SSL.
In.
Until now.
Whatever you've been doing until now, that's been like three weeks already.
You've only been working with which VPN?
IPsec VPN.
Epicyclic gear, right?
If you remember IPsec VPN, what layer VPN is?
What was it?
Entry.
Why was it an L3 VPN?
Because.
Exactly.
You had an internal header, an internal IP address.
Then on top of this, you had.
So it was protecting your packet from layer three onwards.
So you may have UDP here or ICMP here.
It did not matter.
Leipzig, it did not matter.
We saw all the different varieties of IPsec VPN, but all of them were starting from layer three onwards.
Right.
With SSL VPN.
This is the difference.
SSL VPN does not work on layer three.
The encryption actually happens on layer seven.
The encryption happens on layer seven.
So it's like when you're sending traffic from 151 .3. 3 to 151 dot 20 dot two.
Source port.
X.
X x.
The destination port for SSL VPN is going to be TCP.
What?
443.
Heard about it before.
Https.
Mr..
It's not.
It's not actually Https, it's just Http.
This SSL makes them.
Makes Http into AWS.
It's actually a VPN.
Whenever you're opening your Facebook page, you're opening your Gmail page, you're actually opening
creating a VPN.
You don't realize it, but you're actually doing it.
Right.
And whatever is inside here.
Is encrypted.
All your information, your credit card details, everything else, wherever you're entering, is here.
And it is secure.
Right and famous.
Much more famous than IPsec VPN.
One of the reasons why is because it uses this port number of.
443 very well known out there and there is very seldom chance that any router or any other firewall
out there would stop this traffic.
Nowadays, it's quite virtually impossible because everything works on four.
If you stop this, people go to their rooms.
They cannot use what they cannot use Facebook, Gmail, all those things.
They'll complain about it and you'll have to make sure that this works.
But with IPsec would usually has happens as a problem is say for example you go to a hotel room.
You go to a hotel, right?
And it's connected through a router to the Internet.
Right now this router because it's a small hotel.
This router can be a very cheap one.
Right, which by default will not allow ESP packets to go through.
If you go to this hotel and you try to connect up your Internet, maybe you wanted to create a connection,
a VPN connection to your company.
Right.
When you try to do it, it doesn't go through.
Why?
Because the router doesn't allow it.
ESP is a protocol which not a lot of people know about, right?
I mean, for a layman, he wouldn't know what ESP is and what SSL is.
But what he would know is Facebook has to be allowed through.
Right.
That's why https.
Which is for 43.
Is quite famous because it's more common.
So people people prefer this over IP.
He has for site to site connectivity and everything, no doubt.
IPCC is very nice, very good.
But remote access VPNs.
When I say remote access, I'm talking about what?
I'm talking about a server.
Through the Internet and are a client sitting at home.
Remote Access VPN.
You access your sites remotely?
But for that implementation, SSL is gaining more popularity than.
Even.
Of it.
Plus then you can do other stuff later.
You can combine it with a secure ID server.
You can combine it with OTP servers for OTP for RSA tokens and all those different things.
Right.
Let's have a look at how this actually happens, how this actually works.
There's a handshake just like IPsec had.
What It had those nine packets, phase one, phase two, then all those modes.
Quick mode, aggressive mode, main mode.
Right.
Just like that.
SSL also creates a handshake.
It's called an SSL handshake.
A SSL handshake.
So you have a server.
And you have a client.
You have a server and the client like they want to communicate to each other, right?
The first thing.
Who initiates this connection?
Always the client in remote access VPN, it's always the client using a message we call it.
Client.
Hello.
The client sends out a message saying, Client, Hello.
Now what does this message have?
It has all the policies that the client is going to use for encryption, for hashing, all that.
Just like your IPCC had all the policies that they were going to use.
Now in SSL VPN, also you have choices.
Do you want to use as 128.
Do you want to use as 256?
Do you want to use three days?
It is still symmetric.
It's still symmetric.
The encryption decryption is symmetric.
But how do you how do you negotiate it in the.
Hello?
I'm also going to say which version of SSL am I going to use?
Now, there are certain versions out there.
SSL version 1231.02.03.0.
Then it was replaced, not replaced.
They both work together, so sometimes you may see TLS 1.021.21.3 is under.
They just released the draft for it for 1.3 in this month.
Beginning of this month they release the draft of 1.3, but right now 1.2 is the latest one.
So that's what the client also says.
It says, okay, I support Virgin.
Let's say it supports these two Virgin.
So it says, these are the versions I support and these are the set of policies which I want.
Let's say three days.
And Shah.
Sends it also along.
Where?
In the client.
Hello.
Okay.
Simple packet.
The server will accept the client.
Hello.
Choose the highest one that it supports among the ones which the client supports.
So if the client supports 1.2 and 1.0, the server only has 1.0.
They will go down to 1.0, both of them.
Right, Whichever is the most highest compatible between them, they'll choose that.
So the server will reply with.
This version.
Let's say they choose on TLS 1.0 depending upon the browser and all those things.
A lot of things then.
He was supporting three days a year on all those things.
Out of that, I support three days and.
Yeah.
This packet is known as server.
SQL Server.
It.
Then it waits again.
The client doesn't send it's not 1 to 1.
