All right.
Before we talk about easy VPN enhanced the newer version of it, we need to talk about this.
Virtual tunnel interface, a special type of.
Called.
DVD.
The D stands for.
Dynamic virtual tunnel interface.
What is the dynamic which return interface?
Until now we have seen static virtual tunnel interfaces.
Well before that, we saw what tunnels were.
Right?
How would you configure a tunnel?
Create a trial interface.
They'll have something like this.
This will be your tunnel, right?
You go here to R1, you'd say something like this.
Tunnel zero Interface Tunnel zero.
Dinosaurs.
The public address.
150 112.1.
Final destination.
151, not the remote address.
And you could also specify the IP address.
Is 192 168 .1.1.
Correct.
You would do that.
Then on the other side, this is a graph, a simple graph.
Do the same here.
This will be 1.2 and source and destination would be the worst.
So from the other side.
This would be your source and destination.
Right to change the mode.
You'll just go tunnel mode IPsec IPv4 and protected using thermal protection.
That is not the main point right now.
What I want to explain is this tunnel that you have, if you're using it as a static tunnel and you
just do that.
IPsec.
IPv4.
Since you've converted it into an Svi, you would also require what tunnel protection?
AP.
Because now you won't have the header anymore.
Anymore.
So you need these two commands to.
To use the SB as a header or a.
For the ESPN says you're starting your IPCC.
Now if you have these two.
Working like that.
It's fine.
This is an.
Right.
Well and good.
I'll try to use this in my VPN also.
But do you remember easy VPN?
There was one problem.
What was the problem with these?
I get it.
I did not know the IP address.
Of what?
Of the other endpoints.
I did not know the IP address of the other endpoint, so that means I don't have a tunnel destination
First problem.
I don't have a tunnel destination.
Apart from that, there is also another thing.
What is that?
Let's say I have two different departments.
One is sales.
One is it?
One in sales and one is it.
Both of them say, for example, when a sales guy logs in from home.
I believe in here.
Interesting.
There was interesting graphic based on the tunnel IP address.
The source in the routing table, whatever is going through that interface goes through the tunnel.
You know, like, let's do this first.
Let's go to R1.
Copy this.
Interface Channel zero IP Address 192.
Kernel source 20.
Final destination.
This part.
We didn't have.
It's not.
Change the tunnel mode because then I would require tunnel protection.
So I'll just use.
The more I.
Of the more.
Jerry.
I.
No tunnel protection.
I will not use any protection.
I'll just create a normal tunnel and make sure that one side can ping the.
How does the ping happen?
Because, see, this is important.
When you go to your routing table, you see that you have that address, you have that source address
in your routing table, whatever IP address that you specified that address in your routing.
Anything that goes through the tunnel, it will go to the running configuration, use the source and
destination as the public header and take it to the other side.
A simple, static tunnel.
Right.
The problem imagine now with.
With your.
Easy VPN is okay.
I understand that I have one say sales guy.
I'm giving sales people the address from the pool.
19221681.0.
Marketing.
I'm not giving them 1.0.
I'm giving them 2.01921682.
So I can differentiate that these are sales people and these are marketing people.
Hey, where am I making that differentiating section here?
Let's say this is the server.
Let's say R1 is the VPN server.
Does that mean if I use IP address 1921681.1.
Does that mean it cannot communicate to, for example, the other endpoint?
I'll give it 2.1 or 3 dot one.
Right if it's good.
I'm actually trying to say is give me a second.
Let me.
There you go.
So in VPN, if you remember the other end point of the tunnel, whatever you specify.
Is given by whom?
The server pushes it down.
It pushes it down, right?
So yesterday we pushed down 192.168 .1. ten today.
Let's push out 1.1 for example, or one dot ten to the other End point.
Okay.
My endpoint is also 191 68 1.10.
So I can communicate to each other to the other side.
What if what if now it guy logs in when the IT guy logs in?
I don't push out 1.10.
I will push out.
What?
Two that.
The problem that will happen in that case is what is my IP address?
1.1.
The other end point is what?
2.1.
Both ends of the tunnel will be at different addresses, different subnets, so they would not be able
to communicate to each other.
Right.
Do you understand what I'm trying to say?
I'll push down the other end point of the other end point.
IP address is pushed down from the server.
From the pool.
For sales.
I pushed down 192 168 2.0.
For marketing, I pushed down 190 to 168 3.0.
What does that mean?
That means my endpoint IP address cannot be constant, cannot be static because I'm not only pushing
down for sales, I'm also pushing down for I'm pushing down different subnet addresses.
For some.
Sometimes I'm giving out.
2.03.04.05.0.
That means this side, this end of the tunnel cannot have a static IP address.
Then what can it have?
If it cannot have a static IP address, it can have something we call it.
Give this address using your go to interface channel zero, not IP address.
We call it IP number.
It's called IP, UN number.
And then you have to specify the IP address of an interface.
Now, this interface can be anything.
It does not make any difference at all what this interface is, right?
It could be I could create a loopback, I could give it any address.
IP address.
1.1.1.1.
Right.
So when I go to my interface Channel zero, I could say IP unnumbered.
It doesn't have an.
I'll explain.
Now, if you see your show IP interface brief, you'll see your tunnel is up.
The method that you gave the IP address is not actually TftP.
It means you have not done it manually.
The system generated it for.
For this interface.
If you check your show run interface, Channel zero, sorry, show Interface, Channel zero, you'll
see that it says interface is unnumbered, meaning interface does not have an IP address.
It is borrowing the address of what?
Loopback zero.
Why would it need to borrow the address?
It doesn't borrow the address.
Actually, what it borrows Is it because if you don't have an IP right, this tunnel has to be IP tunnel.
Basically, the IP stack on this tunnel should be up.
Otherwise it won't be able to communicate.
Right.
So but you also have to make sure it doesn't have a static IP address.
IP unnumbered does what from loopback zero.
It takes the IP stack so that it can have IP functions of this tunnel.
Just the stack.
The IP address is not used at all.
There is a shocking thing that you'll see in the routing table.
If you go right now, show IP route.
You see that the address?
The tunnel is not here.
From here.
You don't see a tunnel.
It's completely empty.
Then how do you communicate?
The question is, how do you communicate?
Empty, right?
You don't see anything here.
The way you communicate is you use static routes.
So I could say 192 168.1.3.
Is from Turner.
In the routing table we use unnumbered because unnumbered is not an IP address.
It doesn't put that information in the routing table.
You have to manually go in there and tell him, okay.
192 168 1.3 is reachable from tunnel zero.
I could also later tell him 192 .168. let's say 2.3.
Is reachable from tunnel.
The other problem is with the destination.
There's two problems.
The source.
The source is fixed.
There's two.
There's one.
Is two problems.
One problem is this destination is not there anymore.
That is not the problem I'm solving right now.
I don't know the destination.
Right.
That is not the problem I'm solving right now.
The problem that I'm solving right now is this part.
The unnumbered part.
IP address part.
What is that problem?
The problem is that the other end point of the tunnel will not always be on the same subnet.
Sometimes it will be using 1.0.
Some other times it will be using 2.0.
Even yesterday it wasn't like it was.
123.1.2.2 at one.
192 still working.
It wasn't.
Buzzer.
That was a crypto map, remember?
That was not a tunnel interface.
There was a crypto map.
It did not have a tunnel source and destination for a tunnel to work.
It's an interface.
Think of this as an interface.
It's a normal interface.
Both endpoints should be the same subnet, right?
