connect.
Connection is up.
Check this out.
N m remote subnets.
The more subnets means.
Now, when the connection is created, not only does the server push down anything, the client also
pushes up.
Pushes up.
What?
These addresses.
He will tell the server, Listen, I have this address.
If you want to send traffic to 10.4, send it through the tunnel.
Earlier.
It was not possible here.
Nothing will not happen.
The server did not push down any address to me.
The server pushes nothing to me.
Okay, so from here, the tunnel will be based on anything source from ten 440.
We'll go through the tunnel.
I will show you that that that that's another good thing.
We need to check that I didn't show you last time.
We'll show you.
Here are two anything going to 10.4 will go through the.
Let's go to R2.
Check your route.
What do you see?
You do need reverse route injection here.
You do need reverse route injection.
What do you see?
No IP has been pushed down.
If you check here show IP interface brief.
There is no loopback.
10,000.
Nothing has been pushed down.
It's very simple.
The client is telling the server, Listen, I have this address.
If you want to send traffic to this address, send it through me.
So Crypto IPsec SA will show you any traffic going to north 192 168 going to ten .4.4.
Any traffic going to 10.4.
And from the side side.
Show crypto IPsec.
Any traffic coming from 10.4.
So earlier, the address that was pushed down was used as a source.
Now, the loopback will be used as the source.
Now the loopback in real life scenario in production environment, you'll be having what?
A full network that will be pushed up.
Or down both ways.
Right.
Let's see if the server can reach.
Ten.
Four, four, four.
Obviously it can.
This is the site.
Pink then for four for can the people inside R1 and R6, can they reach ten for for for obviously can.
Obviously can.
Now it acts exactly like a site to site VPN.
Now, this is an exact copy of a site to site VPN, and this is what a lot of people have been doing.
As a replacement to site to site VPN because this is much easier to configure.
Right.
You see right now that both the sides.
This loopback is able to reach the server behind.
If we had a lan.
Let's simulate that Lan Using what?
Another loop.
To back one.
What if I had another land here?
44.
Right.
What if I wanted those users to also go up earlier?
I would do it.
How?
Using ACLs, right?
Proxy ACL would specify traffic going from here.
Here all you need to do is go to that land.
Crypto IPsec client Easy VPN easy inside.
Okay.
Crypto IPsec Client VPN Connect.
Connection is up instead of sending one.
It sends how many?
Two subnets up.
So from the server side show IP route you'll see not one but.
Two subnets.
Which inside.
Yeah.
Like right now I'm using interface loopback.
You can use interface fast ethernet zero zero.
The full subnet.
If you check right now, he's sending the subnet 1044 44 zero slash 24.
The full subnet is sent up.
So now the users, your PC they can also access 4444 dot.
Your servers can also access full networks.
All the loopbacks that you specify as the inside will be acted up.
Let's do another thing.
Let's go to the other side side to let's configure this guy also has network extension mode and then
let's see if the two sides can communicate to each other through the VPN server.
Right.
The rout is used on the VPN server.
That's how it installs the static nodes.
Let's go to R5.
Football.
It should, because you're not pushing down anything and you're not giving out an address.
The static route will be installed anyways, but it's always a good practice to have it installed.
Easy connect.
I'll keep Connect Auto here instead of connect manual.
On the other side here is the same 151 .2.2 group.
Sales key.
Cisco one, two, three.
Mode network.
Interface F00 Crypto IPsec Client Easy VPN Easy outside interface to back zero crypto IPsec client is
European easy.
Interface Loopback zero.
I've not created yet.
Ten.
Five.
Connection is down now It's up.
See, Otto, I didn't have to use the command.
It keeps on trying and trying.
When the remote subnets did I push up?
Ten, five, five zero.
So if you go to the server side and check your static stuffs now you also have new static routes.
You have ten, five, five, five.
Can I from here go to 1011 11.1 with a source of ten.
Five, five five should be able to go.
But can I go to.
Think about it.
I want to go from 10 to 5, five, five.
My traffic should go from ten.
Five, five, five.
Go to where?
Ten.
From here.
Right.
From where?
From our side.
We'll be interrupted.
It doesn't have to go to the server, it can go to the cloud directly.
It won't go.
Everything has to go to this because your peer is only the server.
And then going back to our for our for our for reply.
That's what I will be replying.
To whom?
Ten dot five.
Hartford will be replying.
To whom?
It Reply.
Does it have the route to 10.5?
He doesn't need that.
Because the source will be used.
10.4 when it's coming back.