So you send one and the client send one.
No.
The client has sent a packet.
It's the server's job to send.
B k i certificate.
Remember.
Remember I was with you at your public key signed by the server.
Once you have those signed keys, then you can use it for identification.
We used it in IPsec VPN, but the only one reason why we use this was for forward validation.
We never use that key, right?
Do you remember last time the key size that we created was 5.2 bits?
Because I told you that we are not going to use the key.
The only thing that we are going to use is the I see who signed this key that was more important at
that time.
But here the key will matter.
The key will matter here.
The AC is the same.
So what the server will do is create a section, create a set of keys.
A public and a private.
Get the public key.
Signed by whom?
By the CIA.
The CIA will sign it with the CIA's private key.
It will be signed with very private key.
Then when the client is asking for a connection, the server offers him.
What?
The certificate.
It will be valid only if.
The client trusts whom The CA server.
If the client trusts VeriSign, you will get the green mark.
On your browser.
If the client if the if your browser does not trust your server if you signed from.
Anywhere else let's say gopalan.com.
Got it signed from gopalan.com.
I don't know.
It's just a name.
Now in your car, in your Chrome browser or any browser which you're using, you wouldn't have the root
certificate of home.
Gopalan If you don't have the root certificate, you don't trust Gopalan.
So when he shows the server, shows you the message, you get a red icon.
On the top left corner which says proceed at your own risk.
You want to proceed at your own risk because we don't know this server.
So whatever information you might send to him, there is a possibility that he might be able to see
it.
Okay, so that's what the server does and you will not move further in SSL.
If this is green, it's all right.
You'll move further.
If it's not, it will be stuck unless you say yes.
Unless you proceed, it'll be stuck.
Where?
Here.
At this stage.
At the third packet where the server sends a certificate.
Once he does such a certificate, you do accept it all.
Also remember the certificate also has what the public key.
It can be 1024 bits.
Inside the public key is there.
Now, once this is done.
Now in general cases.
Once you send the certificate, the server will send another packet which is known as server.
Hello.
Then.
To the client basically saying, I'm done.
You accepted my certificate.
Well, and good.
I'm fine.
I've done my job.
It's your job now.
I mean, the ball is in your court.
Now it's the client client's responsibility to move the handshake further.
How does the client do it?
The client will send out, we call it a pre shared pre master key, not pre shared.
Now they both agree on an encryption standard, right?
Say, for example, they both agreed on three days.
And they both agreed on.
That's.
But they still need the key in IPsec, who provided the key.
Be it.
The exchange automatically provided the key here.
The client is going to create the key, not the complete key.
Half of the key.
With some random numbers is going to create that part of the.
And send it back.
To whom?
To the server.
But you might ask the question.
I mean, you're sending it across.
You're sending it across.
Isn't that dangerous?
Sending it across the public environment.
Encrypted.
Using what?
No, no.
That's what they're going to use.
If I even encrypt it, how will the server decrypt it?
He doesn't have the key.
I will encrypt you.
Right when you say you encrypted.
But not with that.
What will I use to encrypt it?
The public.
The 1024 bit key which you received earlier, you will use that to encrypt this pre-shared key.
Pre-mastered.
And then send it to the other side.
Why is this good?
Because this encryption 1024 bits is huge.
And most of the times now you don't even use 1024 bits.
Now you use 2048.
And you remember the video, right?
Billions and billions of years to crack that.
The server will be sending a public.
Hello?
Along with.
No, the server wouldn't do that.
The server only sends the public key which is signed by the key is the certificate in the certificate
is the key.
The public.
Yeah, it'll be signed by the private of the very sign.
That's a separate thing.
That'll be the thumbprint.
That's a separate thing.
It will also have if you check.
Let's open a website.
Let's check here.
Facebook, right?
If you go to connection.
We'll go to the connection.
You see what it's using is and it's not using Sha, it's using Ecdc.
Ecdc.
This is elliptical curve and it's a new variation of it.
It's using TLS 1.2.
If you go to the certificate which was given to you.
This is the certificate, right?
Eventually in the certificate will also have.
A public.
Right now they're using EQ curve something.
It's a new thing, I think.
Yeah.
So what we are going to be using is RSA 102420482.
You can use these.
You can use the newer ones I showed you yesterday, if you remember right, the newer versions have
been included in there.
This is what it is.
So you have the name should be here somewhere.
Yeah.
There you go.
Digicert.
But you're able to see it because it has already been decrypted.
How did you decrypt it?
You have the public key you use that decrypt.
That's how you can see the certificate.
Right.
The important part of the certificate is the public key.
Earlier we never used it.
Now we are going to use it.
So we'll decrypt encrypt the Pre-shared master.
Right.
We'll encrypt it using this and send it to whom?
To the server.
The only one person in the world who can decrypt this is the one who has the private key, which is
only with the server.
So the server will give out the public key.
We'll go back.
And send this key to the other side.
So when you see the server.
Eventually the server will do is.
It was encrypted, right?
It will use its private key to.
Decrypted.
Client key exchange.
I think I have a document.
Server.
Hello.
First is client.
Hello from the client.
Now he's considering this site to be the client and this site to be the server.
So you have SSL version supported ciphers.