What I'm doing from this side is I'm completely removing the IP address part.
This side does not have an IP address.
So when you go inside the routing table, you will not find this route because you don't have the IP.
This tunnel does not have an IP.
So you have to manually go in there and tell him, listen, if you want to go to 192 160 81. anything
1.3, your next hop is through the tunnel.
You also tell him if you want to go to 2.3, your next is from where?
Now, there is no 2.3 right now.
No one has 2.3.
But I could also do is I could create a loop back here.
Give it What address?
That.
So when I send a ping from here to 2.3, it would go through the tunnel because I'm telling it to go
through the tunnel.
It goes to the other point.
The other end point recalculates and reaches what?
The.
Let's first try the first one.
If I can ping on 82 and 68 1.3.
Cannot right now.
Show IP Interface Brief.
So interface down I'm using IP unnumbered my source is this my destination?
Is this from here?
Let's check.
To be able to go.
Thing.
192 168 .1.3.
Yes.
The problem that would occur is what source does it use?
When it goes out from the tunnel.
What source does it use?
It doesn't have a source, right?
When it needs to go, it needs to have at least a source address so that the other guy also knows what
this guy is coming from.
Right now, the source that it's using, if you check, we have Wireshark running.
The source that it would use.
Right.
Because this is not an IP, right?
It's unnumbered.
So.
Let's check.
What is the source that is using?
The source that is using is 1.1.
But which 1.1 is this?
Is this the tunnel IP?
It's not the tunnel IP.
It's a loopback.
The borrowed blue bags address.
It's using the loopback address to go.
The problem what is happening on the other side is the other side does not know where 1.1 is.
R3 doesn't know where 1.1 is.
So how would you do it?
You would have.
Its static route pointing towards.
Only three.
For this to be successful.
Not.
Not this address to be rude.
From tunnel.
You're basically guiding this traffic through the tunnel using static routes.
The important point here to note is I did not use an IP address from this site.
To counter that problem, I needed to add a static route telling R2 about the other endpoints.
What are behind.
How does this help me?
This helps me in a way that tomorrow, if the tunnel changes the address to a different subnet.
2.3.
If you change the address of the other point to a different subnet.
All I need from this side is what?
2.3.
All I need from this side is what?
Just to start.
To go to the other endpoint.
This will help me.
Why?
Because tomorrow, When?
When?
Today.
When I'm doing my VPN, later my tunnel endpoints are going to have different subnets for sales, different
subnet.
For marketing a different subnet.
For a different subnet.
All I need at that time is.
Install static route towards those destinations.
How is it dynamic?
According to the requirements.
I'm changing this part.
I'm not changing this part from here.
All I need is a static, right?
And if you remember, we have a mechanism to do that reverse route injection.
It does that, right?
So whenever he pushes down an IP, it will install a static out.
So this part will be solved by dynamic, part will be solved.
Right.
And the other end is also solved.
Why?
Because the IPS are giving according to the pool.
So sales will be here.
Marketing will be here and it will be here using different IPS.
It doesn't really make a difference.
Why?
Because I have a static route from.
Why do I need a static route?
The only reason I need a static route is so that R1 knows in his routing table which traffic to send
through the tunnel.
Traffic going to 1.0 should go through the tunnel, 2.0 should go through the tunnel, 3.0 should go
through the tunnel and so on and so forth.
Otherwise, this information would not be involved in your routing table because you're using unnumbered
links.
Dynamic routing would cause problems.
It does work.
But in that case, this side, if you're using DVT on one side, basically if you're using unnumbered
on one side and numbered on the other side, you would have to keep them in the same network for routing
to work.
Or you could keep both as a number.
Both are unnumbered.
Any network doesn't matter.
Routing will come up because both of them don't have an IP address.
Right here.
It's unnumbered on one.
Only one second.
If you keep both sides on unnumbered, you will have static routes or static routes on both ends.
How does a package route borrowing?
1.1.1.1.1.
I'm going to the other end.
Going to the other.
It doesn't have to be on the same.
It doesn't have to.
It's a simple it's a simple routing routing happening here.
Packet is sourcing from 1.1.1.1.
Destination is going to where?
2.3.
This is your packet goes to the routing table.
What is the routing table?
Tell him.
Through which.
Goes to the ground Zero.
Gets what?
The source and destination attaches that to Gray doesn't have a source and.
It does have this is the source and this is the destination.
Public source and public destination.
In SETI.
Header won't be there.
This will replace it, but the concept will be the same.
Heading toward the Ori won't be there.
ESP will be here instead of gray.
So I didn't use that because then I would have to protect it first and get the ESP.
Yeah.
IPsec will work here also, but the same concept works in IPsec and the IP unnumbered.
Here.
The only thing I wanted to show you is the IP unnumbered.
The is with the ones that did the actual routing.
Yes.
From here.
From here to here?
Yes.
Right.
That is the outside header is done from 151 .15. 1 to 151 .23..
Correct.
The important part again, is to make sure that this site no IP address at all and it does not make
any difference if you have if you do have an IP, if you do not have an IP does not make a difference.
And the.
Right now.
Normal right now.
It's not DVT I'm talking about.
I'm doing SVT.
This one is an SVT, but it's just that I'm making sure that the other endpoint can be dynamic IPS.
Different types.
So I could change an IP here, right?
I could change an IP here.
And from this side, all I needed was static route to those items.
I did not need to change anything else.
I needed a route basically telling this side if you want to go to the other end point, it is through
the tunnel.
Why is this?
Because this side has no IP address so it can form tunnel with any IP address.
Anyway, we want to do it on only one.
I'll explain that also.
Why?
Because the parameters should be the same.
Right.
Decline towards the end point of all the clients.
Yes.
From the client.
According to the one from the client, you wouldn't need that.
Subscribe here.
Here we used it from the client.
If you remember, Easy VPN is source based.
Anything from the source will go through the tunnel, so it doesn't need that.
An easy VPN.
Right.
It's sauce based.
So anything anything that uses the sauce of 10 or 10 in that case will always go back through the tunnel,
right?
All we need to do is tell, first of all, R1 what traffic should go through the tunnel.
We do it by using a static route.
We tell it any traffic going to 192 168 network should go through the tunnel.
Correct.
From the client side in VPN.
All we need to do is we need to make sure that the address is pushed down to the loopback, because
once we do that, anything sourced from that loopback will automatically come back through the tunnel.
Right.
That's what we do in VPN.
We haven't gone there yet.
We'll get more concepts clear then.
But the only difference, the only big thing that I wanted to show you is here.
No IP address.
Why?
So that it can form an IP address with anybody else.
Right.
This is the only point where people have difficulty in easy VPN enhanced.
Everything else is the same as we did yesterday with small minor changes.
Let's do that.
Let's create the new topology.
All right.
So same topology as before.
The difference that is going to be there today is I am not going to use crypto maps.
No crypto maps I'm going to use.
But which.
There are two reasons for dynamic VDI.
Reason number one is I don't know the other destinations.
I don't know the tunnel destination part.
That is reason one.
Reason two is my tunnels, which are going to be created.
There is a huge possibility that one of them.
Maybe, let's say 1.0.
The other tunnel that I create could be.
The endpoints of the tunnel can be on different IP addresses.
How do I tackle those problems?
I don't use an SVG.
I use the dynamic virtual terminals.
We'll see how to configure it when we reach before we go to that point.
Let's configure the normal stuff that we've been doing until now.
Step one.
Always the same crypto camp policy.
Authentication.
Detail and.
Step two.
