All right, let's start.
What are we doing today?
We're doing Flex.
Flags.
Server.
And client flex server client.
We have done, spoke to, spoke.
We have done SVT DVT set up the last VPN in flex is server and client.
What does this represent?
What is it?
In familiarity with easy.
You have to understand some things.
Easy VPN has been there for a long time, so a lot of software has been developed already for easy VPN,
VPN client and all the other kind of stuff.
And router can act as an easy VPN client and all the other kinds, right?
But Flex VPN is relatively very new, very new.
So a lot of software has not been developed yet.
It's still in the beginning phases, but the basic setup of what you do with a router as a client and
with the VPN server is the same.
You have a flex VPN server and a flex VPN client, and then you can make the same tunnel like you used
to do before, share the same things like you used to do before.
But the only one thing the difference here is there is no n m.
There is no n m mode.
There is no any plus mode.
Nothing like that.
You do all of it manually.
What do I mean by manually in network extension?
I used to extend networks from my side to the other side.
Right.
And the normal mode, the client mode was I used to get an IP address and the server used to have a
static route towards me.
Right.
The same thing is done here.
You know exactly how to do it.
You know how to install the static right route from the server to client to the interface as well as
to that network that is inside.
We did that in Dmvpn.
That is why flexibility is there.
Now you know how to do dmvpn.
You will tell me how to do flex.
I will not tell you.
You will tell me the steps for flex VPN server client.
You know it.
You have done it already with just one small minor command.
You have to do it on the client.
Everything else is the same.
Okay, let's do that first and we can look at the concept later.
First things first.
Our IOU.
Was suspended.
Suspend.
Resume the guest.
Make sure that I'm using the same interface which I need.
Vnet one which is host only.
That is fine.
We one What is the IP 19221638210.
Perfect.
Hey, dude, I 100 will open my IOU.
This right here.
I also need to open my secure CRT.
The good thing is I saved everything yesterday, so it'll be easier.
Starting from one.
That's fine.
Everything is saved.
You don't have to city in this.
There is no serial fast Ethernet.
You have Serial which is already there, but we are not using it.
This one.
These are serial links.
These ones.
I'm not using it.
This is not the only topology you can use.
You can go to the internet and download some topologies for here, and then you can import it in downloads
and manage.
You can import those topologies, but you really wouldn't need them because this will definitely cover
everything.
Eight Routers is more than enough to cover routing and switching.
I'll cover most of everything.
These eight routers are in your lab.
Sorry.
CCI, Lab routing.
Switching.
Look at how big the topology is.
So this will cover your everything.
You don't need anything else, but if you still want, you can download those sample labs and import
it in.
I do.
Are three.
Five.
This two and.
So which one should be this?
This the second one?
Probably.
Yeah.
Okay.
So I have everything.
Let me see the routing.
My this is which one server client spoke to spoke.
Does this book just work?
If everything is fine, if everything was saved yesterday, we can still verify it.
Three Yes.
Two is the internet.
I have this all coming from 10.1.
Create a virtual access, an Http relationship will be set up.
I have this, but there's a problem.
There's an override here.
So that means my.
My mappings are not perfect.
Maybe they are.
They still go through here?
I'll have to shut my tunnel down and bring it back up again.
But from our four.
Hartford is also the same.
So let's go in here.
Interface Channel zero.
Shut.
I?
No.
Okay.
Good is going straight.
Spoke to.
Spoke.
Now R4 and R3 are spoke to spoke.
Are one.
I can do the same thing on the same topology, but I'm not going to do that right now.
We'll start over from zero.
All I have to do is just change one thing.
But I won't do that right now.
What I'll do is I'll erase this and reload.
Because I want to set up a server client relationship.
Between whom?
R1 and R5.
The diagram is the same as yesterday.
Part one will be connected to the Internet.
Part two will be inside and half will be here.
There is no smoke to smoke here.
Remember, it is not smoke to smoke.
This will just act as a client to this game, just like an easy VPN service.
Does he know what the IP of this guy is going to be?
No, he does not, because he's the server.
These guys will connect up from home from their internet connection.
So he doesn't have to know.
Do they need to know what his IP is?
Definitely.