And what is the specific data coming back?
You just choose on what?
What version of SSL I've chosen selected cipher is or three days.
Then you have session specific data and server certificate sent by whom?
The server sends out a certificate.
Then it says that hello has been hello is done pre master secret sent by.
Send by whom?
The client to the server.
Now there may be cases.
There may be cases out there where the server also asks from a certificate from the client.
For high security mode in the company.
What you would usually do is you would have the server and the client both negotiate on certificates.
So the server will give out a certificate, but it will also ask for a certificate from the client.
That is done here.
When the server is sending the hello, right when he sends out a certificate, he will also send out
a certificate request.
And the client after the pre master secret will also give out what its own certificate.
For validation.
That's it.
Only to validate the client Is.
Is this actually who he says it is?
Usually done in production.
Okay.
Then both of them will create their keys since they already have everything else.
So they will create their set of keys.
Then I don't think this is complete.
Once they complete the keys, they have the client will have the client send this right.
After that, the client will send out another packet.
We call it change.
Cipher.
Sweet.
And then.
Encrypted message.
Client.
Done.
Chain cipher suite means after this, whatever message I'm going to send is going to be encrypted.
Because since both of them have the key client change, cipher means less change to the cipher.
After this.
Let's change to the cipher suite.
And then the last message that you send is encrypted.
After that.
Which is done basically saying handshake is done from my end.
You're sending that encrypted because you have the.
The server will do the exact same thing the moment he receives this.
The server will send its own chain cipher suite and.
Seven.
The chain cipher suite and server.
This.
The server sends it back.
Okay.
Just a quick overview again.
Now, this one right now, the one which you are using is RSA.
We're using RSA, remember?
We're not using.
To exchange the keys.
We are using RSA.
How I'm sending the public key is encrypted using the public key.
Sending it back to me.
There is possibilities where you can use TLS.
Sorry, you can use VH, you can use elliptic curve.
Right?
SSL by default only supported RSA.
Dlss supports the use of HDR and all those other different things.
They're more working on TLS now rather than SSL.
Do you know who created this SSL?
How did it come into existence?
You remember that browser?
Netscape, Netscape Navigator.
They are the ones who actually created SSL VPN for.
They wanted to protect the Http sessions, so they created their own version of Https.
Later it became common and people adopted it.
It was them, the browser which no one uses.
Right.
What was the first packet which goes through from from which size does the first packet originate from
the client.
Which is what?
Client.
Hello.
With all the policies the server replies with his.
Hello.
So this is packet number one.
Packet number two.
Packet number three from the server.
Again saying what?
This is my certificate.
This is my public key.
Please accept it.
You accept it.
It might also ask for another certificate from the other side.
Then the fourth packet is server.
Hello.
Done.
I'm done with my.
Hello.
My job is done.
Now it's your turn the client sends.
Three Master key encrypted using the public.
Encrypted using the public.
Then we call it client key exchange, then sends a chain cipher suite and client.
Hello.
The server will do the same.
So this is packet number five, six seven.
The server will do the same.
Jane Cyphers returned.
Server.
Your handshake is complete.
Okay.
Good enough.
Now, again, if this is how it happens, let's have a look at the topology that I'm going to use.
This is my topology.
My router to here is going to be the SSL VPN.
Gateway.
And my client.
Here is the loopback of my PC.
The loopback is trying to create a connection with R2.
Now this connection will be.
Through SSL.
Before we go there, we have to understand the different implementations.
Of SSL VPN.
There are three main implementations of SSL VPN.
Can anyone guess what?
There's one called Thin Client.
Sorry.
The first one will be called.
Client list.
Second is thin client.
The third is thick.
Client Clientless is a way where you configure the VPN so that the client doesn't have to do anything.
All the client would require to connect up to the VPN Gateway is a browser.
If you have a browser, you can connect to the VPN.
Clientless.
But as you guessed, it does not support all the protocols.
So it won't give you the flexibility of IPsec VPN, but it's easier on the client.
You can send traffic like http ftp.
Cifss.
True.
Who that?
So the CTP becomes a Https, FTP becomes Sftp.
Because you're sending it through the.
Your actual protocol will still be Http.
It's just that because it will go through the tunnel, it will be protected.
Okay.
Doesn't support a lot of protocols.
Thin client is a Java based application.
Where you can extend the scope, the scope of these protocols.
So earlier where you had only Http and Https and FTP.
Now you can go to Telnet.
You can go to Smtp.
All the all the protocols that require well known port numbers, you can use them.
Through a thin line.
Through a thin clients.
So it gives you a very good, very good amount of flexibility.
It's a Java based client.
A lot of vendors support it.
Thin client, right?
Still not as flexible as what?
As your IPsec VPN.
The only one thing that is as flexible as that is the thick client.
Thick client gives you complete control, just like your IPsec would do, so protecting you from layer
three onwards.
These ones still work on layer seven.
Left 4 to 7.
Your thick client works.
Giving you full control over your private IPS, your public IPS and all those things.
We will have a look at this.
But when we're looking at the thick client, we will not look at it on your router.
We will look at it at the.
Why?
The this one is these two are these two are applications just like easy VPN client.
These two are also applications.
I.
So what I was saying is.
Remember.
This device called Pix.