And this guy is coming back.
The sauce will be used as well.
1044.
Default it doesn't have.
But everything will be leaving from there.
When it hits that interface, only the source will be.
But does it have an.
Who are for four pointing towards it has a default are pointing towards this guy.
That's how it connects to the server.
That's how it's connected to the server, right?
So will it or will it not?
Will.
It should.
Let's try.
It does.
It does go through.
So two sides are also communicating to each other.
Now you can control it using spread tunnel ACLs, by the way, if you're concerned about that, just
use split ACL.
Yeah, it will go through the server.
It has to go through the server because the tunnels are created through the server.
The tunnels.
The tunnels are like that on VPN.
That's how it is.
You cannot have smoke to smoke.
It's always server to client server client VPN.
Right Now what you would have here, explain.
Yeah.
So.
See your packet originating from R5.
How does it look like coming from ten 550 going to ten four, four, four, to be specific.
Let's give it more space.
Then going to ten for four for coming from ten.
What happens to this packet here on R5?
Will it be encrypted or not?
It will be Y will be.
Will it be encrypted?
Because.
Because of the source.
Because the source is 1055 destination.
It doesn't care about it doesn't even know in his routing table where this destination is.
It just knows that the leaving interface is this guy and the crypto map is applied on that interface.
So based on the source, it encrypts it.
The said pair address on this guy is 20.2.
Source will use its own source which is 50 dot.
50 dot.
Correct.
The packet will go through the tunnel and encapsulate where.
Add the VPN server because it's meant for him.
The server will check.
The source and destination.
What is the destination now on the server?
The tunnel is what source based or destination based?
Destination based.
So based on which destination you're going to, it will encapsulate here.
The destination is what?
Ten .4.4.4 from the server traffic going to ten dot four goes through.
Which tunnel?
So it encapsulates it again, but with the source and destination of the second tunnel.
So the source will be 20.2.
Destination will be.
40 dot.
So the traffic goes from this tunnel coming back to 10.4.
10.4 will open it.
Check the source and destination.
It's meant for him.
So it's the packet.
Sends a reply coming from.
What happens to this packet.
The tunnel on the client is what based?
Source based.
Anything coming from 10.4 source will go where?
To the server through the tunnel.
So again, encapsulation will take place.
Source will be.
Destination will be.
Where will this traffic go back to?
Through this tunnel.
Right back to the server.
The server will receive it.
Open it again.
Check the destination.
Destination is 5.5.
Its destination base.
So anything going to ten .5.5.5 will be.
Encapsulated again.
Using what destination address?
Source as.
So the traffic will go back to.
So you'll see when you send this traffic traffic on the VPN server, you'll see both the tunnels will
be showing increase in the packets.
How will you check that?
You send traffic again.
But you wouldn't be able to bring the Internet.
What just happened?
I wouldn't be able to do what?
If I use the source, I wouldn't.
I have control over my source.
Right?
You won't.
With the loopback, you won't be able to because it'll be encrypted.
Easy VPN.
But you have to understand with the network extension mode is it's not meant for bulky sites.
It's meant for small sites, very small sites, not for bulky sites.
If you have a site like this, a server, you will not use something like this.
You'll use a normal site to site or VPN or stuff like that.
This is if your site is very small and you want to access the services of that site, you will use what
the network extension mode.
Do you understand how it works?
Network extension.
What happens is what I send my networks up to the server.
The server knows about them.
No natting takes place.
Everything is 1 to 1.
There is another mode which is known as network extension plus.
Network extension.
Plus, it's a very new one and it does have certain bugs, but in crypto maps, it works properly.
In DVT, in the virtual tunnel interfaces, it has certain problems right now it should work fine.
So what we'll do is we'll convert it into network extension.
Plus, can you guess what will happen in that case?
Extension plus.
Can you guess what will happen?
See, right now, everything is okay.
You can access anywhere, any device you want.
But there is one slight little problem.
What if from the server you wanted to telnet into R4?
Do you know R4 address right now?
I do not know R4's address.
I only know that there is a network.
1044 .4.0 slash 24.
I don't know specifically what r4's address is.
So if I wanted to manage it remotely, I could not.
502.
For for for that you know right now it's for for for but if you're sitting remotely will you know.
Mean for the server.
I'm only sitting here.
I don't know what address is on the other side.
You said the client would.
A client pushes the whole subnet.
Client pushes to the server what the full subnet if you're only sitting on the server, if you don't
have access to the client, you only have access to the server.
