Right.
We've already seen this before.
The same concept will be repeated again.
Nothing will change except for the device which was the router before.
Now it's a.
That's it.
Right.
Let's talk about it again.
Company.
Right here.
Connect it to the Internet.
You can consider this part to be the HQ.
Right.
So this can be considered as.
And you want to connect up to the HQ using router as a client.
And this is what the VPN client on a host machine.
Public IP is here.
Here.
Let's have a look back.
Okay.
So you want people on the on the inside network to communicate through the tunnel across to these servers.
And this guy who's sitting on a host PC connected to the Internet should also be able to access these
devices right here across the Internet.
They're connected across.
Right.
So.
This is going to be my server.
This is going to be a router as a client.
And this side is going to be the easy VPN client, the software to connect.
Now, I have configured the devices.
This guy.
And this.
Not.
Not this one yet.
We'll do this later.
Let's do this one first.
Okay, so I have configured this.
The only thing that is left is the AC or the pics.
Let's start on it.
Now interface Ethernet two is the one pointing upwards inside.
I'll call it inside.
Security is 100.
IP address is ten.
11.
Ten.
And no shut.
The other one is Ethernet three if.
Outside security.
Zero.
IP Address 151 .3. ten.
This is the address that others are going to come up to.
Okay.
Also require a root.
To the internet.
151 .3.3.
Correct.
Right now should be able to ping R4 for sure.
I can think.
Okay, Done.
Save.
Now, the good thing is that R4 and the ACA have connectivity.
Now I just need to configure R4.
Sorry.
For what?
For VPN capabilities.
Now let's go back a little and talk about what VPN was before and how did it work.
First of all, what we did with the VPN was all the policies were defined here.
If you remember, all the policies were defined here.
The transform set was defined here.
Your access list was here.
Split tunnel ACL that use your configuration group.
The key to that group was also.
Right.
And then everything was pushed down to the client.
The client had nothing.
So all the information which you had was there on the.
We just push it down.
Okay.
Again, if you want to go through.
Let's make it easier.
You'll use what?
This is which one?
IPsec Remote access.
And then you go for the steps.
Now, you could use this.
It will give you everything else, but not recommended.
Right now we try to do it without it.
It'll show you everything, all the steps and whatever you need to know to configure it.
On the other side, we'll configure it based on what we knew from before, and you'll see how easy it
is to do it here as compared to the one on the iOS.
Step one obviously the same crypto policy.
Then encryption.
Reader's authentication.
Hash MD5.
Remember MD5 is VPN, right?
Since I'm using the VPN client.
Correct.
We did this.
Requires, but requires an activation to.
There you go.
Show version.
Now it does support let's do the same thing.
Crypto ICBM policy ten Encryption three does authentication Pre-shared hash in the five and group.
Today.
Do I need to specify the key?
I do not need a key.
But what do I have instead?
A group name.
Do you remember this from yesterday?
Tunnel group here.
I used to specify about the IP address to specify the peer.
Now I'll specify.
What?
What type L to L or remote access this is.
Then again, tunnel group sales.
Now you get more attributes to it.
You have VPN attributes, you have general attributes, you have IPsec attributes.
What you're going to be working on is general is for what I told you yesterday.
Two things.
General is for the pool, for the split tunnel and all the other things.
If you want to do the key, it is done in IPsec Attributes.
Go to IPsec attribute.
So you have all those options here.
What do what do I want right now?
I want to use the Pre-shared key Pre-shared key will be Cisco.
Group and key.
Right.
Group sales key.
Okay again.
Tunnel group IPsec attributes.
And then I specified the key.
Okay.
Once you do this.
You also have to do your IPsec transform set.
P set esp guitars esp MD5.
Configure the transform set which is supposed to be used.
Right.
You also require a username.
Now if you remember we use username where last time.
We use the username to bind the group policy.
Right.
You brought in the group policy into what?
Into that username.
So we specified a username password and then to that username and password we applied.
What?
How did we do that last time?
If you remember.
Authentication was used already.
Is the tunnel.
For the authorization.
Yes.
So you have your username and password, Cisco.
This will be used only for what?
This will be used for x auth.
Extended authentication only for x SR.
Right now what the most important part right now to me is IP local pool, because the VPN, the important
part is that I should push down a pool to the user split tunnel I will use later.
Right now I need to make sure that I push down a pool.
I'll call this pool.
Anything.
192 168 dot let's say ten dot one and 192.