Right.
Everything else will be the same.
You'll see the similarities between VPN on Plex and Easy VPN on Plex.
Let's start and help me with this, because I want you to critically think about it.
First step I need to create.
First, let's think about it.
What do I need to create on R1 DVD?
I need to create a DVD.
Should it be protected?
Yes.
Yes, it should be protected.
So for that I would require a profile.
For the profile, I would require an Ik v2 profile also.
Right.
So I'll have a virtual template for the DVD.
To protect the virtual template, I will have an IP sec transform set profile plus Ik v2 profile.
Right.
Do I need to push any root down?
Yes.
Because my internal networks ten .1.1.1 should be pushed down so they can reach up just like I used
to do in an ACL.
A split ACL.
I used to push it down.
So I need to do that also.
Right from the from the client side.
In the beginning, we'll just do client mode.
Client mode does not need to fix anything up.
He does not need to send anything up.
Right.
But he needs to set that one interface.
Which one?
The IP address that he's going to receive.
He needs to tell the server, Hey, you gave me this.
Have a static route towards me.
We'll talk about the server side now.
What is the first step?
What am I supposed to do in the beginning?
I need to create the Ik profile for that.
Do I need to change the default policy?
I need to do root set interface node set interface is there the access as well as access list?
I need to push down access list as well as an interface address.
So.
So I do need to change my authorization policy.
Remember.
So what are the steps?
The first step is I enable the model and create an authorization list which points towards my local
authorization.
Now, this is not spoke to spoke, so I do not need to do it on the default.
I only need to do sports spoke to spoke default default when I'm doing spoke to spoke because as I said
there are there are some bugs so it does not work with if you change the list you need to do it on the
default for server spoke here.
You can do it on any.
So name it anything authorization network.
Local.
Right.
So I'm telling him that the authorization policy is going to be done locally, but I need to do it locally,
so let's do it locally.
Crypto Ikev2 Authorization Policy.
Call it anything I call.
And what am I pushing down?
Root set interface.
And.
Without said.
Access list.
Then I have not created ten.
So before I do this, I'll go in here.
Access list ten permit ten 1.1.0.
So I'm pushing 10.1 network down so they know where 10.1 is.
This is a standard access list.
I'm pushing down so he'll have a route towards this this network.
If I do ten dot zero, he will have a static route towards ten .0.0.
Whatever I push down as the access list will be installed as a static route on the other side.
That's why you don't need to specify the.
For this.
This is standard.
This is a standard access list.
If I had 100 here, then it was permit IP from this source to this destination.
Here it's a standard access list.
So I'm just pushing that down.
I just need the source.
I do not need the destination.
I just need to tell him where to install the route to.
Right.
Then this part is done.
I need to put all of this.
Where?
In a profile.
Ikev2 profile.
Right.
I call it in the V2 profile.
For that, what do I need?
All those proposal and policies for the profile.
I'm telling you the steps so you can link it up together when you're doing it.
So what is missing now is the crypto.
Crypto ikev2 proposal.
Prop encryption three days.
Group two.
Integrity and MD5 done.
Crypto Ik v2 profile I.
Prof.
I didn't do one thing here, which I had done before.
There was a pool.
Yes, I forgot to do the pool because this is easy.
VPN Yes, Access is when it is pushed down, the source and destination won't be changed like we did
for that was easy.
VPN no see.
Easy.
I only did a source he does not installed.
He does not use it to install the root as a static root.
Remember yesterday I showed you this when we did root set access list.
This one address will only be used so that the other guy installs it as a static root.
He will not use it as an access list there.
Just like I do.
Root set interface.
He installs a static route towards my interface, so the access list is converted into a static is a
static route.
On the other side.
Exactly.
Just a static route.
Okay, this is easy VPN, so I also need a full VPN server.
So I also need a pool.
So this does not become two.
This is three.
Two will be.
IP Local pool flex.
1.11..
I can have 100 users, 100 clients.
And where do I call this pool?
Cool.
Let's.
Flex.
Was it pull?
So he's going to push down the pool to the other side.
Right.
So give out an IP from this pool to the other interface.
Then create send out a static route.