What you can see is 1044 is not connected, is it?
Crypto IPsec client.
Okay.
It's in.
It's in client mode.
Crypto IPsec.
Let's talk about ten, five.
Ten.
Five.
I have access to what?
The full subnet.
If I wanted to telnet into R5, how would I do that?
I'll enable it here.
I will not be able to go there.
Right?
I will not be able to tell anything to our five.
The public.
What is private?
I want you to go through the tunnel.
Encrypted.
I would not know the address to do this.
What you can do is you can go to the site, you configure it not in network extension mode, but in
network Plus.
Mode network.
It'll do both things.
They'll combine both together.
Network extension and client mode together.
So my subnets will go to the server.
Plus I will receive a route or I will receive an address from the pool.
So I will have an address plus the routes.
So if you check show IP interface brief, I have received an address from the pool and if you go to
the server side.
The server has 10.5 as well as the address that has been given to me.
Both things the server will push down and address.
The client will give me what its remote subnets.
In the client mode.
Only the server pushes down an address in the network extension mode.
Only the client brings up what its remote subnets in network extension.
Plus both things happen.
I'll give out an address.
The client will give out it.
Give out its.
When I telnet I'll be using 192 168 .1..
This is only for remote management.
It will not make any difference on the client side.
Show crypto.
IPsec SA will be the same.
10.5.
And 192 168, but two different essays.
192 And that both will use two different tunnels.
Two different IPsec tunnels.
One going to 192, 168, 1011, one going to 10.550.
Even from this side you should be able to see that crypto IPsec sa include include.
Check it out.
Two tunnels.
One going from ten .5.5.0.
The other going from where?
We are going from 190 to 168 dot.
Line will be using the ten dot, obviously.
10.5 will be coming in as 10.5.
But everything else will be.
This is only one channel only there for remote management.
That's it.
It's there for nothing else.
Only for remote management.
Okay.
Do you understand the difference between them?
Network mode, client network extension and network extension.
Plus three clients together.
Right now our focus is in client mode.
What happens in client mode is the server gives out an address.
So there's an IPsec tunnel on the client side saying anything coming from the source of 192 one 6810,
basically this loopback.
Anything coming from this source.
192 168 10.10 should go through the tunnel.
Now what happens is these users also are supposed to go through the tunnel.
So what happens is their address is patted on 281 68, 10.10.
Once they get patted, they go through the tunnel.
In client mode.
In network plus network extension mode.
No address is pushed down, a tunnel is created.
But what the client does is it pushes out, which is up its own addresses.
So in the server mode, the server knows.
Ten .5.5.0 slash 24 is through the tunnel, so when the server has to send traffic to ten .5.0 network,
it will send it through the tunnel and the client side.
Anything sourcing from ten .5.5.0 will go through the tunnel.
The difference between the two here, anything sourcing from 190 to 168 10.10 will go through the tunnel
on R5.
Anything sourcing from ten .5.5.0 will go through the tunnel.
In network extension plus.
The client will send out its address, plus the server will also give out the loopback.
Two individual tunnels will be created.
One will be sourcing from 190 to 1, 68, 10.10.
The other will be sourcing from ten .5.5.0 slash 24.
Even from the server side, anything going to 1092 .168.1. ten will go through here.
Anything going from ten .5.5.0 will go through.
This.
Network extension plus.
Here.
But there's another thing.
There's another thing.
Do you remember?
I would have to connect my.
BC for this to connect a PC.
To connect a PC to.
Let me explain how that is done.
You get a host here.
You double click on that.
Host Sorry, Configure that host.
You have so many different adapters, right?
You could use any one which any one of them, but I would recommend you use the one with the loopback.
If you don't know how to create a loopback, just open any YouTube video.
How to create a Microsoft Loopback Adapter.
All Windows 7, Windows 8 or anywhere.
You could create a Microsoft Windows Loopback adapter.
For this.
That's because for the loopback.
That's because your PC has certain privileges.
Reduce the security of your PC.
And we use VMware.
Yeah.
Can.
It'll work.
Yeah.
It'll work with the VMware adapter but it's recommended you use the loopback one.
So, yeah.
You can use any one of these adapters as long as it's a virtual adapter, you can use any one of them,
but some people might not have VMware right now.
So Microsoft Loopback adapter will also work.
Right.
You go here.
Now.
You need to choose an address for this adapter.
Write any address here?
I'll choose 150 .1. let's say 30 dot 25.
Yesterday I used.
Am I using 30 anywhere?