168 dot ten dot ten.
This is the pool that I'm supposed to push down.
Where do I push down the pool?
Tunnel group.
What is it called?
Sales.
General attributes in the general attributes.
The option is address, value.
Address pools.
Then the name of the pool is.
Correct.
You have other options here too.
This one is important.
So you're pushing down that pool to the users, right?
You could do some other stuff here also.
You can have some other stuff here.
But most important is the pool that is supposed to be pushed down.
Right.
I would also require.
What?
It is provided.
I would also require a group policy.
Now, what do we do in this group policy?
This is.
Do you remember this?
Do you remember the group policy?
You have to define it separately.
Group policy.
Call it anything.
This is an internal policy.
And then.
Attributes of the policy.
Here you have certain other values available to you.
This is where you do what Your split tunnel and your split tunnel network.
Just like, where did we do this before?
If you remember web VPN, web VPN, we had the same thing.
Yes, there was username, but username is not used here.
Username was used in web VPN.
We had everything.
The group policy was bound to the username.
So in the username we set default group policy is whatever.
Now we won't do that.
Now we what we did was we created a tunnel group.
Basically saying sales and he was.
Cisco.
To the cells.
I also attached.
What?
Group policy.
Now in that group policy, I'll have split.
I will have network specified or network all tunnel all or tunnel everything.
And I would also now the pool can either be given here or it can be given inside the group also.
Last time when we did it, we did it through the group policy.
Right?
We specified the pool in the group policy and then it was called.
So let's do that.
I'll go here in the group policy.
I'll specify the address pools.
Value is pool split.
Tunnel can be done here, but I will not do that right now because I have not created the split ACL.
So run tunnel group.
I have this right here.
So what I'll do is I'll go inside my term group sales IP, general attributes, no need for address
tool here because I'm already using it in the group policy and you can call the default group policy.
What was it called?
What did I name it?
Also since.
Also sales.
Okay.
Again, notepad.
So I said tunnel.
Group sales key.
Sorry.
Key and channel group sales.
Then I specify type.
This is IPsec.
Remote access.
Then done a group.
Sales.
And then you specify IPsec.
Attributes and where in which you specify the Pre-shared key is Cisco.
Then you go and go again.
Tunnel Group.
Sales general attributes.
Here.
I specified what?
Default group policy is called also sets.
So I went to the policy group.
Policy.
Sales.
This is an internal policy.
Group.
Policy sales attributes.
What are the attributes of sales?
The important one is.
Address.
Pool value is cool.
You can also do split ACL and NM and all the other stuff is done here.
Correct Maternal group is created.
Maternal group policy is created.
My IPsec Transform set is created.
What else do you require on the server side?
A map.
A crypto map to bind all of this together.
The problem with crypto map is this case is going to be dynamic.
I would require a dynamic crypto map.
So when you create a map, you say crypto dynamic map just like before d y n specify the number ten
and then you don't press the enter key as before here, just like the access list yesterday, you just
specify it in the same line.
So match.
Address.
We don't need match.
Address.
We need set.
Transform set.
Set no matter Dressier.
Okay, so you have this then?
Crypto map.
I map.
Then IPsec Isakmp and then you specify the dynamic map was defined.
Buying the crypto map together.
That one to this one.
What else do you need to do?
Apply it on the outside interface.
Crypto map map interface.
Outside crypto I can enable anything else.
Crypto imap.
Crypto map.
Client.
Authentication this will be used for.
This will be used, for example.
No, that's not here.
I not.
You don't need that reverse route.
Yes, but we'll do that later.
Reverse out will do later.
So it's enabled on the outside interface.
What did I use?
I said.
Capital.
Map.
Crypto dynamic.
Map y n ten.
Then I said set, transform, set t set to bind it to the physical one.
I said crypto map.
I map ten.
IPsec Isakmp dynamic is the.
The crypto map I map.
Interface.
I'll take.
Crypto map map.
This is case sensitive.
The price.
Enabled.
Right.
No need for set pair.
No need for match address.
The only thing that you need is the transform set which you already bound.
Then you apply that crypto map on the outside interface.
You enable escape on the outside because by default, the service is disabled.
Right.
Done.
Let's try and see if this is working.
Show run.
Crypto first, let's check the configs.
Dynamic map is correct.
Apply to the outside interface.
All is good.
From here to Sunset is also here.
Show Run Tunnel Group.
Tunnel Group is sales policy and sales show run.