I would require an ISO compliant configuration group for that.
The first thing I would require is IP, local pool sales pool for 92 168.1..
10.121932168 .1. 2010 dot 20.
I'll create another pool.
The cell call as.
Mark.
So.
Sales pool and marketing pool.
Step three.
I have two different tools.
Right?
Yeah.
I need to change the IP to 20.1 20 dot.
Thanks.
Then what?
Crypto is a scam client configuration.
Sales.
He is Cisco.
One, two, three.
Pool is sales.
Pool.
If I wanted, I could also have a split tunnel.
Copy the same way.
Paste Mark.
And this would be.
Mark.
Yes.
The other one, right?
So Mark Buehrle and Sales, I've done it then for Crypto IPsec.
Transforms it.
ESP three 3ds esp.
So until now, the concept is still the same.
The one thing that you have to add is since I'm going to use an SVG, how do I apply protection to an
SVG?
I would require a profile.
So step five would be transforms that you've done already.
I would also require a crypto.
IPsec profile.
I call it I.
Set.
Transform set.
I would also require triple A new model Y, because I have to say I have to tell my isochem that the
authorization of this network will be done using the list Sha, which is going to.
Pointing to the local database.
Until now, we did the same thing as yesterday.
Except for this one extra step off transform set, which was put in a profile.
Now here is where the difference comes in.
Okay.
Yesterday.
Do you remember?
What did we do after this?
Using a crypto dynamic map.
Right.
I created where I set the transform set.
Then I had a crypto map.
Which make whatever.
I'm just showing you the right so dynamic.
I linked it to the dynamic.
Then.
Crypto map I map.
Then I said.
I said camp.
Authorization.
Then I also said crypto map.
I map.
Client configuration address.
This is what I said yesterday.
Then I applied the map on an interface.
Here, I cannot apply it on an interface here.
I cannot do it this part, but I still need to find out a way to the to do the authorization list and
to use this command where I tell my router that you can push down an address if in case the client asks
for it.
Respond to an address request.
You have the option in the.
Obviously that's how we'll do it.
Not in the profile, but what?
Step seven here is replaced by.
Since I'll be using what?
And as a DVD.
If it was an SVT, I would use it like this.
Interface Channel zero, then IP address and stuff like that here.
It's a DVD.
Now think about this.
A DVD.
What does it mean?
It means that I'll be creating a separate tunnel with this client.
I'll be creating a separate tunnel with this time.
Can it.
Can it achieve?
Can it be achieved with Interface Tunnel zero?
Interface.
Channel zero is only one channel.
I need to create multiple tunnels with multiple clients.
The best part about that is, though, all of these tunnels would have similar characteristics.
All of these tunnels will have almost the same characters.
Right.
Have you ever heard of the word template?
What is a template?
It's like a it's like yeah, it's like a template is like a blueprint, right?
Say, for example, you're printing cards for someone who's getting married.
You'll choose a template first, right?
Then all the other cards.
What will you change?
Only the name on the outside.
You add a label on the label, you just change the name.
So this card is destined to this guy.
But the format of the card remains the same.
So you choose a template.
Then you clone out cards from that template.
Same concept will be applied here.
We'll choose it in DevTools.
You choose a template.
Then sweeties are removed from that template using the same characteristics that you will choose for
that.
You will have to use NP.
People have to come up and register.
It wouldn't work.
This is different.
This is a VPN, right?
You would have an endpoint from that side.
Then you would have to create an interface channel zero IP, and then they will have to come up and
register so many different things that you would have to.
One.
The source is fixing the destination.
For?
Yes, a little similar, but still different because the IPS can also change there.
The IP wouldn't change.
Here, these IPS address IP addresses also are changing.
And plus there the tunnels didn't have remote IPS.
The destination.
Yes, it could have the tunnel IPS cells will have different IP marketing will have different IP.
He was same concept 192 168 1.0.
Then the endpoints were 1.1234567.
Yeah, it was.
That's why OSPF point to point and multi point we had to do right because the same network.
Right here.
First of all, the network can change and there's a huge possibility that the destination can also keep
on changing.
The same guy's destination will keep on changing every single time.
Because when you go back to connect from a hotel, you connect using a different address.
You can go back home, connect with a different address, you can go to a coffee shop.
So in one day you can connect from four different locations there.
That was not the case.
We knew the destination is just that we couldn't map it.
We used an Http.
Now the thing here is you will create something.
Called.
You call it.
Interface.
Virtual.
Template.
And you number it just like you would number a normal tunnel.
You have to specify what kind of a template is this?
What is the kind tunnel basically saying that from this virtual interface, tunnels will be cloned.
Tons will be cloned from this template.
Now what are the common features?
Of this virtual template which all the tunnels will use.
First of all is the source.
Which is 151 .2.2.
Every tunnel will have the same public source from this end.
Tunnel mode will be IPsec.
IPv4 for all the tunnels.
Tunnel protection.
IPsec profile.
April will be the same.
There will be no destination.
That will be resolved as per each tunnel.
So that will be different for each.
I will not change.
I will not put that here because that is the only thing that will change.
Also, I would also require a IP.
Unnumbered not address IP unnumbered because the other endpoints can have different subnet.
IP addresses.
IP unnumbered you can use any one here.
I'll use fast ethernet zero zero.
No, I'm using this this interface address because anyways, I want them to reach this network.
Right?
Not to back any address, any any physical interface, any interface which has an IP address, It will
borrow the IP address from there.
Doesn't have to be a loopback loopback.
I just showed you because I did not have any interface.
It would if you want, it could.
But at that point, the problem would be would be that when our four has it has the root right.
When you install the root, you could have it.
It won't make a difference.
You can use any one here.
There would be wouldn't be any problem because it doesn't read it out.
It needs a root to this network.
All you have to tell him is go through the tunnel.
So wouldn't be a problem at all.
Right.
So this I would copy it.
Always remember one thing.
I need to show this to you also.
I Prof is not.
Obviously nothing is defined.
I haven't copied anything yet.
Right.
Always remember one thing in this because sometimes.
If they ask you this in exam.
An EVP, and they ask you to create a virtual tunnel.
Type ten virtual template of ten, for example, the number should be ten.
And you make a mistake like this.
You forget to use the type tunnel, you just press the enter key.
Then when you try to go back again and change the type of tunnel, it will not accept the command even
if you try to remove it.
You can remove it, but when you add it back again.
Interface virtual template, then type tunnel will give you the same error message.
What I'm basically trying to say is whenever you configure, if you forget the type tunnel.
If you forget the type tunnel, you will not be able.
If you just press the enter key, you will not be able to change the type of this tunnel again.
Whenever you're using virtual templates, make sure do not forget the type.
Otherwise you'll have to restart the the system to get it back.
Now, it's not really necessarily important from production point of view, but if, for example, in
the exam, they might ask you specifically make the tunnel of ten.
What's your template?
Should be the name number ten.
If you make this mistake, you'll have to restart the.
The out and then get it back.
Right.
So always use the type command.
Just food for thought.
Go back to our to.
Now my virtual template is stuff.
Everything looks well and good right now.
I need to just like yesterday, I used crypto maps to bind this together.
I also need something else here to bind it.
Right here.
I don't have a crypto map, so I need to find another way to bind it together.
What is that other way?
We call it.
Crypto.
I say come.
Profile.
To bind everything together.
We use what?
Isaac?
Right.
Let's see.
Let's have a look at these options.
It says a profile is deemed incomplete until it has matched identity statements.