40 and 50.
I'm using 30.
I'm not using.
30, 20, 40 and 50.
I'm using.
151 point 30.25.
Now this.
Okay.
I want to show you the I want to show you the loop, not the loop back.
I will show you the VMware, how to attach it to VMware.
Some doubt with the VMware.
Let me explain how to do that now.
VMware.
I have Windows XP here.
Right.
I'll power it.
Power it on.
Let me explain how this works.
VMware is a virtual machine.
It has two adapters.
Two adapters.
These adapters are VM zero VM, let's say eight.
Now these are virtual adapters.
Your machine is running here.
Your actual XP is running here.
This XP.
This is the box.
Right.
These adapters, half of them belong to your PC, which is right here.
The actual PC, which I'm working on the desktop, which I'm working on, half of the VM belongs to
whom?
My PC.
My PC is interface.
Half of it belongs to the VMs interface.
The VM machine's interface.
Just like I have a physical adapter here.
Half of it belongs to the physical.
Other side, wherever I connect it to, the other half belongs to me.
Same way here.
Half of it belongs to me.
But it's virtual.
The other half belongs to the VM box.
XRP has only one.
Adapter.
Local area.
Right that I will connect to what?
VM zero.
I'll connect that to VM zero.
How to make that connection.
Let me show you.
It has only one, right?
How to connect it.
You go here to the settings.
You say, okay, XRP is.
Whatever XRP is inside local boxes, I want you to connect it to net zero.
Right now?
No, it's host only.
It's host only means it is not connected anywhere else.
Post on.
Yeah.
Do it.
Do it for host only.
Make sure you do it for host only.
Right.
How do you do?
Host only go to net editor.
Let it be there.
You just choose an adapter.
Whatever adapter you have out of all of this, choose what Host Only if you choose bridge, you can
bridge it to a physical port and connect it somewhere else.
That is done when you connect connecting a server.
But right now I want to use it as a host.
Done.
What I've done is I have bound my exp2 VM zero.
Now what I'll do is I'll open.
What?
DNS.
I'll create a PC That PC.
I'll join.
Where?
Two zero.
That PC I'll also join to.
Now this VM zero is acting as what, a switch in the middle of your DNS and your XP machine.
On this end, I'm going to use the address of 151 .3. ten from here I'm going to use 30.25.
Now this address in the middle can be anything, but it has to be on the same network.
It'll be acting as a switch in the middle.
Right.
Because one end is connected to one end is connected to gas.
Here you could have anything.
Now, the good thing is, since it's a part of this PC, this PC right here, if you open cmd here.
And you think you should be able to pick XP.
You should be able to pick GM's.
Why?
Because you're picking from which interface.
When you're on this PC, your net zero, you're pinging this side as well as this side.
We have zero PC now on my PC.
I have XP connected on this side.
I have connected on this side.
They are connecting through me.
Right.
That's what I'll do.
So net zero, whatever address you give, you just have to make sure that it belongs to the same network.
That's it.
This is the switch in the middle.
So this usually I keep it as 151 .33.101.
I use it as 101.
Do not require a default gateway.
You don't because you're connecting those two together.
That's you.
Do you want to go somewhere else?
If I want to go somewhere else, I'm not using this adapter.
Right?
Right now I'm going to the Internet using which adapter?
Yes, in that case, public IP will be connected to the DNS.
You don't need to give it here.
You need to give it where.
On that host.
See, this is a switch in the middle, right?
What is the switch in the middle?
VM zero connected to XRP connected to.
DNS.
You want to go here, you want to go here.
But who wants to go?
This wants to go, not you.
This is me.
This wants to go.
So the default gateway will be given here.
Pointing towards where?
You have to manually specify it on the machine, pointing it towards this router because then it will
send the traffic to the router.
The router will forward it.
This will be nothing.
You will never use this.
This will only be to create your connectivity between and.
Right.
So let's go to XRP.
Let's see, what address do I have here?
XP to the Internet.
Then what will.
Well, then what you will do is the default gateway that you point will be towards VM net zero, VM
net zero.
This is another thing that's called bridging.
You will bridge VM net zero and wireless connection together.
Can I come back?
Can manually bridge it.
Or you can just use the nat.
You could use bridge connections here.
Whatever.
I.
Yeah, see whether it works or not.
Also, you can connect to the internet.
Suppose if I block it?
Yes.
If you check my video for Asia in Asia, I have my video for MPF.
I've done it.
I've used Firewall in the middle.
The internet connection through the firewall.