Tell him to install a static route towards you and also tell him have a static route towards my internal
networks.
10.11.
10.1.
Point one.
Okay.
Done.
Then profile, not profile policy.
Policy.
Paul What do I call in here?
Proposal prop then Keating Crypto ikev2 keyring cr my peer is any addresses and.
Pre-shared key.
This heating is done.
I need to profile, create a profile.
So this is for step five will be profile crypto Ik v2 profile.
Call it anything ik.
What was the next step?
Match.
Address.
Match Identity.
AWS Identity Remote Address 0000.
Anyone can come in and create a profile with me and.
Authentication.
Local Pre-shared Authentication.
Remote Patient KeyRing.
Local key.
And do I need a virtual template?
Yes.
I need a virtual template.
Virtual template.
So I need a virtual template so that I can create a DVD downstairs.
Yeah, I forgot which one.
After virtual template or before this?
Triple A authorization.
I'm using group not user group.
User is for triple A server.
If I'm using a user based authentication on the triple A server and I'll be using SRC, not EAP, not
anything else.
I'm not overriding.
I can override if I want to.
That will work.
That command will also work because I'm not using users anyways.
If you use override user will never be used.
But that's okay.
I don't need it right now.
SRC and list.
List.
List is the name.
What is the name of Good?
And the other one is the username is Ike Paul.
I call is which one?
The policy which I created right here.
Where did it go?
This one.
The one which I edited locally.
I edited this locally.
When I say ruleset, interface and all the other kind of stuff, right.
Virtual template.
Now what is the next step?
Step six Crypto IPsec Transform set to set.
DSP three days.
DSP MD5.
Good.
Crypto IPsec Profile.
I.
Set.
Transform.
Set d set.
Set ik v2 profile.
Next step.
Yes.
What is the next step?
Interface Interface.
Virtual template ten type tunnel.
Do not forget type tunnel.
Keep on repeating this tunnel source is 192 1.1.1 no destination IP address.
What is my IP address?
A number.
What number?
Maybe I need to create it.
I need to create the loopback 11 and give it an address of the same range.
Right.
And then IP and numbered loopback.
11.
So the source is done.
IP is done.
Destination.
I don't know.
Can this be a pure IPsec tunnel or does it have to be GRE?
Does it have to be or can it be pure?
Am I using an air in here?
I'm not using an air.
But if we try to connect many users, then it will not.
But they are not talking to each other.
Then you have to understand why do we do server and client server and client for the clients to access
their internal networks only for that reason.
So there is no spoke to spoke here.
If you do that you'll be going back to spoke to.
Spoke.
I don't need spoke to spoke communication.
That is exactly what Dmvpn is.
That is the only difference between the two.
Here my job is for the remote users to access the headquarters and whatever is behind the headquarters.
Okay, so IP number loopback zero tunnel mode IPsec IPV four and tunnel protection.
Use protection IPsec Profile.
I.
I'm missing something.
Nope.
Let's check this again from the beginning.
New model network is local.
Authorization is done locally.
What is my local authorization here?
Whereas a root set interface, root set access list.
And the pool.
The pool is defined right here and my access list is defined right here.
So they're all called here.
This needs to be called in the profile to create the profile.
I need this stuff.
My proposal, my policy, my key to create the profile.
Call all of this and also call the authorization group, which I just created a group along with pointing
to the local list.
And the group is right here.
Then you have virtual template.
Why?
Because I need a DVD.
So now I need to configure parameters of the virtual template.
I will require a transform set.
I will require a profile IPsec profile where I call the Transform set along with the Ikev2 profile.
Finally, configure the virtual template and protect it using the IP.
Right.
Copy.
Is the same thing we had done before.
There's nothing new in here.
For this book.
We are not using we we're not using DVD for spokes to spokes.
This has nothing to do with spokes.
We are not using here smoke to smoke.
We use because we're supposed to use and HIV works in conjunction with GR.
Is this okay?
My virtual template is down.
Why is it down?
It will be down because virtual access is up.
Virtual template is always down.
The protocol is always down.
Now to create the virtual access, it'll be done from the other side.
This is the side.
This is where there's a little different.
Until now it's everything is the same except for the pool we did yesterday.
