It's not too easy to follow a recipe if you
don't have all the ingredients.
So in this video, I'd like to talk about a few
of the ingredients that we will be
putting into our remote access VPNs using FlexVPN and IKEv2.
So for our planning, we're going to need to have a certificate
authority.
Let's use a local CA here on R1.
So we're going to basically tell R1
it's a certificate authority.
And then we'll have it go ahead and authenticate itself,
which means it will get its own-- it
will trust its own certificate as a root certificate.
And then we'll go ahead and enroll, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll go ahead and enroll,
which means it'll also have an identity certificate.
I'll walk you through that.
And that will help us not have to go to an external CA just
to get this lab working, because with AnyConnect,
connecting to a FlexVPN hidden router operating IOS,
this has to be using RSA signatures for authentication.
Otherwise, it won't work.
Also, for AAA, authenticating a user as they come in, let's
specify all AAA methods are going
to be ultimately referring to the local database.
So we'll specify a local user in the running config. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll specify a local user in the running config.
And we'll call up on that when we're
doing the authentication of the user who's trying to connect.
For the pool of addresses, when this guy does connect,
let's use 10.67.83.51 through 100.
Now, this one user won't need all those addresses.
But it'd be good to have at least enough addresses
for the expected amount of VPNs clients who will be connecting.
Also, let's do a split tunnel policy that
says traffic going to the 10 is going to go through the tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
says traffic going to the 10 is going to go through the tunnel.
Let's also specify a DNS server if we have an internal DNS
server we wanted to use while his VPN tunnel is up.
So we can specify a DNS server as well.
Let's use 10.5.5.5.
So what should happen when the VPN tunnel is up,
we should have in our routing policy that 10 anything would
go over the tunnel, and also the IP address of the DNS server
would go over the tunnel.
Now, when the user does connect to authenticate,
we're going to use a virtual template,
and effectively, we're going to create a logical interface
for this user connection for the VPN tunnel WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for this user connection for the VPN tunnel
so that we have it in the routing table and everything
else, but that virtual template, we
are going to define as part of our FlexVPN remote access
configuration on the router.
So here's what I propose we do.
Let's create an interface loopback 100.
And we'll give it the IP address of 11.11.11.11,
the 32-bit mask.
And then for our virtual template,
we'll say IP unnumbered.
And along with IP unnumbered, we'll
specify use the IP address already
on interface loopback 100.
So basically, this template will be saying, for my IP address, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So basically, this template will be saying, for my IP address,
I need to use the IP address that's already on loopback 100.
And then when it spins off virtual access interface, which
is the logical interface it's going to create for the tunnel,
it'll have that same IP address as well of 11.11.11.11.
So that address on the loopback, the virtual template,
and the virtual access interfaces
is going to show quite a bit.
And then on this virtual template,
we're also going to specify the tunnel mode of IPsec or IPv4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're also going to specify the tunnel mode of IPsec or IPv4.
And we'll also specify the IPsec tunnel protection profile
on the virtual template.
So when it gets spun off, logically, you
will have this new virtual access interface
that the VPN client is using, which
will have all those properties.
So we're going to break this into smaller chunks, including
the certificate authority piece all by itself.
So we'll cover in the next video how
to train R1 to be a certificate authority to believe
its own certificates, and then get its own identity
certificate so it can use it as part of FlexVPN remote access.
And we'll do that in the next video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll do that in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.