Becks was Cisco's first firewall.
Very, very famous in the market, worked for a long time, gave a lot of benefits.
It was considered to be a luxury device at that time.
Pigs Right now, with time, what happened was other vendors came up with their own versions and this
SSL became famous along the way.
So they had other vendors having very good implementations of SSL.
VPN picks.
Also tried to do it, but they failed miserably.
Right.
So what did they do?
They bought this company called.
What?
VPN.
Concentrator.
There was a device called VPN concentrator.
What it would do is it was only there for SSL VPN.
The whole purpose of this device was as they merged it with pix to form.
What?
Is.
So the SSL VPN that we are going to do on the router is think of it as obsolete.
You wouldn't be using it ever.
But why is it important?
Because the concept is important.
Right.
So it does not again, it works with Java.
And some of you might be knowing Cisco's Java, I mean, whichever Java version they use, it's ultimately
it can eat your head right to find the perfect version of Java.
Which one works, which one doesn't work.
It's a headache.
It took me a long time to find the perfect one for me.
And trust me, this one is a high chance.
It won't work on you.
Right.
So that's what it has.
Sometimes it works, sometimes it doesn't work.
And the thick client has issues.
With Iowa's VPN.
We'll be doing this on the RSA, which will be tomorrow.
Today we'll do it on the iOS.
Now, for those of you who have not done RSA, you don't have to worry about it because it will just
be another device.
We will not be configuring any RSA features.
We will not be configuring any firewall features.
We will just be configuring features for the SSL VPN, just like you would do on the device iOS.
You would do the same on these same configs.
Nothing.
Nothing new.
Okay.
We'll have a look at that.
So.
See now when they negotiate, right.
They had the pre master key.
Now they know which kind of algorithm they're using.
So now they have the key already.
Both of the sides have the key.
When they have the key now the packet comes in.
They will encrypt using this key, using the mechanism which you've already chosen.
You've chosen 128 is 128 encryption from here.
The other side goes and decrypts this one symmetric.
The only the exchange.
You cannot have asymmetrical.
There will be too much.
Check out your sister since you're using asymmetrical and such.
How slow do they become?
I cannot do do it here.
So it's you.
Most of the times it's always symmetric.
Client list is what we are going to talk about now.
Before we do that, let's configure it because we know how the handshake takes place, right?
We now have the handshake takes place.
So we'll have a look at it and we'll see how it works.
Then we'll know how the tunnel is created.
To configure client list.
You'll go to R2.
Right now, the first thing again is to make sure connectivity is up.
So.
This is my setup.
These are going to be the internal servers that I want to access from home.
Like for Http access, let's say, because I said, as I said through the client list, only two protocols
can go.
Most of the times you don't usually use what are those two protocols Http or FTP?
Whereas what used.
That's what you're using.
In the enterprise network, you don't use client list.
You usually use the thick client in Enterprise.
But if you have to deploy something like if you have an Http server, you want to deploy it as an Https
server, this is what you would do.
This is a remote.
Chemotaxis.
This is an Http server, right?
I want to deploy it as Https.
The job given to you is this is Http deployed as Https.
How will you do it?
This is how.
You want to deploy this Http server on the public internet as an Https server?
It's actually Http.
It's always going to be Http.
Eventually it's going to be Http.
Behind this router is going to be Http.
But for the public Internet, it's going to be acting as what, https?
Because they're going to create a tunnel from their end until R2.
You'll see.
Give it time.
I'll go back to the loopback and give it the address so that I can communicate.
151 dot 30 dot.
Three.
Next up will not choose the next.
But I'll also do is.
I'll add it out to 151 .23.2.
251.30.
Kidnapping.
30.
I don't think I've configured this part.
Should I be with?
This should be 30.3.
Rollback should be 30.25.
That out.
Be happy that.
Should be able to bring one 51.22.
Was.
One 5122.
My SSL VPN Gateway.
I'm bringing.
I do.
From where?
From the back.
First thing.
Main condition.
Connectivity.
Once I have that.
What I want to do next is to configure the gateway, which is our.
How do you configure it?
We'll go to our to.
I'll call it.
SSL.
Gateway.
Okay.
Now, the way you do it is.
The VPN.
Gateway and you name it.
To create a VPN gateway and you name it.
Now name it.
Anything you want.
Now, this name has no significance to anything at all, anywhere.
So you can call it anything, right?
You can call it Rob.
What does it do?
Generate 1024 bit keys.
Why?
Because it requires it.
The public set of keys.
Now you can get them verified, right?
How?
You have a way to get them verified.
Using SSL so you can say SSL trust point.
If you have a server pointed to the server, you will go and get itself signed by default.
I will leave it as it is.
So it will be self signed, its own sign on the certificate, right?
What else do I have I need to configure.
The most important part is the IP.
Either you can use based on the interface or you can specify the address of the gateway.
The address of the gateway for me is going to be the public address.
And the port number that I'm going to be using is the default port.
What is the default port?
440.
Okay.
So what I what you're basically saying is.
The VPN Gateway.
Name it anything.
IP address is 151.23.2 and the port is.
The default one.
Which you.
What you also do here is the important part.
Call it in service.
In service is nothing like no shutdown anything.