What is what are those match identity statements?
You need to match the identity group of people who are going to be coming in.
When someone comes in, it can come in with a group name of sales and a group name of.
Specifying this is for the client cam profile is over the client.
So I'm saying the client can come in with a group name of sales or it can come in with a group name
of marketing.
The key is already specified in the local database, but I have to tell him that.
How?
For the pool and everything to be pushed down.
Right.
Same as yesterday.
The one which I used.
What else do I need?
Client configuration.
Those things I'm specifying here.
Also, I also need to bind.
What?
For things.
Right.
I need to bind step seven.
I need to bind step six.
Four and five are already bound in seven, so no need to worry about that.
I need to call these two.
Pool is already called in here and I am obviously works by on its own.
How do I call it?
I call it all in.
Where?
In the profile.
The first thing that I call is step three.
Match Identity.
Group sales and.
Mark.
Did I use a capital mark?
Yes.
So my step one, two, and three is done.
I need to bind my four, five and seven, which is already bound together, but I need to call it here.
How do I call it here?
I just call.
Virtual.
Visual template.
So basically telling my process to use virtual template ten to create the tunnels.
Right.
What else do I need?
Basecamp.
Step six needs to be called.
Yeah.
Finally.
Client configuration.
Address.
Which I needed yesterday.
So if you see these two, which I was using with the crypto map, are now used with ICBM profile, the
best way to remember this, if you have to remember if you think you might have a problem remembering
it, first of all, is to follow the steps.
Follow.
One, two, three, four, five, six, seven, eight.
It's easier.
But the other way, if you can do that, is to go from down to up.
Remember what you have to do here.
It will make you do the rest of the stuff.
First thing you call is group sales.
So you remember that you need to create the group sales, you create the group sales, and you do that.
You need what, a pool.
So you'll create the pool, right?
Then you go to virtual template.
And now you know you need a virtual template.
Then when you're configuring it, you know, you need to protect it.
To protect it, you will require an IP profile.
For that, you will require a transform set.
Then you go to authorization list.
For this, you would require a new model and list should be pointing to the local database.
Or if you want to a triple A server, then this obviously you'll have to use on your own kind configuration.
Address this spawn.
Done.
I've already copied it.
That's it.
That's all you need to do on the server side.
What about the client?
Same as yesterday.
Nothing changes.
Crypto IPsec Client Easy VPN Easy Connect.
I can profile.
You don't need to map it.
IPCC.
That's an eye to.
That tonight.
We do not.
Here.
You don't need to see here.
Who's going to kick start the process?
But.
IPsec profile is in the virtual template.
With iSight camera.
Right.
So when the packet comes in.
The good thing about it is the packet will be coming from where?
From the client.
In that packet.
Your policies will be negotiated in that packet.
Group name and key will be there.
So all that information will already be coming from down.
You don't have to initiate the tunnel from this end.
Right.
So interesting traffic will come in from there first and then the negotiation will take place.
Let's monitor this link so you can have a look at the packets to.
If this is done again, the client side.
What do I do?
Connect Auto mode Client.
Right connect to mode Client peer address is 151 .2.2.
Same as yesterday.
Group Sales key.
Cisco 123.
That's it.
Right?
Interface fast Ethernet zero zero.
Crypto IPsec Client VPN Easy outside interface loopback zero.
I don't think I have the crypto IPsec client an easy.
The moment you do inside is going to go in and try to create a connection.
It's up.
Hey.
The same thing as yesterday.
Aggressive, aggressive, aggressive.
Then.
Quick, quick, quick.
Nothing changes unless up as it was before.
If you check your IP interface, brief blue back 10,000 has been given the address of 192 168 10.10
if you check your show IP route.
In your IP route.
You don't have much, you don't have any information.
But what do you have that information?
IPsec Anything?
Source from 10.1, 10.10 will go through the tunnel.
Now, the good part about this VPN is called Easy VPN enhanced.
The best part is you don't have to do RRC.
It's automatically done.
Reverse route injection.
It's automatically embedded into the system.
So if you check your R2 and you do your show IP route, you'll see a static route has already been installed.
Using what?
Virtual access to what is a virtual access.
Virtual access is a tunnel.
These are tunnels which are created from the template.
So you have a template from the template.
You clone what virtual access?
So if you check show interface.
Virtual access to.
It says it is unnumbered.
It is using the address of F0 zero.
So it's not having an address at all right now.
Encapsulation is done.
It is access.
Cloned from what?
The source is 20.2.
The destination which the virtual template did not do, did not know.
Now I know the clone knows is 40.4.
So whoever came in with the second packet, who came in with the second packet after.
So it took its source address, used it as a clone the moment it received that part, or that is what
is missing.
That is the only missing piece of the puzzle, the destination address.
And the guy comes in and registered with that.
So I got it.
I took it, used it as the destination.
My tunnel is up.
Also, one more thing that you'll see is a lot of people have confusion here.
If you do show IP interface brief, you'll see that there is a virtual access one.
Just one second here.
Hello.
Ah, yes.
You will see that, first of all, your visual template always stays down.
First.
The first thing virtual template will always stay down because no traffic goes through it.
Another thing is you'll have a virtual access one.
Which will be there and you'll see that it will have no address at all.
It just creates this to see if the clone is working or not.
It's not used for anything.
When you have virtual templates, virtual access, one is created to see if the cloning is working or
not.
It will not have a tunnel destination.
It will not have anything.
No information at all.
The first virtual access which will be working with will be virtual access to.
Right.
Source is here.
Destination is here.
Which type of tunnel protocol transport you're using?
IPsec IP.
You're not a tunnel.
You're an IPsec tunnel.
And the other stuff is the same.
What?
Queuing strategy?
First in, first out.
Your packets coming through and going through the tunnel.
Let's try to send some traffic through the tunnel from here.
First, let's check the IPsec from here.
So, Crypto IPsec, is anything going to the destination of 192 168?
10.10 will go through the tunnel.
All I need to do is set static route to send that traffic.
I do have a static route to send that traffic.
So right now if I send traffic to 192 168 10.10, I should be able to.
Right.
So should 10 or 10 be able to send traffic to ten, 11?
11.1.
Not right now.
I'll have to use which source to back 10,000.
So I can go to ten, 11, 11, one, ten, 11, 11, two, ten, 11, 11.6.
Because it's a source based on.
Right.
What about the loopback?
Can I use loopback zero.
Again, the same concept.
Nothing.
The concept is the same the users who are behind here.
Ten .4.4.0 slash 24.
Since I use this interface as my inside and the public interface as my outside.
What is happening?
Nothing is happening from inside to outside.
And when it comes to that source is used as 192, 168, 10.10 Source base tunnel, go straight up.
Let's go to R5 and use it for marketing.
Interface.
Sorry.
Crypto IPsec Client VPN is.
Mode.
Client Connect Auto address is 150 1.1.
This is where I decide.
Group Mark.
He.
That's it.
I'm going in with Mark.
Interface zero zero Crypto IPsec Client.
Outside the Facebook page zero Crypto IPsec client is.
I've only given.
And you only give Only Yes.
For one client.
One group.
One group because one IP, right?
One IP right now at one time on an easy if you have an easy VPN client as the software, you can have
two, but you at one time you can only connect one of them.
One time, one IP because one adapter only write only one loop loopback 10,000.
You would need different different authors.
Yes, that would make sense.
Right?
One router will only be in one group.
This will be sales router.
This will be marketing because people behind our marketing or sales, you cannot have sales marketing
sales behind the same router.