The only one thing that I added was route set access list interface also I had done yesterday.
Interface also had done yesterday.
So can I do this now?
Let's go to create a tunnel with R4 R5.
I'll create it with R5.
Go in here.
New model.
Why do I need to do this local here?
Check the local.
Why do I need to create a policy on the client side?
To one client side for root set y so that the other side will know where I am and my behind address.
And if I need to do network extension mode, then I need to do the access list also.
First, we will not do the access list part.
We will just do this part.
Do I need a pool?
No, I do not need a pool.
Let's do this separately.
I need a pool.
No, I don't need a pool.
I need a access list right now.
I don't.
So pool and access list, remove it.
The only thing I'll do is basic route, set interface.
So he knows what IP he gave me.
And what is the virtual access it's coming from?
He installs a static route towards me.
Do I need this?
Obviously I need this.
I need this.
I need this as well as this.
Why?
Because I have to point to I am setting a route set interface.
Do I need this?
No, no, no, no.
It's not a DVT.
It's a static transform set.
Yes.
Profile.
Yes.
Lubbock.
No, this will not be a virtual template tunnel.
This will be a
tunnel source.
25.5.
IP address.
What is the IP address going to be?
No practice yesterday.
No one practices yesterday.
She negotiated.
Negotiate from the other end, then tunnel mode.
Same tunnel protection.
Same.
Right.
I do not know the destination.
That is exactly where the difference comes into play.
The destination.
I'm not going to put it inside the tunnel because I want this to be accepted as a client.
Right.
He should be accepted as a client.
For that, I'll have to do this one extra command which says tunnel destination is dynamic.
Dynamic y dynamic.
It's the same.
I'm still specifying the destination, just not there, but in a different module.
I'm just taking it out and putting it in a different module.
I'll see what that is.
We'll see what that is.
Right.
Until now, everything is okay.
This is okay.
And this is okay.
First things first.
Zelda.
One is.
Start configured Ethernet zero zero.
Hopefully it's Ethernet zero zero.
Shot in the dark.
Yeah.
That's too many O's.
It's not zero zero.
I'll have to check.
I five it is zero zero.
Have I put it in the right villain?
Switch one show.
Yeah, that's.
That's what I'm checking on.
Brief.
Okay, First, I'll have to check what port this is.
WI fi.
This is 111.
One needs to be put into 25.
Ethernet one one.
Switchboard Mode Access Switchport Access Vlan 25.
It wasn't even created along the same lines.
Let's check if this has 25.
Does not have 25.
So here also I need to create 25.
Encapsulation dot one Queue 25 IP Address 20 5.2.
Okay.
The number five should be able to reach.
That one?
No.
Why not?
Do you trust this guy?
Why not?
12 to 1.
Something's wrong with that one.
I restarted it.
So there's no IP address on the side.
Okay, so R5 is reachable to R1.
Now I need to paste all this beginning from a new model.
Done.
Something is wrong.
Where?
I agree to policy.
To up model local.
Everything else should be okay.
Everything is okay.
But.
To check this guy has nothing.
Transito has nothing.
Why?
Because his destination is not there to do the destination.
This is the only place where you'll use this one command.
Until now we have done flex VPN.
Have you ever seen that keyword flex VPN?
We did not see it.
It's only in the client that you see it.
Crypto Ikev2 Client.
What client Flex.
This guy is going to be a flex VPN client name this anything.
Just like we do it on a server, we name it anything.
So f x.
Flex.
Okay.
And then you have certain options.
You remember some of them.
The first one you'll use is here.
You need to give a sequence number of the peer, Right?
Why?
Because in this you can also have backup VPN servers.
You have one flex VPN server.
So the sequence number one will always be tried.
If he cannot reach there, he'll go and try the second one.
For tunnel destination.
So you have that flexibility also on the client side.
If one side is not, you have two backups to easy to flex VPN servers doing the same thing, but different
IP addresses now.
So if one goes down, you can reach it from the other side.
All you need to do in that case is do it here.
Peer one is this peer to peer, two is the other one.
He will always go to peer one first.
If peer one is down, then he'll try Peer two What is Peer One's address?
So it's like priority.