Remember, No, shut down.
We used it a lot of times.
Right.
You configure something in the end, you specify a server if you remember, configured it in the Env
service.
What?
No.
No shutdown here.
No shutdown is called in service enabled the gateway.
The moment you do that, the gateway is enabled.
You can also specify the encryption mechanism which you want to.
Now here it gives you a set, not you cannot choose it.
Encryption separately and hashing separately.
You choose a set S or Sha or C four or MD5 three dozen Sha.
Right.
It's a combo.
Will come.
Right.
But the only difference is here, you don't have the new ones available.
That entirely depends on what iOS you're using.
Get a new iOS, you'll have more options here.
Under.
Right now.
Let's leave it at default.
It is done.
You would also require.
What?
Because when people log in, they'll be logging in using a username and password, right?
Facebook page, you have a username and password.
Everybody does it like that.
So you need to create that username and password.
The only difference here is when you do that, you need to add a domain name.
On a router for every different domain, you'll have a different SSL VPN page for admins.
There will be a separate page for sales, there will be a separate page for marketing, there will be
a separate page and the users will also be different.
So marketing users will be somewhere else, sales users will be somewhere else and so on and so forth.
You will have to configure that.
So I'm saying sha, but at which domain admin.
And password anything system.
I'll create another one.
Right.
I'll call this cop at the rate of.
Sales password.
Cisco's.
So to your users, Shai and Rob, these are two different users at two different groups.
Correct.
I also need to do it.
Can you guess what?
Triple A new model.
Triple A authentication login.
Call the list.
Anything.
Any name.
Let's say Paris pointed to the local database.
I'm using these names so that you know that these are.
You can use anything at this point.
Usually you would use company standards, right?
So you would follow those standards.
Right now it's just so that, you know, why do I need to point this to the local database?
Because my username and password is stored on the local database.
If it was a triple A server, which most of the times it will be, you'd be pointing it to a triple
A server.
So saying that this username came in, check it against the Ldap group.
If he's there, allow him to get.
That's how you would have Facebook will not have everything.
All the 202 billion users stored in one one PC.
It'll be somewhere huge.
Username password.
You won't do it here.
You'll do it on the Ldap.
On the triple.
This.
Which this part.
Which exchange.
Thinking.
That's after.
That's after the handshake has taken place.
Handshake will take place the moment you open.
Open any page.
Right.
Handshake is done already.
Once you get the display page, that means the handshake is done.
Then you enter the username and password, which is already encrypted because the handshake is.
Save the dates before you register.
Once you register, you're registering to the Ldap server.
So your entries.
Yes.
You do that, right?
Sign up.
What does sign up mean?
You're signing up to the Ldap database, so you're putting your information, which is going to that
database.
And then later you access it, you automate it.
Also obviously automatic.
You enter it here, it goes straight away to your database.
So later when you come, you just access your account.
Right.
So triple authentication login.
That's what I need for now.
Right now.
That's fine.
And what I'll also do is web VPN.
Now, first of all, you specified all of this.
Let's do this.
I did this.
I said in service.
Then I also did.
What?
Username.
I said.
I didn't use it.
I kept it as a default password.
Analysis that username.
Rob at sales.
Password.
Cisco.
I said triple A.
Authentication.
Login.
Barry.
When you put that.
Now you have to create those pages.
The pages you create now.
What pages?
It's called context.
For each.
For each domain.
A different one.
And you'll name it something.
Now, this also, the name does not matter.
I'll call this admin content.
Call this admin convex.
Now here you have a lot of features which you can work around with many different things.
Right.
You can have port forwarding, you can have a policy.
Right.
You can have a login message logging.
Many different things which you can configure if you want.
Right of what we are going to be working with is we'll have, let's say, not the title.
There's a function somewhere.
Policy group.
You're going to create a group policy.
I'll call this group or I'll just call it admin.
Policy.
Here you have function this.
Let me explain this.
This is a little complicated.
So when you do it here, Web VPN, Gateway.
Sorry, Gateway context.
I'll call this anything.
The name doesn't matter.
Again, I'm stressing this enough.
The game name here has no significance.
Under here.
You have two things.
You have a policy.
Of group.
We call it anything admin.
Policy.
Whatever changes you make in the policy are made to the policy only.
Are applied only to the policy.
They're not applied to the web context.
To apply to the VPN context, you will later say default.
Group.
Policy and you will call that policy for this case.
What is the name of that policy?
Admin.
I.
The changes that you'll make will be making were under the policy, although it does come under the
same subheading.
Which is you're still working under the context.
That is the weird part about it.
So you'll have to cut that edge off.
You'll have to remember that this is weird.
You'll be configuring it where in this and the policy will be called under the same VPN.
Okay.
What are those policies?
Functions to the users who come through admin who comes through.
I want to give him the functions of file browse.
Now let's have a look at the functions that you have available to you.
You have file access.
He can access files, he can browse files, he can enter files, leave SVC.
SVC is the virtual client, the thick client.
So I'll say he can only browse.
That's all he can do.
The guy who comes in can only browse.
I'll exit.
Go back where?
I'll exit.
And go back.
To the default group policy.
So I'm still under the same VPN context.
I'm still working under the same within context, but here I'll say default group policy is what admin.