Then whatever I'm blocking on the firewall, my PC is also getting blocked.
You won't be you won't be able to certain websites and stuff.
I blocked it using that.
You can see there.
I've done it.
I've shown you how to do that.
For now, let me just fix this, because we are running out of time.
When I'm using.
Host only is VMware.
I'm saying that I'll choose this manually wherever I want to do with this.
I'll do I'll do this manually.
If you use bridging, it means you are binding it to the physical port.
If you use Natting, it will Nat with the internet interface.
Whatever interface is taking you to the internet, you will get nat it onto that interface.
This is fine.
30.25.
Next stop is 30.10.
The only one problem I might run into is.
DNS will not have enough interfaces for me.
So what I'll do is I'll just remove this.
I'll attach it here.
If I don't need that client, I'll use this client.
Was it blue back?
I don't remember.
Let me check.
I don't remember.
Lubeck should be.
It.
Also, if you are adding a loop back, you will see that the loop back will not come to your CNNs.
You'll have to restart it.
You'll have to restart your PC when you install a new loopback.
You have to reinstall the PC.
Sorry.
Restart the PC.
R3.
I need to change the address now.
That's how you restart the PC.
You know, it shows.
I can look back right back or Kim can look back.
It's called Microsoft.
There's many, but the one which you have to do is.
Should.
You should usually.
Does this work?
Yeah.
See, right now, I should be able to pick, what, 30.101, which is net zero.
I can ping net zero.
Net zero on the other side is connected to 25.
So I can also ping 25.
I'm connected to my machine.
What I want to show you here is why I did this is because I want to show you something else the dangers
of using the VPN client.
If you use that, if you use it as I'm using right now, the dangers of it is.
I'm connected.
Don't you think?
Think it's dangerous to connect just like it is as it is.
The information is saved.
Saved in the VPN client.
Anyone coming in just can double click.
And my PC is at home, right?
I have a younger brother, right?
He likes to play around, so he goes in there, he double clicks, gets connected.
Right.
He has access to all the servers.
Go do anything.
Right.
Quite dangerous to connect like this for this.
Plus another thing is, remember aggressive mode.
Easy VPN use uses aggressive mode so the group name and key that you specify going in the third packet
in the third packet.
But again, aggressive mode is not considered to be as safe as main mode because main mode you have
very nice exchange of data, you have first packet, second packet policies exchange here it's very
quick, so it's considered to be a little less safe, the aggressive mode.
So what they have done is they have added another mode, another phase which is known as phase 1.5.
Extended.
We call it extended.
Extended EU also known as Aix en.
Xor.
Extended authentication is once aggressive mode is done, once aggressive mode is done, it will stop
the exchange.
Wait for another username and password.
If you don't specify that, you won't be able to connect.
Won't be able to connect.
The way you do it is pretty simple.
You go to your.
So remember, we did triple A authorization.
Now, I'll also do Triple A.
Authentication.
I'll authentication for login, obviously.
And the name of the list, I'll call it Sha pointing to the local database.
Since I'm pointing it to the local database, I also need to create a username and password.
Right.
How do you apply it?
Crypto map.
I map client authentication list is.
That's it.
Three commands.
What?
Create a list.
Bind it.
That's it.
That's all you need to do.
Create a list.
Bind it.
But for that list, you also need a username and password.
Just do that.
The only thing is I was crypto map I-map Isakmp authorization list.
Here it's client authentication list.
The only difference.
For authorization.
What did he use?
Crypto map.
I map isakmp authorization.
Right.
I camp authorization here.
It's client authentication.
List.
That was the client configuration.
Done.
Save it.
Go back to your machine.
Disconnect the tunnel.
Connect back up.
Extended off.
You need to specify a username and password.
If you specify it as wrong, it will not accept.
And you see your exchange will be stuck in the aggressive mode.
It will not go to the quick note.
Aggressive mode.
Then that's it.
Stuck there.
Aggressive, aggressive, aggressive.
Then stuck doesn't go to the next mode.
You need to specify the username and password.
Cisco and.
Now it connects extended are very important.
Very important to implement.
Now how about the client side?
How about router as a client?
How to clear the tunnel is clear.
Crypto IPsec Client.
It will clear the tunnel.
It's correct to say it tries to connect automatically.
What does it say pending x auth request please.
X auth.
First, provide your username and password.
Until then, you cannot log in.
Right.
So you have to provide your username and password for all the days that is missing.
How do I do that?
Use this command again, not in the global configuration mode in your user privilege.