It's like a priority.
It's like your Isa camp.
You have priorities, right?
Isaac Camp ten, 20, 30.
Ten is tried first, then 20 is tried.
My public address there.
So the destination there is specified here, but I need to link them together.
Client Connect tunnel which tunnel connect using tunnel zero.
And I also have that Connect auto.
But before I did that, the flex VPN client is up.
What is this server?
Public address.
12.1.
And the tunnel has been assigned.
What address?
21.
Should I it out?
Does he have that static route?
He has the ecstatic crowd.
This is one thing I wanted you to see.
If I ping 10.1, will I be able to reach it?
I don't have a loopback, so let's just create a loopback first.
I cannot reach it from 10.5.
I should be able to reach it from my normal interface.
But I'm not able to.
Can anyone tell me why?
Because of.
No.
He has a static route through the tunnel.
The other end point of the tunnel is one.
There's one thing from here I want you to remember.
So that's why I want you to think.
I have the axis.
So the axis is telling me to install this root.
I have that root.
Another out.
Also, it says go through the tunnel.
If I check my tunnel.
My sources.
25.5 destination is.
On one.
Let's check the route on R1.
I have.
Have this guy, right?
And I have a static route towards the virtual axis.
I have done it.
So that's how I have 21.
That's how I have 21.
If I ping 21, it goes.
I can ping the interface, but I cannot bring it with the source.
Why?
Yeah.
Not any.
Check this.
No authorization.
There is no loopback.
Why?
I wanted you to show this.
Even if there is no loopback, the route still goes in here.
Why?
Because this access list, which you push down, has nothing to do with if the network actually exists
or not.
It will just be purely what the access list states.
There was no 10.11, but he still pushed that route only because the access list stated it.
He does not care if it exists or not.
It's just pure one command.
Whatever is in here create a static route towards me using that.
You understand?
Show IP interface brief.
These tunnels that were going down.
These were the older tunnels.
The one with R3 and R4 spoke.
Two spoke.
Why?
Because my characteristics changed.
The other side is Mgr.
Sorry guy.
This side is IPsec IP.
That's why he's not able to create it with them.
So.
So that we don't see these messages.
What I'll do is I'll shut these tunnels down for some time.
Okay.
Is this clear?
Now, what do I have to do?
Create that loopback interface.
So our five can ping.
Not with the sauce.
With this?
Why not with the sauce?
Because he does not know what that side is.
He doesn't know what we're 10.5 is.
That is network extension mode.
I'll have to do it manually.
I'll have to do it, man.
See this?
This is No, this is the static route for the tunnel.
The other side of the tunnel.
There's also one more thing I can do.
Instead of doing route set interface, I can also do this.
Client.
No.
Was the plan like to.
Yes.
Yeah, I am in the interface.
No, there's.
Okay.
I'll have to do it here.
Yes.
Crypto v2 Client Flex VPN f x.
Client inside.
Blue back.
Zero telling my insight is loopback zero.
Remember we used to do it?
Where is VPN?
Inside and outside.
Outside.
He already knows which one is it inside.
But there's a difference here when I do this.
Can I beat out a static route towards one on one static route towards here?
It does not have anything right?
No, this should happen.
I'm not telling it.
He's not installing anything.
You should install it on the other side.
From the vertical axis is down.
That's what it says, but it doesn't usually it should, Pat.
That's what it says in the documentation that this should.
Pat.
But I tried it yesterday.
It didn't work.
It should Pat with 192 168 .1.1.
But it doesn't.
There's no outside in here.
There's no outside option C Crypto Ikev2 Client Flex.
F x.
There is no outside option.
You have client inside and connect.
Connect is where do you connect through and inside is what is the inside.
But that's one way of doing it.
What is the other way of doing this?
To tell him my inside networks crypto.
What do I need to change on this one?
The only one thing I need to change here is.
Access list.
Then permit.
Liking it then.
Now.
5.5.0.
And.
Here will be route side access list.
That's all I need to do on the client side.
Done.
Let's check.
Clear the tunnel.
You can do it as we can do it here.
Like this.
Iv2 Crypto Iv2 Client Flex.
Down.
Up.
Swipe out.