Policy sales is here and the address value is.
Let's go where our for how do you connect from for crypto IPsec client VPN easy.
Here is 151 .3. ten.
Correct or not?
Group is.
He is.
Connect.
Auto.
More, let's say, client.
Create a loop back.
Do you guys remember or you forgot?
Remember this interface fast Ethernet zero zero crypto IPsec Client VPN easy outside interface loopback
zero will be crypto IPsec client is an easy moment.
You do this, it will try to create that connection up.
It says what?
Pending requests.
Pending.
That's because by default.
By default, x auth is enabled.
On this.
By default, you have to disable it.
So you go to the ESR.
I think it should be in group policy.
Sales attributes.
There is an m here?
Yes.
User authentication?
Yes.
Let's do this user authentication disabled.
There was a there was a command.
So let's try clear crypto IP client is.
We will try to connect up again.
That's not it has to be somewhere else.
User authentication.
No need.
Split tunnel.
Not required right now?
Nope.
VPN filter sessions Tunnel protocol.
Let's try in the tunnel group sales General attributes.
Authorization Authentication Server group.
Then because it was somewhere.
Is a command in the IPsec properties.
Key client authorization required.
I said camp.
Yes.
So.
Crypto IPsec.
Market channel Group Sales IPsec.
Attributes.
It's where I camp.
Not here.
It's.
The first option.
I agree.
One user authentication, I'll say none.
So I'll remove it by default.
It's what?
The music.
Now go to our four player Crypto IPsec client is a VPN.
So it's.
Like the same concept if you check here show crypto IPsec client is VPN, you'll have the same things
again.
Same things as before.
Right?
Show IP route will show you what nothing here but show IP interface brief will show you.
An IP address has been pushed down to loopback 10,000 just like before Show Crypto IPsec will show you
anything which is sourced from 192 168 10.1 will go through the tunnel.
The remote endpoint is 30.10, local endpoint is 34.4.
Also along the same lines, if you go to if you go here and you do your show route, you have what by
default route is set to the other side.
So now I can 192 168 .1.1 I can ping the guy.
Right.
The question is, can the guy are four?
Can he go to ten, 11, 11.1.
Right.
Like this cannot.
But if he uses the source of loopback, 10,000 then should be allowed to go here as well as if he wants
to go to ten 1111 dot two.
And other things.
Everything.
The concept is exactly the same.
There is no difference at all.
Right.
The tunnel which is created show crypto campus a middle.
Right.
If you want to check from this side, it just shows you differently.
But it is the same.
It just tells you it's called a m a m y.
Why am if you remember is a VPN uses what aggressive mode not main mode.
It uses aggressive mode.
Everything is negotiated with three packets instead of six.
Right.
So am active.
Right.
There is no rekeying procedure here because I'm not.
It's not get VPN and the peer which I'm creating the tunnel with is 30 4.4.
Okay, so Crypto IPsec is same.
How many packets have gone through?
Right and inbound and outbound.
You're using crypto map which won the win.
The actual map that you're using is the dynamic map show.
Crypto map.
I don't think you can see it.
Here.
You can't on the router, you can't.
So if you go to router show.
Map.
I'll show you the time.
But here it's fine because everything is coming down from the top.
Right?
So this is what you have received from the Transform set.
On the other side, you're using group two.
You're not using FS right now and you have your current pair is 30.30 access list.
Look at the access list that has been pushed from you to.
Tunnel.
Everything.
We call this tunnel everything I want to do what I don't want to do, tunnel everything I want to do
tunnel specified.
Basically, I want to have a split tunnel in here.
Let's do this.
Let's remove this.
Let's start our.
And let's run up and see if it works the same way.
I need to make sure that it is bound to net zero.
I also need to configure.
VM zero has what?
150.
No, not this one.
I need to change this.
Two.
151.
This is 35.101 and the XP machine is going to be 35 point, let's say 25.
Again, zero is correct.
In the meantime, I'll go to the Just create the split tunnel.
I'll keep it there.
Access list.
I'll call it split permit IP.
From which network?
Ten, 11.
11.1 or 0.
Let's say one only.
Going anywhere.
I'll just create.
This is the split tunnel that I'll be using later.
But right now I don't need it.
Right now I just need to make sure that my VPN is working properly.
So let's go here.
First of all, let's change the IP address.
Right here.
Is 35.25 and the next hop is 35.3.
Correct or not?
Close.
Check if you have connectivity.
By bringing these.