Right.
So if you check right now, what is the IP that I've received?
20.10 show IP route.
I have no information in my routing table, which I don't really need because I have the information
where show crypto IPsec RSA, which is anything that source from 20.10 should go through the tunnel.
So wherever I whatever I do.
If I'm using the source of.
10,000.
I'll go through the tunnel if I'm also using the loopback of zero.
I can go through the.
Can I go to?
Where am I going?
This is not the servant.
I'm going to ask for.
From the server.
I'm going to ask for the other end point from one end point to the other.
End point through the tunnel, through two different virtual accesses.
If you check from our to show IP interface brief, you see another virtual axis was up.
Right?
So now earlier it was only virtual access to now you have virtual access.
Three.
The IP.
This is not an IP.
Don't think of this as an IP.
This is unnumbered.
This IP is not used at all.
The only important part is you should have a static route.
Ten, not ten, is from virtual access to 20.10 is from virtual access.
You just need to tell the routing table if you want to go to 10 or 10, which virtual access to use
if you want to go to.
It automatically does it reverse route.
It automatically injects it.
Right.
Clear.
Same as well.
The.
Yeah, same.
We are not giving reverse route.
But now you're using VPNs, right?
Earlier it was crypto maps on here in in.
What do you mean benefit here?
Watch your tongue.
It's more scalable, more scalable.
If you remember, are more scalable than crypto maps.
Tomorrow, if you might need to send multicast traffic, you wouldn't have been able to do it with crypto
maps.
You can send multicast traffic here.
There.
It was not possible right here.
All you need to do is a route through the tunnel for that multicast address.
It will go through through a crypto map.
It doesn't go through.
So I need to ask.
In crypto maps.
It will not.
Here it will.
SETI is crypto multicast.
Traffic goes through.
Remember, you can run routing also.
So if there is a possibility that you do need to do that with Etis, you can do that with crypto maps.
Not possible.
It's not as scalable and this is easier to manage.
Because now you have virtual access.
Is it possible for the other one?
We?
You guys wouldn't work in that.
It wouldn't work in that in crypto maps.
It would not work in any situation.
It would not work here.
It would buy it wouldn't work because we are I mean, it has to be.
This would be a problem.
Yes.
But that is not only not only ACL crypto maps by default, they do not allow.
If you're applying crypto maps on interfaces, they do not allow what I see your multicast traffic to
go through.
How does it work?
It's not allowed.
You can just any anything.
Just if you have a multicast traffic, all you need to do is from the server side.
What do you need to do?
IP route to 20 400 ten.
From virtual access.
You cannot give virtual access.
Yeah.
Virtual template.
Know the route which you have to give in that case is see what I could do.
I could run a routing protocol EGP.
Then I could say network 192 168 .1.0.
August.
I suppose it's starting from 192.
Yeah.
You can't have a show from 224 to 1 to one.
It won't work.
But why can't it work in.
How will you give the ACL?
How will you send the traffic?
How will you tell him to send?
See, it's when you send.
When you update it.
Right.
It will go to 224 001 from the server side.
How will the traffic come back from the server side?
It's destination based.
Right?
Anything going to the destination of 192 168 10.10 will go through the tunnel.
Where when it comes back.
But the source will not be the source.
Your destination will be 224.
The multicast traffic destination will be what?
Coming from the server down.
The destination will not be 192 168.
The destination will be 220 400.
Right here.
It's a tunnel, so it can go through the tunnel.
Can I?
Can you give a fool like I feel?
Multicast.
You will use pool as multicast address and on the other side you will use.
I don't think why you would do that.
I think why you would.
But you can try if you want.
You can try and check if you can give out addresses on to 24 through the pool.
Right.
But I don't think.
Why would anybody use that?
Right.
Just to try.
This is a substitute.
Why?
Because I ran it here, right?
I'll go to R4.
I'll say router one.
I'll say 192168.9.0.
Order summary.
Bag zero.
Okay.
Right now it will not work because why the client side?
I'm not running a I'm only running a from.
The server side is only a virtual tunnel interface from the client side if you check.
You don't have a it's a normal IPsec client from this end.
If you have a look at it for this to work, you will have to use a also from.
The client which you can use.
How will you use it?
You create an interface virtual template, anything.
This name does not matter type.
You change the mode to tunnel mode IPsec IPV four and give it an IP unnumbered address of let's say
loopback.
Blue bag zero.
And then when you do your crypto IPsec client VPN easy here you'll say virtual interfaces.
Okay.
She'll go down.
We come back up again from virtual access.
So show IP interface brief.
Now you have a virtual access of two from here, also using 11.
So show IP, IP interface.
Now it's running on the virtual access.
He.
And not zero.
Right?
The interface grease.
I have to use it.
Yeah.
With.
With the unnumbered.
You can.
There you go.
Neighbor is.
Our neighbor is.
You wouldn't usually do this, but just to show you that Multicasts are going through, usually you
wouldn't do this because you wouldn't need to.
You can always through VPN, everything goes.
With what?
IP address?
Let me explain with unnumbered.
With unnumbered.
What you have is if you have two interfaces, both are unnumbered, so both don't have an IP address.
If you send IP traffic from here to 220 400 ten does it have an IP from here?
No.
Does it have an IP from here?
No.
If it receives multicast from both ends does not matter from which source it will form a neighbor.
Does it have to be directly, directly connected?
Does it have to be?
You can have two different networks because they're not networks.
These are not IP addresses.
They're not considered to be IP addresses.
There's actually a document on it if you want to read it.
How to do this.
It's where it's called.
It's unnumbered, right?
IP number.
You didn't understand before.
The same concept.
If you have unnumbered on both ends.
Yeah, there's IP and IP unnumbered.
What we are doing right now is IP unnumbered and IP unnumbered.
Both sides are numbered.
If you do and numbered from this end, this is 171.68.0.
This is 172.
So two different networks.
Right to different networks does not matter.
They will form neighbors.
Why?
Because the multicast that you're sending, your source will not be affected.
The other guy will not will know that it's a copied source.
When he sends you the address, it will know that it's not a it's an unnumbered source.
They will form neighbors.
You wouldn't usually do this.
Why?
I showed you this is because I wanted to show you how multicast traffic can go through it.
So now you have more visibility, more control.
More than your crypto mouse.
Right.
Then.
So how will you do a virtual interface on your client side?
You say crypto.
I'd be sick.
Client.
Easy VPN.
More client.
Connect Auto.
Then what group?
Mark T Cisco.
One, two, three.
And what else?
Peer to peer.
One 51.21 For the interface, what you will do is interface virtual template type tunnel ten.
IP.
Unnumbered.
Whatever.
But this was not like, you know.
Yeah, it's not required.
But if you have to do it, you can do it this way.
IPsec Profile.
No, not.
Not IPsec.
Just change the mode.
That's it.
And call it where?
If you want to have virtual interfaces on both ends, sorry is on both ends.
You can do it this way, but not really required.
You wouldn't usually do that.
Most of the times you wouldn't do it.
Hey, if you want to send multicast from both ends, you will.
So copy it.
And then.
Your template?
Yeah.
This is which mode?
Client.
This is the client.
What else do I need?
Oh, which one?
Its routing protocols, we would network extension.
You don't really need that because it automatically does it for you if you try right now.
Multicast map?
No.
Did you see when I sent the multicast traffic?
From the neighbor.
I just formed a neighbor.
It was not possible with crypto maps.
Right.
So you can do it here with clients.
It is a little unstable probably because it's enhanced is not that form.