No.
Did I do it?
Clearly.
And I would say access list ten.
Because my access list n permit now 5.0.0.
This is fine.
This should work.
This is Access list ten.
Let's go.
Here.
Set this down first.
See, this is what I was saying.
If you go to R1 right now, interface virtual template, then type tunnel, see, he'll show you a message.
He also says why I have active virtual access present, so I'll have to go for here.
And even I felt it.
Maybe there it would not be.
Maybe it was not clearing from this side.
I'll say connect manual first.
And then shut it.
Not shut here.
Interface Tunnel.
I just cleared it.
Clear.
Crypto.
Ikev2 Plex VPN.
Client.
Flexible.
Player the client.
And then I'll try it again.
Now you can enter.
Right.
Shut.
As the camp is off.
No.
Shut.
I see.
Camp is on and here.
Crypto hike v2 same as VPN flex same as before.
The face is up, you get an IP.
You get the static charge, you get this.
This side should also get a.
Stomping grounds.
Maybe that was the case.
I had to shut it.
That's why he was not getting it from inside also.
Now we have the inside.
Now we have both inside also.
And this is installing it.
One of the two ways he'll do the same thing.
He will also install the static route the same way when you do inside.
He will not do your netting.
He will install the static route.
He will take it up as the static route to the other side so the outside static is done automatically.
So now my inside network.
With the source to backup zero is also stuck.
So headquarters and everything else is done.
Now this gives you a lot of flexibility as compared to easy VPN.
First, you don't have to do that split tunneling part.
You can just send the networks which you want the other guy just send those specific networks to that
guy.
You can set no specific networks.
The other thing that it does which VPN does not give you is.
You can run.
Can run a routing protocol over it.
Why?
Because now this is not a host client.
This is a router as a client.
I have this.
He's not.
He's going to take only this.
Why?
Because this is statically present to him.
So he has a better route.
But if I create another loopback.
172 .5.5.5.
Right.
And in my I'll say.
Yeah, it'll work both ways.
It's easier to share my roots.
Not the functionality with easy VPN, although easy VPN.
You can also do this reverse route injection on both sides.
You'll have to do some extra steps on the client side.
So he also gets a because remember easy VPN, he didn't have that the same problem.
There was a virtual template on the other side.
He didn't have that route to where that guy is.
That's why he could not ping that interface.
Remember, he could not bring the interface, but he could bring the inside networks.
If he can get that one interface set, you can run routing protocols over that also.
But it's more complicated here.
See how simple this is?
All you have to do is just root set, interface, root set, access, IP, local pool and push the pool
down from one side to the other side.
And it's done.
How much was different between the MVP and an easy VPN on flex?
Not much.
All you have to do is learn that basic set up first.
That basic setup is same in all three.
This basic setup is same in all three.
What authorization profiles?
Call them inside your profiles and then you have either a normal tunnel or a virtual tunnel.
Not more than that one.
Normal tunnel.
One virtual tunnel.
The two towns are only used in spoke to spoke.
The others have one static tunnel from down and one DVT on the top.
Authentication.
Which one?
Here you don't have that same x auth you had before.
We can try.
Remember what we have at that time for authentication.
What did we use to do a authentication login?
Call it anything.
Local username.
Password.
Cisco.
Copy this.
Bring it.
Where?
Here.
Okay, where we used to call it inside our profile crypto like V2 profile.
Ike.
But maybe we can.
NDB indication authentication.
No, this is the normal authentication.
Local pressure.
A Yes.
A authentication.
No.
You can only do it with EAP.
Yes, you can only do it with the protocol called EAP.
User based used with the triple.
You cannot do it locally here.
EAP is only done with the triple, so you have to call the list.
That list should not be local, should be pointing to a group which is radius server and the username
and password should be there and then he will check it from there and then he'll push it down.
Is extensible authentication protocol used for communication between your triple A server and the authenticator
and the authenticator.
This is that protocol that is used.
That's why you have a username and password is used to add an.
Athenaeus.
And then where?
There we do that when you do a local.
We do we used to do radius and local remember but this is just a he only supports gap in authorization
he does support group.
I showed you the group and the user in authorization but in authentication he only supports EAP.