I'm specifying why.
Because tomorrow what you could do is you could create two policies.
One here and other 1st May be for disaster management.
So if you immediately wanted to shift, you could only have to change one command default do property
policy is the other policy.
So it would just shift to the other one.
Okay.
Done.
You already have that?
Yes, I'm already have a web page.
I'm only letting the web page know that the admin guy, whoever is the admin, what functions is he
allowed?
You can change the I'll show you first the actual web page that you get.
Then you can make changes to that.
You can change that.
Any questions?
Until now.
So you choose the default group policy.
There are still other things that you do.
Triple authentication.
List.
What is the name of the list?
Body.
Or what you're saying is whoever enters the username and password that should be checked against Paris.
Paris is what, local.
So basically you're saying inside.
Inside what?
Inside the Gateway triple A authentication login.
No, not login.
Authentication list is, as you will also say.
Triple A authentication domain.
What domain users are allowed here.
Based on what you have chosen here, which ones do you want to be allowed here?
Admin or sales?
For this case should be admin.
So you'll say admin.
Now this is where the symbol is important.
The symbol differentiates the username and admin.
You can use any symbol here.
You could use a pound, a hash, anything, but you would have to use the same thing here also.
Yeah.
It's only people on that domain.
So if Shah is here.
No, no.
Here.
You're saying Paris.
When you say Paris, you're saying that all the username and passwords are stored there on the local
database.
Yes, but you're also saying that the domain is limited, whatever is local, but his domain should
be admin, so both things should match.
So both.
No, not both.
Both has to match.
It has to be local.
Basically, when you're saying local is where to check, local is not you're not saying that these are
the users.
You're saying where to check, what to check is the domain.
You check it in the local database the domain should be at.
Okay, so we'll say triple A authentication domain should be at the rate.
The differentiator between the two.
You also have to link this.
So if you, again, have a look at this, you have not linked it to the gateway.
This is a context, but you have not linked it.
To which gateway are you talking about?
I have to link it to the gateway, so.
Gateway.
What was the name of the gateway?
Rob And you have to specify the domain.
Now, this domain is important.
This domain.
Earlier I said admin, right?
I will only call it Add.
Just so that you know where we actually use this.
Just.
Configure the gateway probe.
I think it was capital.
Eddie is just a name.
Listening.
I know significance of Add.
I'll show you how where you use it.
I'll call it Add.
You cannot use Add.
Okay.
And finally, you have to bring up the context.
So in service.
Then you have Gateway is Rob.
Domain.
Is Eddie Sharp, Finally is finally you in service.
Bring it up.
No, Shut down.
That's if you context is up.
Your VPN is up when you do these things.
Let's have a look at this again.
The first thing that you would do is create that gateway, give it an IP address and bring it up.
Create a username and password.
Create an authentication list which points to that username and password.
This if this is step one.
This would be a step too.
Step three would be creating the VPN context, one page for admins, one page for sales and stuff like
that.
So for admin you have two things which you have to be careful about.
You have to create a policy, then call the policy.
You create the policy where you say that he's only allowed to browse the files you call the policy,
then point to the local database, point to the local domain, point to the gateway.
You're done.
If you really look at it, it's just very simple.
Create the policy.
Call the policy, point to all three domains, point to the local database, point to the domain and
point to the gateway.
You're done and bring the bring it up.
Okay, let's capture packets.
And establish the connection.
How do you do that?
It's already trying to do it.
Did I have anything running here?
How do you open https?
Https.
150.
151 dot 20 dot https.
Opens the best browser to open this would be.
You could just proceed anyway.
Anyways.
Https.
151 dot 20 dot if I just do this.
What does he ask me?
There's a problem with the website's security certificate.
Would you like more information about it, or do you want to continue?
I want to continue.
So if you see, it will not open the page.
Why?
Not the client side.
The handshake will be complete.
Well, that is actually running.
I'll just show you the handshake before we go any further.
Check out the handshake.
Client.
Hello.
I think you should be able to open it also.
Clienthello is the supported methods that it can use.
Cipher suites.
12 suites that it can support the client right now can support all these 12 based on the browser.
Right.
It can support ecdsa.
Imagine you can support all these different suites.
All the guy has to do is choose, but the version that it can support is one dot.
Cannot support 1.2.
Correct.
Sends it to the server.
The server accepts, so the packet is smaller.
133 is compared to 185.
The server will accept.
Maybe not.
Okay.
He has RSA with ease and Sha.
They've already agreed upon that.
Then you have server is done.
Then certificate sent by whom?
The server sends the certificate to the client doesn't listen.
This is the certificate.
Do you accept it or not?
Self-signed certificate.
I was signed.
Remember?
Then send the certificate.
Done.
Server says server servers.
Hello.
Is done.
So server.
Hello.
Done.
Then what?
Client key exchange.
The master key is sent.
Plus, if you see that this will be sent as payload.
So you have client key exchange change, cipher set and client.
Hello.
Not.
Hello.
Client to client handshake.
Done.
Encrypted text.
Chain cipher suite means what?
After this, whatever I'm going to send is going to be encrypted.
And this is the pre master key being sent.
RSA encrypted.
Pre master key.
RSA encrypted.
Okay.