This neighbor will sometimes it is unstable.
It might go up and down right from both ends.
Not yet completely stable, but there is a possibility normally.
Do we?
It's not meant for that.
It's meant for VPN client.
The remote client which you use to connect up from your home is meant for that.
This is only so that now you can enhance it.
You can.
People from inside can also come through.
From the server behind the server.
You can.
Exactly.
So from the client, you just need to connect up.
It's just like one part of your company is connecting up through the internet.
It's still a part of your company connecting up through the Internet, through a different address.
So you are maintaining a you're just connecting it directly.
So it's just another part of your company connecting up.
But this remote.
So you connected remotely.
Right now.
I'm sorry.
Not really.
If we need routing, see why we use use this.
I told you this yesterday.
Also we would use it.
Yes.
It's an internal no, no.
He's talking about routing to exchange these networks.
But do we.
He.
You wonder.
Do it.
Not through the Internet.
It's on the tunnel.
Through that.
It's not on the on the internet.
You would.
But the thing is why we use VPN mostly is because we use it on small sites.
When you have small sites on the other end.
We don't need routing.
You can just network extension in network extension.
You can just put those routes in there and forward it automatically to the other side, right?
If you have huge sites, then you would require something like dmvpn.
The problem here is what happens if this is a dynamically changing IP Every day it changes.
If the IP changes every day at that time, you wouldn't have a choice.
Very low.
I mean, the scenario is very low possibility of that happening because the site usually has a leased
line.
But let's say your leased line is down and you use a broadband connection, you use a broadband connection,
your IP keeps on changing every day.
Lee's line is when you go to a service provider and you buy an IP address.
Do the same.
When you see point to point, the point is completely different.
Point to point links are serial links.
Nowadays these lines, you don't get them by serial links.
Now you get them as fibre links just by five.
Earlier you used to get it as serial links.
So point to point links.
Now you get it at fibre links fibre to the home.
So they bring it to your apartment.
From there you get a line straight in.
Please line means when you purchase an IP completely for you, there is no download limit or anything
like that.
They give you an IP address.
Right with the other one.
With the broadband connection, you don't have an IP.
Right.
So they keep on managing whatever is free.
They give it to you.
Whatever IP is free at this point, they'll give it to you.
Not the same.
Your IP will keep on changing.
Gonna find this one?
Yes.
In broadband.
Point to point is link.
Type.
Point to point is a link type.
There are two different domains.
Lease line is something else.
Lease line is when you go and type of connection that you have to purchase and you have actual physical.
Lehzen is a type of connection that you have purchased from the service provider.
Point to point link is a network type.
Network type point to point, so on the other.
So it's one PC connected to another PC.
Ethernet is not point to point, right?
Ethernet is broadcast.
Why?
Because you can connect it to a switch and broadcast serial links.
You can do that, serial links, you connect directly to each other.
So these are link types.
Difference between link types and this line is a type of connection.
Bandwidth, but how do you get the bandwidth through an IP, a public IP?
You are dedicating to yourself.
Yeah, obviously I have to take a bandwidth.
You have to take these line per bandwidth.
Sorry.
Bandwidth.
Yes.
And but how will I give you the bandwidth through a static IP?
A static public IP you purchase, right?
Yeah.
Purchase a static public IP.
See, for example, this place, the host.
You.
Simon.
I would.
This line doesn't look.
It's a concept.
This line is not a physical link.
This line is not a physical, it's a connection.
When you have you go to a service provider, right?
He gives you connections, broadband connection.
A good broadband connection or a leased line connection.
I can say one.
Can I have a B.S. degree?
Lehzen is your connection to the internet?
When you purchase a public.
When you have a side to side connection.
A you don't usually by a side to side, how will you have.
You will have direct connection.
No, you will have it from the ISP, right?
Cereal is a kind of a link.
Cyril is a kind of a link.
So a link if it's using if you're using a serial link, it'll be point to point link.
From.
Yeah, that is.
That is way too expensive.
I do way, way too expensive.
Through the service provider, he'll give you a direct link from you to him, but way too expensive.
You were saying?
Which one?
And the one which you say, for example, I want to have a public dedicated public IP.
What do you call that?
I'll explain.
This company which which we are sitting in right now, they have a public address.
Why do they have a public address?
Because they are hosting racks online.
They have to access the Internet, so they're accessing racks online.
So when they went to the service provider, when they purchased a connection, they purchased the leased
line.
It was called the lease line when they purchased it.
And they give you now these lines, they have costs 40 Mbps, 60 Mbps.
That'll be how much connection is dedicated to you.
It's not fluctuating.
It's a dedicated 40 Mbps line to you, to the Internet.
A dedicated phone line to the Internet, so it will not fluctuate.
So whenever you try to download or upload anything, you'll always get those 40 Mbps or 20 Mbps.
Now, depending upon what bandwidth you're purchasing, that bandwidth will your cost will change.
Based on that bandwidth.
But the IP that you get, yes, the bandwidth is constant.
Not from your side to another side from you to the Internet.
This bandwidth will be constant.
Right.
That's what you're trying to say.
Right.
But when you buy this, you will also have a static IP address.
Your IP will not change because that's how you host tracks online, right?
I cannot tell students today that.
Okay, your address today is something else.
So tomorrow I'll give them a different address.
This address will also stay constant.
Correct.
Right?
Right.
I mean, I don't know what frame relay was used before.
Frame relay used to use serial links.
Frame relay replaced.
Now.
Mpls replaced everything.
Yeah.
What you're talking about is.
No, that's a different case.
What you're talking about is you're talking about when you when you connect to companies directly to
each other.
That was done before.
This was also called a leased line, but this was leased line for what?
To connect two parts of the companies together.
This was a concept used way long back, but it's still like I mean this and point to point it was point
to point.
People buy direct connections from one side to another.
Very expensive.
This one.
What do you call the connection that you purchase?
A direct line.
What do you call that?
If a guy purchases, if I purchase a connection from here to the Internet.
Who's purchasing this?
When you say we, who are you mentioning?
Are you going to this?
And then you'll give it to other people, right?
Then you'll give it.
Your purchasing connection.
From what to what?
You are a company, you are purchasing it from a service provider from one point to another point.
Is that what you're trying to say?
From a fiber provider.
Okay.
And then.
After the.
After that, they are giving it to customers.
I still don't understand what you are trying to get at because what I am talking about, what we are
on topic, right?
What I'm talking about is the connection which a person purchases.
Let's not drift away.
What I'm talking about.
You get my point, right?
What I'm talking about is a connection which I purchased from the Internet.
This purchase.
When a company purchases it, you purchase a static IP, right?
You get a static public IP.
All I need is a static public IP where on the VPN connection, what I'm getting at is these people here
will not have a static IP address.
Their address is bound to change every day.
Right if they have any broadband connection because you will not use private users at home, will not
use anything like that.
Right.
They'll use a broadband connection or they'll connect using their 4G phones or 3G phones or Internet
cafes so their IP can change.
Now, if if a site also has something like that, a broadband connection, but you need to connect up
to people here, but their IP is also changing.
VPN would not be your best solution.
At that point, VPN would not be your best solution.
What would you be your best solution to connect up using easy VPN virtual interfaces on both ends and
then run routing?
Ryan Bolton on the houting will only run because when you have on both sides.
Right?
We don't need that.
But if there is no way out.
Yeah.
If there is no way out for you, you have a possibility.
You can do it here in crypto maps.
That's not an option.
Crypto max, you don't have that option at all.