The authentication should not be done locally should be done.
EAP the local which you're talking about, we do it if we have console backup here.
I'm not doing it for console.
This is for remote users login, so I don't need to protect my console, I don't need to protect my
console in that way.
Okay.
People like crypto policy?
I don't think so.
We'll still try crypto like we do.
We have authorization policy.
There's no authentication policy.
Authorization policy is why?
What to push down.
What to do.
Authentication is separate from.
Okay, Claire, any more questions?
This is the end of Flex.
Flex is finished.
Anything else?
As I said before, the clients have not been developed for it yet.
They're still in testing.
The clients, the flex, like you have easy VPN, you have a separate client.
It's not the same for Flex right now.
They are in development phases, so you'll get it soon.
Even the documentation, if you check on Cisco, it's not complete yet.
It's only a few pieces.
They're missing bytes bits a lot.
Why?
Because it's a new technology.
They're creating new stuff about it.
But again, whatever is new in technology is in demand.
Do you know which ones?
Jai.
Jai, Which one?
The ACM.
ACM Can the iOS.
Jai may be, obviously.
Cisco communication professional Cisco.
I have never personally used it, but also checking on the Internet is very easy to configure with all
these all of these things, you can use it to configure all of those policies and you can push them
down.
Destination What kind of, you know, the address address and that address and what commands it ran
in the background.
And it shows you all the commands just like Asdm does, but do the configuration pasting.
It shows all the this is what I'm going to use in production.
Yeah.
Employee goes to client side and just copies this.
Yeah.
And all the other kind of stuff can but troubleshooting you
can do at that time right.
So it's good I mean once you know this.
Yes, yes.
Then it's okay to do that.
But it's not good to start from there.
And come here.
But what I'm saying is it's a very good thing.
Yeah, but as Jessica in the lab should be done in the end, it's not good if you look at the lab first
and then start studying the process.
So don't look at the lab first, do everything, and then go to the lab.
Same way.
First this, and then that is the.
That is the shortcut for time.
Yes.
Nice.
Three.
Predecessors.
What kind of predecessors?
The easy.
No, no, no.
It's not backward compatible.
You mean backward compatibility?
Key Flex VPN server, Easy VPN, Client Easy VPN uses.
I can
remember the client which is created uses Ik v1 policies Ik v2.
They'll have to create a completely different protocol.
Why?
Because the packet exchange is completely different.
And that was my Ik six messages plus three messages.
Here it's completely different.
So the client also has to support remote access here.
Remote access.
There is no client right now for remote access, There is no remote access client right now, but they'll
develop probably VPN version that will support Ik V2 and all the other kind of new technologies
to support the already accomplished between those he will support, as in which case
the VPN server client or flex as a whole.
So you can accomplish that.
No, I saw the documentation yesterday.
What it is is easy VPN, you create a redundant flex VPN over there, then migration over the migration
will be easy.
That's what it says.
I've read that document, the migration will be but backward compatibility that flex VPN server, easy
VPN client that's backward compatibility that will not be there.
It will support when the client is updated that will run both.
They'll be able to run easy VPN as well as this.
So here you cannot connect to this using an easy VPN client or you cannot have a flex VPN client and
connect it to an easy VPN server AC compatibility.
But yeah, in a network you can run both the easy VPN server, run this router, flex VPN, but easy
VPN client should be easy VPN, but flex VPN client should be flex VPN.
The functionality will be exactly the same.
We'll provide you the same functions on both.
Okay.
So on the client side, you used save one and then yeah, so that is if I have multiple flex VPN servers,
I have one and second one as a backup one.
The one is the priority number.
The first priority will be given to this.
If this is down, then second will be the priority.
So we'll go to the second one.
If that is down, he'll go to the third one.
Basically trying with this server doesn't work, tries with this server, it doesn't work, tries with
this server.
So different servers right now only have R1 as the server.
I can have R2 as the server also or R3 as the server also.
So first he'll always go to R1 for priority basis, but if R1 is down in any case for redundancy he'll
go to R2.
Is this clear?
Everybody.
To finish it off with Flex.
Yes.
All right.
That is your flex VPN.
All three.