151 point 30.10 is the as I am getting a reply from the ESA.
All I need to do to connect up is what?
Open my client.
Create a new connection.
What is the name of the server?
This is RSA.
The address is 151 .33. ten.
Group name is.
He is.
Cisco.
Connect up.
Securing connections.
You're done.
Connection has been formed.
Right?
Now if you go here.
And you check the statistics, you will see that this is a tunnel.
Everything right now and tunnel details are right here.
Same.
How many packets are encrypted?
How many decrypted can you go to?
The question is, can you go to the servers right now?
1011 11.1.
Yes, I can.
I can also go to ten, 11 11.2.
But I have lost connectivity to the internet, so I cannot go to 151 dot 30 5.3, which is directly
connected to me because this traffic is also going where to the VPN server tunnel everything.
Everything is going to the server.
How do I fix this?
I'll go to I'll go to the server.
I'll go again to group policy.
It's called sales attributes.
I'll say split.
Tunnel network list is called.
I'll call it split.
I'll also say split tunnel.
We have tunnel policy.
Return policy by default.
It's done all.
I'll change it to tunnel.
Specified.
Correct.
Exit.
Disconnect and connect up again.
Disconnect and connect again.
You're up.
What are the roots that have come down?
Only one 1011 11.1.
You can only go to 1011 11.1.
So if you go here now and you try to go to ten, 11, 11.2, you should not be allowed because you're
going where to the Internet to look for this address.
If you go to one, this should go through the tunnel.
If you go to your Internet, your connectivity should not be stopped.
So.
Got got You can still go to the.
Okay.
Any questions?
Nothing.
Same thing.
Same thing as yesterday.
Yesterday.
In day before yesterday in VPN, we applied the split tunnel exact same way, copied the split tunnel,
put it in the group policy there.
The group policy work was called in the username here.
The group policy is called in the Tunnel Group.
Why?
Tunnel group Because you have the group key and the name group is sales key is.
Call the policy there.
Correct.
This is the client mode, right?
Right now our for wasn't mode client.
What is the other mode?
Mode network extension.
The moment you do this, you will see that it will not work.
It's down, is it?
It will not work.
Why?
Because by default name is disabled on a on a firewall.
You have to enable it by yourself by going on the firewall.
Network extension mode is disabled.
You have to enable it in the group policy.
Sales attributes.
It's called Nem network extension mode, enabled by default.
It's not allowed.
The moment you enable it, you'll see that network extension was enabled and the networks have gone
up.
Which networks?
Ten 440, if you check.
If you check your AC show route, you have the route to 192 168 10.2, which is the other side.
You don't have the right to ten .4.4.
Why don't you have the route?
The networks have come up, if you check remote subnets, have gone up ten, four, four zero.
But the route is not on a say.
Why not?
Dynamic ten set.
It was.
Remember?
Reverse rout.
Then clear it now.
Clear.
Crypto IPsec client is.
Down.
Back up again.
Okay.
For this guy.
Also when I give you my address.
Right.
I'm giving the server my address.
Network extension.
He doesn't have the IP.
I'm giving you my address.
You need to find out the route.
You need to insert a route towards that address.
That's reverse route rejection.
You have reverse route.
Now you can go to ten .4.4.4.
Obviously you'll have to use an address because this site will not know you.
So.
So crypto type exec and with anything that is sourced.
Okay any obviously.
So you will not be able to ping who would be who will be the only guy will be able to ping our.
110 .4.4.4.
Any network extension.
And with split tunnel.
So this guy is allowed access to 10.4 from both ends.
Now, earlier, you didn't have access from the server to the client.
Only the client could access the server's resources.
Now, the server can also access the client's resources used for small sites to connect up to the headquarters.
Small sites with 50, 60, 70 users to connect them up, they can go up and the servers can also come
down and communicate with them.
Just like you land to land.
Correct.
So let's enable X off.
Crypt tunnel group sales.
IPsec attributes.
Right.
I camp right here.
Icon authentication should be.
Username Cisco Password.
Cisco Securing it.
And connecting up.
So now you have that extra authentication.
You will require the username and password to connect.
Okay.
Similarly on here.
Not always do this on the global user Exact username Cisco Password.
Cisco connect up.
You still have the remote subnets right here.
So you go here, show shout out.
The other guy is the client and I'm the one is remote access.
Sorry, one is network extension, the other is mode.
But.
Everybody okay with this?
This is easy VPN with dynamic maps only.