Right.
Because it's bound to an interface.
Right now.
I've seen this clear, right?
Clear.
Right Now, What I'll do from the side is I'll change the mode.
To what?
Network extension ignore goes down.
Comes back up again.
From the server side.
You should have.
10.4.
So now the server can reach.
Ten .4.4.4.
Right.
So all the people behind the server, same concept as yesterday can reach 10.4.
They'll have a default route right now.
Swipe it out.
It'll be using what source?
Ten.
11?
Yeah.
Should be able to reach.
And not.
So let's check.
Source Doesn't matter.
Show Crypto IPsec.
So no, because I have because I have the virtual access now.
Right.
So now it'll be based on the vertical axis.
Whatever is true, going through the axis will be encrypted.
If you check show interface virtual access to.
The source and destination will be specified here.
This is your applied protection to the tunnel, right?
To the interface.
So your source is what?
40.4 destination is 20.2.
Anything going through this tunnel will be encrypted.
Anything going through the tunnel will be encrypted.
So if you check right now, show IP route.
The problem here would be that you would not know where to go.
The problem in this case because you don't have a static route.
Where.
Pointing towards the other end point so you don't know how to reach to the other side.
When you use virtual access here.
Right now and I use virtual access here, I won't be able to go to the other end point of the tunnel.
So what I would need is reverse route injection.
But to do it here.
Not really sure how to apply it.
Virtual.
Let's first see from the other side.
Again.
I can.
Like that Crypto IPsec client is a VPN.
We can we don't really need that, but let's try because here I don't have a virtual axis virtual template
anymore, so it'll be a normal tunnel with a show IP route.
This, this side should be able to go.
So first of all, I need to change what.
Mode network extension.
You would not use network extension with virtual interface on the on the side.
Because if you are using routing, if you're using routing, right, you would need to do network extension
because routing will exchange everything.
Network extension.
You'll use it with normal crypto maps from this end.
Right?
So I am having my remote subnets being sent to the other side.
So show IP route.
If you check here, 10.5 is also coming.
I should be able to go to ten .5.5.5.
The the router behind should also be able to go to ten .5.5. 5 or 6.
Should be able to go to ten .5.5.5.
R5 did not have a virtual template for I need to remove it.
So crypto.
How was what effect?
The virtual template was affecting because since now this side is also unnumbered.
So in the routing table, he doesn't know what traffic to send through the virtual axis.
If you check R2 and you do a show IP route, how do you know that traffic to 10.5 should go through
virtual access three?
You have a you have.
I have a static route.
I told you when it's an unnumbered interface to reach the other side, you would require what?
A static route to reach the other side of the.
Of the tunnel.
One automatic.
Once the ice forms, it automatically knows the static route.
But it doesn't happen from the client side.
If it's a mode client, I know it wouldn't be a problem because I'm only accessing that endpoint.
I'm only accessing 192 168 10.10.
The problem would be if I'm trying to access it from a server.
From ten, 11, 11 one.
Does he know now?
See, right now he doesn't have a static route or anything through the virtual axis.
How does it know if it gets traffic to ten .17.17.0 slash 24.
How does it know that this traffic should go through virtual axis?
Here.
It knows because you have a static route.
Here.
You don't have a static.
And know first it has to find out what traffic goes through this interface.
Right.
This is checked.
If you remember, source is checked.
When you reach the crypto interface, then the source will be checked here.
First, you have to make sure what traffic is going through the tunnel.
Once it goes through the tunnel, it will automatically be encrypted.
All you need to make sure is that traffic, is it going through the tunnel or not?
Do you understand?
If you're going through the tunnel or not.
The same thing is from this end.
Are you going through?
You have a tunnel here.
How do you make sure your traffic is going through the tunnel?
Really?
How do you know if your traffic is going through the tunnel from the routing table?
The routing table tells you what traffic is going through the tunnel.
Right.
Check your routing table.
It'll show you that if you want to go to 10.5 is going through this tunnel.
Tunnel three.
If you're going to 10.4, you're going through which tunnel?
Tunnel two.
The problem is when you return it, when the traffic is coming returned.
How do you know which side is it going through?
You need to know which traffic is going through the tunnel.
For that you would require what?
A static route.
For that, you would require a static route from here.
I installed a static route.
All right.
From here, I don't have a reverse route injection procedure.
I don't have what it was.
This side doesn't have.
So that's why when you're using virtual access here, you only use it in client mode.
Why?
In client mode?
Because then you'll run routing.
When you have routing running, you will have next stops when whichever network you run from here,
you will have next hops.
Next hops will be through the tunnel.
Estatico.
No, no.
Be between the two tunnel interfaces.
I just ran it, right.
Unnumbered.
Unnumbered Run.
Share these networks will share his network Will share his network.
Yeah.
The networks for this guy to go to ten, 11, 11, zero next hop will be the other endpoint of the tunnel
for R2 to reach ten four four for the next hop will be so it knows what traffic should go through the
tunnel both ends know what traffic should go through the tunnel.
Right.
Right now.
R2, R4 doesn't know what to send to the.
Either we can use virtual template or if we use virtual template, sorry, if we use the virtual template
here and we use routing, we can use that.
Or you could use network extension which will give you the same thing.
Right so if I also go to our for.
There is no there is no three modes of there.
And here the modes are the same.
They work exactly the same way.
The difference because he asked the question about what is the difference between crypto maps and why
would we require twice?
I said that with vice you have a possibility tomorrow if you need to send traffic.
What traffic multicast traffic through this tunnel in crypto maps.
It was not possible with here.
What you could do is you could run a TV from both ends and send and send multicast traffic.
So normally you wouldn't use it.
Normally you wouldn't use it.
But if you need to tomorrow, send multicast traffic for any purpose through a tunnel.
You can only use it with VPNs.
Not with crypto maps.
It's impossible with crypto maps.
Right.
The modes are still the same mode.
Client You don't really have to stress the VDI on R4 much.
You don't have to stress it much because most of the times you would not use it.
Most of the times you'll use your normal crypto IPsec client VPN and not not the interface you would
mostly use.
What?
We'll just connect up using a client mode, network extension mode or network plus mode.
And as I said before, Network Plus does have problems with enhanced.
Right.
So what I would do here is I would go to our code.
Interface crypto IPsec Client VPNs.
Right.
I will say no virtual interface then.
Now this is network extension mode.
We'll go up Since Connect Auto is enabled, we'll come back up again.
Now you'll see.
I should be able to go to.
Don't have a look back.
10.4 can only go because I don't have an address.
Also, you see, right now no address has been pushed down to.
Just like that.
Same same.
It's just that from our to the management is easier now because our two will manage you.
Using what?
Different virtual accesses.
From the water campus.
This part As in what?
Virtual access command from virtual templates.
Virtual access is nothing.
These are svgs.
Think of it as SVG as static virtual tunnel interfaces.
Same as before.
You have a tunnel source and tunnel destination.
Here the tunnel destination is solved by whoever comes up.
Right.
Think of it as Tunnel zero.
Tunnel one Tunnel two Tunnel three tunnel zero.
The destination is 40.4.
Tunnel to the destination is 50.5.
Everything else between the tunnels is the same.
The source is the same.
The protection is the same.
Right source.
The only difference is they are both IP unnumbered, so no IP address is given from this side.
The only reason is so that I can communicate to the other side.
One thing that I need to go to the other side is what?
A static route which I have.
I explained it earlier.
Right.
If you remember from earlier, I said static routes.