Cisco.
And you connect up.
Extended are useful most of the times in the client mode in the VPN client.
Claire.
Any questions?
Any questions with this?
I know there's a lot again, a lot advanced, right?
There's a lot of things happening.
For the land, anything.
Right?
We wouldn't we wouldn't do the.
We wouldn't do this for the land thing.
No.
Yeah, you can do it on the land thing.
See?
To make it easier for you if you right now have to whenever I connect.
Right.
Somebody behind Apple is gone.
He doesn't need to connect.
Only R4 connects.
R4 doesn't need to connect.
R4 connects when they send the traffic it goes through.
It will remain like that.
Now, see, last one last thing is whenever you try to connect, it will give you this pending request.
Right?
I didn't show you the Verification Command Show Crypto IPsec Client.
Easy VPN will show you your client VPN.
Your current state is you're stuck in.
Request your interface inside interface Outside interface in the pair it shows you right save password
is disallowed.
What you can also do to make this work is you can go to crypto IPsec Client.
Easy VPN Easy.
Not say password.
You could use your username.
What is the username which you're using on the server?
The password is.
Yeah, but this username and password you put where on the client.
What username and password will you use to connect up Cisco?
Cisco And there's also another command which is x auth.
User id is saved.
Where mode local.
See right now I'm using.
What?
Exactly.
So whenever I'm getting X is telling me what pending x auth request.
So whenever I have to connect up, I have to first go what?
Do what first?
Copy this request, then use the username and password.
I don't want to do that all the time.
What if the tunnel goes down?
I have to go back and connect up again using that.
Right.
So what I do is I go to my crypto configuration client VPN, I put the username and password, which
I want to connect up, and then I use the command x auth user ID mode.
Local means my username and password is saved.
Where locally?
The one which will be used for.
One more thing that you have to do is you have to go to your VPN server.
Crypto Scam Client Configuration Group.
What was the group?
Sales.
And here you say save.
The clients are allowed to save the password.
So now you'll see that you will not get that request.
So Crypto IPsec Client VPN.
Clear crypto IPsec client is.
Yeah.
Now we'll go back and create the connection again, Right?
Should not be.
Should not be disallowed.
Show run section.
Say password is allowed.
We're going to.
No client doesn't have this command.
The server has the command.
User ID.
Let me see if the command is.
If the command is in the request.
It is there.
Let's do it manually.
Connect manual.
Clear crypto IPsec client is.
Connection terminated.
Crypto IPsec Client VPN Connect.
Let me do another thing.
Interface Phase zero zero.
No.
Crypto IPsec Client.
I'll remove it.
Crypto client.
Connect.
It's again, this has a lot to do with the iOS.
This has a lot.
There's two things which depend on the iOS in VPN.
There's the Save password and there's another thing Crypto IPsec Client VPN is there's Connect ACL.
So this connect ACL, it also depends a lot on what.
Connect is, say, for example, you want to connect the tunnel.
Only right now it's manual or auto.
In manual, you use the command.
In auto, you don't use the command.
In Connect ACL, you specify the traffic in the ACL.
If you hit that traffic on the interface, it will go and initiate the tunnel.
Right.
Not used a lot of times, but it is an option.
Again, that part is also iOS dependent and the save password.
But that's all you have to do in save password.
There's nothing else.
So in the same password?
Yeah, in the same password.
All you have to do is on the server side.
Crypto is a camp client configuration group was what sales?
You say say password.
Then on the client.
Crypto IPsec Client.
Easy VPN Easy.
Is a username.
It's Cisco.
Password is Cisco then x auth.
Mode.
User ID.
The username is created on the server because I'll be sending it to him.
He'll be checking it locally.
The client is sending the username and password.
You will be prompted for.
I will not be prompted for it.
Right now I'm getting prompted for it.
I don't want to be prompted for it.
Yeah, I entered it.
I pre-configured right.
Instead of because he keeps on bugging me and asking me for whenever I try to connect, he keeps on
bugging me and asking for the username and password.
So what I do is I just save it in the configuration so he doesn't have to ask me.
Hey, it will work.
It's just the iOS.
I'm sure about that.
Clear VPN.
The split ACL will work exactly the same way as yesterday.
Everything else is the same.
Tomorrow we'll be doing the same thing, the same things that we have done until now.
Client mode, mode extension.
All of that.
Using what?
DVT, SVT and DVT.
We have done.
We have to see what DVT does.
Virtual tunnel interfaces.
What's your talent interface?
Right?
124.