This goes to the server.
The server replies with server.
Hello.
Done.
Sorry.
Go down here.
It got broken down here I think.
Was it?
Yeah, it got broken down here.
They exchanged some.
Eventually the server will also say.
This is from the server chain cipher suite.
Encrypted handshake and your full.
Everything is done after that.
Everything would be what?
Encrypted.
It was broken down because I could not open the page.
Why I couldn't open the page is because, as I told you, we are doing it based on contexts.
Admin has a different context.
Sales has a different context.
Right now, when I chose my context, I created it only for whom I.
And this was important.
Here what I'm saying is the gateway is going to be robbed, but the domain name is going to be a D sharp.
So when you open this, you will open it as 20.2, but with Add.
With the slash for aid.
That is where this is important.
Everything else, all the other names that you've used are useless except for this which links you to
the domain.
And ad right here.
Which opens what?
Opens the gateway.
Now, most of the time you wouldn't have a weird name like this.
You would usually have admin here.
So when they open, they will open.
What admin will say Gateway drop domain is.
You have the domain as admin because it's easier for you to read also.
So you'll say.
The.
15.11.1.2 slash admin.
Hey, Ken.
Sales Log in here.
Rob.
Can I?
Although it is on the local database, it cannot.
Who can log in?
Shall.
This is your SSL VPN gateway.
This right here, the one which is loading.
I it.
Says that you've already gotten past where the gateway now the traffic that you're sending.
Whatever traffic that you're sending now, application data.
Uh, is going through.
Right?
But check out where is it getting assembled.
There are 2 to 3.25 is your IP header.
Then you have your port number.
This is the reply.
So the source port is 443.
The server is replying.
Not encrypted here.
Also from layer four onwards.
Encryption begins.
So your actual traffic, if you have a look at this, going back to where we started from.
Your actual traffic will look like this going from 151 .3. 25 going to 151 .2.2.
Source port.
X x x destination.
443.
Then.
This will be your SSL and your encryption will be.
Right.
So your package is going up all the way up here from the.
From your PC will look like this.
So people will know you're talking to Https, but they will not be able to go in here because they wouldn't
have the key to open this encryption.
Okay.
The question is, how do I access the servers?
You're telling me I can encrypt, but how do I access?
My main job is to access 10.11 point, 11.1.
My other job is to access 10.11 point, 11.4.
Where do I put that request?
That request?
Ghosn.
Here.
So inside here, when the router will open it, the router will open it.
Right.
Because it is meant to the router R2.
When the router opens all of this information.
When he sees the whole thing inside the Http part, he will see a message like this.
I want to go to.
Ten.
11.
11.1.
You will see this.
That outro will see this.
It's a lone message without a source, without anything.
It doesn't have anything but what the router will do.
The kind router will forward this packet, not actually forward it.
It will do.
We call it a proxy.
It will go to R1 on behalf of C1.
On behalf of him.
C1 will not be going.
R1 R2 will be going.
Using which source IP address?
R2 is IP address.
It'll be creating a connection.
With whom?
Whatever reply he gets from there.
It's going to send it straight up.
Who to whom?
Back to.
It is going to act as a proxy in the middle.
If you remember when I configured it, if you were careful, I did not configure any default gateway
on R1 and R4.
Because I wouldn't need it.
I own an R4.
The only one person which they are communicating is R2.
They're not going to be communicating with C1.
Any questions in your heads right now?
How do they keep track?
You have to.
Pieces.
How does R2 keep track of port numbers?
Based on the port numbers, it would keep track of.
This connection belongs to this PC.
The other connection belongs to this PC.
So you'll see that even though I've not configured anything in my web VPN Gateway, you have this URL
bar from this URL bar.
I could say I want to go to 1011 11.1.
What do I see?
Https.
To whom?
If the certificate was signed, this would be green.
Ktbs two.
I don't have a route here.
Debug.
IP.
PCB packet.
Right.
So I'll go here and I'll click.
Check out the source.
Ten, 11.
11.2 and ten.
11.
11.1.
Who's accessing me?
1313529.
Hoping where This is the one.
Yeah, it is.
Let's send some more data.
All of this data, right?
For all there's too many packets.
49601.
496014960149601.
From 35 is 49601.
So we should see.
591.
It's taking, but it will keep track of the other one.
It changed from.
Yes.
From Yes.
What you're saying is from here to here, right?
What you're saying is, will it use the same port number from here to here?
Will it forward the port number?
He's not.
That is using a different one.
So he's but he's keeping track of them.
So he's using a different port number.
Source port used by this guy is different than the source port basically saying that this is a completely
different connection between R2 and R1.
Then whatever reply that he gets, he forwards it back.
To whom?
So if you have a look at the packet.
Have a look at the pocket.
I said, This is the packet going from 151 .33. 25 Destination 151 .23.2.
Right.
You're not actually going there.
You're going somewhere else.
XXX4 43.
Your actual request is Http.
Ten.
11.
11 point.
Protected.
Your packet goes across, reaches 20.2 is open.
Is open for 43.
And the SSL checks where you actually want to go.
Goes on your behalf.
Whatever reply that he gets.
That reply is written here.
And then again.
And then again the packet is sent back to you.
Source port of 443.