Why do I need a static route?
Because now I can communicate to the same tunnel, different IP addresses.
So this side doesn't need an IP.
I can communicate to the other ends if they are on different subnets.
What's possible with work with this?
Also another thing that we need to do remember the extended authentication.
How did I do it here?
Triple A authentication login.
I said whatever I can call this.
Also, the name doesn't really have to match yesterday.
Yeah.
Username password.
Cisco.
Where do I call this?
Yesterday I called it where crypto map.
Where do I call it today?
Crypto scam profile.
I cross and I'll say client same client authentication list.
Just like yesterday.
I said crypto client authentication list today.
Also client authentication list.
I'll clear it.
Clear crypto ice cap.
Sorry.
Clear.
Crypto IPsec Client.
There you go.
So now you get what?
Username Cisco Password.
Is.
This username and password is saved on the server.
The client on this network extension.
The client is the client.
The client.
Another thing.
Let's do the split tunnel.
ACL.
Access list 101.
Permit traffic from ten 1111 dot zero.
Going anywhere.
Where do I call it?
Crypto is a compliant config configuration.
SEALs as a seals.
So right now, if I check, I've not cleared the tunnel.
So crypto IPsec 90 VPN right now it just shows you what is normal stuff, what is inside and outside.
Now what I'll do is I'll clear crypto IPsec client.
It will connect back up again because I'm not using Crypt Connect manually.
So put in your IP.
Put in your username and password.
And.
I think I made a mistake connecting up.
I used a different password.
Policy map.
Inform what?
So I'll do this.
They use.
I think my ACL is wrong.
Yep.
Access list.
I'm still with firewall permit.
IP 1011.
You see, the one on one is applied.
So clear it again.
I should be fine.
Cisco.
What's up?
So Crypto IPsec client is EVP and.
Now only traffic going to ten dot zero network from 205 network.
We go through.
So ten, 11, 11.1.
We go through with the source of loopback.
Zero.
I can go to point six.
Anything else?
If I go?
Doesn't matter the source now.
If I go anywhere else, I will not go through.
Also, another thing I want to test.
IP set client is an easy I think this might make a difference for.
We cleared it.
I think when you use split tunnel, it gives you the interesting traffic on the client side also.
So I peered out.
Anything going for 150?
Yeah.
With split.
If you want to use virtual interface on the client, what will you use?
Split tunneling because then the split tunnel comes down.
It gives you the ACL off.
If you want to go to ten dot zero network, go from.
Virtual access to.
So now I should be able to go to.
Right.
With split.
Because all that you require with virtual remember, all that you require with virtual template is to
tell the routing table where and how to go to the others.
Now we are telling.
So again, if you want to use virtual access on the client, it will work properly When you're doing
work split because Split Tunnel will guide and give out an ACL and tell the other guy what traffic to
send through that tunnel.
Right.
So I think it should not have a problem with.
Our client also.
Waiting to connect.
Cisco.
Up.
Wipe it out.
Yeah, they shouldn't be a problem paying ten, ten 111 1111 111 with a source of ten for.
Can reach because you have a route in virtual templates, all you need is a route.
If you have a route, you're fine.
You need to know which traffic is going through the tunnel if you know that.
Good.
I was, what, different from yesterday?
Yesterday, it was not done based on routing table.
Yesterday, your traffic would hit the interface.
Then you would go to the IPsec check, what is the source, what is the destination?
And so on and so forth.
Here it's done purely based on a tunnel which you already have.
So you can check the tunnel.
So Interface Tunnel.
Can I remove the.
From the plane, just remove it from the interface.
Crypto IPsec client is no.
Virtual.
You put it in the client.
IPsec client is an easy mode.
Of the server, right?
Sure.
Let's do this first.
Cisco routing table of the server to show IP route.
I mean.
We didn't have it.
We didn't have.
We had it using the reverse route command.
Whatever address was pushed down, the worst route was installed and we'll be having this on the client
side.
But yesterday when we had this, we didn't have it through a tunnel.
He headed to the public address.
So when it hits the interface, then crypto map converts it.
Here.
We don't need the crypto map at the interface to convert it.
This is much better in processor power.
Have this address is at 10,000 on the client.
And when I put it in network extension and get the remote subnets and the loopback will show up here.
Right?
The loopback address ten .4.4 will show up here.
Android 4.4 with the virtual.
Through virtual access to the difference between yesterday and today was this was not virtual access
to this was the public address.
That's it.
Everything's now here.
It's just more granular because now, you know, now you can have a good look at your virtual axis three
and you can see what your source is.
Destination is you can change parameters here.
You know, you can add a Fifo strategies, queuing strategies, queues you could do on this tunnel.
I think.
Plus the control that you have over the tunnel now.
You want to change your queuing strategy?
You want to change your bandwidth?
I can do that here.
You can do that.
Crypto Max.
You don't have that control.
Grew up because you don't know.
You only have everything is going through the IPCC here.
It's going through an IPCC, XVI, Xvii, where you can make changes.
You can change the bandwidth, you can change the MTU, you can increase decrease the MTU with crypto
maps.
You can do that.
Client on the client side, if you want the same amount of control on the client, the same amount of
control from the client side, for usually you wouldn't do that.
Now, if you wanted to run routing between the server and the client, for example, or any multicast,
maybe you're joining a multicast stream.
You wanted to join a stream, How do you join it?
You wouldn't be able to do it with crypto maps Router.
And here also, you wouldn't be able to do it if you don't use virtual tunnel interface on the on the
client side.
So you have to go to the client, use the both sides are using VDI.
Then you can send multicast, you can have a control shows all those things can be done.
For the client.
When you have VDI, you need a route to know what is the other side because it's unnumbered, right?
Also on the client side.
The IP address is unnumbered.
So if it's unnumbered, it's not in the routing table.
The tunnel is not in the routing.
Yes.
How did it work with crypto maps?
In crypto maps, you have something like this.
You don't have to.
Crypto maps.
You go to the interface.
Crypto map does it for you.
Have the map.
All you need to do is that traffic should hit the interface.
So it's source based.
So based on the source, it'll change it here.
It's not like if you use VDI, it's not source based and destination based anymore.
Anything that is going through the tunnel will be encrypted.
So if I use a VPN on the client.
I have a stack of them.
Yes.
Should have a static route to the other end.
Basically saying that the static route should go through the tunnel in the routing table.
It should be resolved.
Is it clear for everybody else?
What we have done is pretty simple, pretty same as yesterday.
It's just that we have explained some topics again.
So, you know, it's pretty self explanatory, everything.
Just a quick recap.
Everything that we did was the same until now.
The only difference was we used a virtual template and we used a crypto cam profile because we don't
have a crypto map to use.
You like templates so that we can clone out different tunnels out of it and I can profile, so we can
push down addresses, we can exhaust and we can do other features.
Combine all of them together from the client side, you could either use the same client which you used
before, or you could also use a virtual tunnel virtual interface where you have a separate interface
even from the client side.
So if you wanted granular control on both ends, you could use it, but most of the times you would
not.
Why?
Because most of the time you would be requiring using Cisco VPN client.
Cisco VPN easy VPN client, the software to connect up that wouldn't require.
Obviously on the other side, it will connect up now the same way we connected with the first first
day, the same way we connected yesterday also we did that.
You can do that here also, instead of using a router here, just connect it up to a Windows XP machine.
Use the VPN client.
It will connect just like your normal client mode does without the VPN that will also connect.
But always remember use MD5, not Sha.
Right.
That finishes your.