Destination Port of what you came in with.
So here it was.
Four nine, 661 or something like that.
How will you remember him by in 496612.
What port number is going out and then coming back?
He'll bind it back.
Goes back to home, going from 20.2 to 30.25.
So your information is here.
The only problem is you're limited.
The only one problem is that you're limited.
You cannot do a lot of things.
You can only do Http and FTP.
Why http bar has been provided to you if you see right here.
Http bar has been provided to you.
So you just enter your information here and just print.
And if the FTP is also there but it's not here, we'll have to do separately.
You can basically do it using FTP.
And enter the command.
151.
If you had an FTP server, you could go to an FTP server.
Today you have one more thing which is not mostly used network file extension.
Remember I said file browse.
It requires an ms. server to run.
So you would have to configure a different server.
And there because when you browse, you browse on that server.
So because I only gave him, which I gave the user what capabilities to only do what browsing so he
wouldn't be able to access, he wouldn't be able to enter the files or do any changes, make any changes.
He would be only too able to browse the files.
On.
On here?
Nothing.
You will need an nvme server.
You'll be guided just like right now.
I'm guided to an Http server.
Right there.
He would be guided to an nvme server.
Right.
Your SSL VPN gateway.
Okay, we can play around with this.
You can also go to the other guy if you want to.
Http ten, 11, 11.4.
The other guy.
You may not unable to connect to the server at 1011 11.4.
Let's check why?
Tribe interface Brief show run section.
Http.
Because I have not enabled.
IP http.
So once you enable it.
Ten, 11, 11, four should be able to open the.
This is the thick client list.
Clientless.
You're not configuring anything.
On the client side.
This is the client, right?
What am I doing on the client?
Just logging in and doing what I want to do.
I have access.
You could also make changes to it.
You could add a banner.
Now that cosmetics and the changes are up to you, but you could also do is delete this.
I could go to R2.
Or the gateway.
I could go to the web VPN context, then go to my policy.
I have a banner I can say, Welcome.
To the world.
Where did I do this?
Under the policy, the policy is already called.
Isn't it?
I just went into into the policy.
I said banner.
And then I went down here.
What I'll do is I'll log out.
I log back in again?
Welcome to the.
Banner pop.
So all the changes now you make on the gateway, on the context will be reflected to you as the gateway.
You can change pictures, you can add login photos, you can change colors, text, color, URL, file
a lot of things.
We'll see that we'll do certain things here and there.
Clientless.
Do you see the problem with client?
You can only access the Http and.
The other things are still around out there, but you can't access them.
We'll be using thin client for that.
What do I mean by that?
Say for example, I wanted to access R1 for Http sorry, Telnet services.
I cannot do that right now.
I don't have the capability.
How do I do this?
The only access I have is to this page.
How do I tell it from this page?
I cannot.
If I wanted to use Smtp R1 for Smtp services, I can.
I can only use certain services.
Good thing you don't have all this.
We don't have all this.
How you're actually.
What are you accessing?
When you open it, you're accessing Http.
You're actually accessing Http now.
If it was not encrypted, all your photos, pictures and everything that were going up and down would
be open.
Clear text.
Now, when you're uploading a photo, you're uploading a profile picture or you're sending a message,
it's encrypted all the way across.
From you to the other side.
But whether an English.
Here.
The Facebook page that you get for login is this.
The one which you get right there.
Username and password that's that's hard to hard to displaying his page.
Once you log in your enter you already entered then you're here.
Hey.
You're actually accessing.
If you remember, I think 3 or 4 years ago, Facebook was Http.
They'd had nothing to do with this.
Then they there was I remember there was a message which they sent to everybody that we're moving our
servers to Https.
So you will get that's with Http.
Now I remember that happening.
Then people.
A lot of websites still are.
Still are.
Must have because it's quite easy to do that now.
You just have to get a connection.
You just have to get yourself paid.
That's it.
This pages are to these pages are to I think it might even say somewhere.
What is it using?
It doesn't.
Depends.
Certificates are usually expensive.
I've never actually purchased it myself, but it should be expensive.
You get an Https because if it wasn't, then everybody, everybody would be doing it.
Hey, so you have to go through a protocol or something like that to get it.
Host a web page.
It can only host this web page.
Ready to go.
Can only host this web page.
That's it.
Then you said.
That you can customize it.
Can I make this?
Yes, you can.
You can change the logo here.
You can change the font here.
Yes, Yes.
Yes.
Yes, definitely.
You can just upload.
Usually what you have is Now this is Cisco.
As I told you, I was not that famous.
There's a lot of other vendors out there which give you customizable, complete, customizable page
so you can upload your own set of page, you can upload your code for the page so you can have your
full document for the whole page.
It will look exactly like what you want it to.
You can have logo wherever you want it to be.
Complete customization.
So here again, you can do it here.
Also, if you want, you can remove all of this, but a little difficult because you'll be doing it
from CLI.
There you saw most of the time you'll use Juniper.
Also, Juniper is also known for its SSL VPN, even check point.
Also also also uses the same right, G1.
Most of the times.
But this gives you a good concept of how the whole process works.
Once you get the process, then you configure it.
It's quite easy.
There is just a click here and a click there.
You're done.
Okay, let's take a break.