In this video, I'd like to walk you
through the configuration for FlexVPN on a Cisco IOS router
to support remote access VPNs.
Now, a word of caution, there are a lot of commands.
And my anticipation is not that you
memorize all these commands, because you can look those up.
But what I would like to do is share with you the concepts
behind each one, and also reinforce the idea
it's called FlexVPN because it's very flexible with the pieces
and parts that we use based on what we want to have happen.
Do you want to do site-to-site tunnels?
Great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Great.
Do you want to do remote access VPNs?
Great.
Do you want to use a DMVPN-like environment with IKE version 2?
Great.
FlexVPN supports all that.
So as we go through these configs together,
I would like you to focus on the bigger picture.
And then if you ever need to deploy this at the CLI,
I would recommend going to some design guides or some config
examples from Cisco, and then just copy-pasting
and modifying the path you need.
Also, as software-defined networking
becomes more and more prevalent, it's less and less likely
that we're going to have to implement WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we're going to have to implement
at the CLI remote access VPNs because of the other tools
to do it.
Now, having said that, whether the configuration is pushed
through APIs, or a GUI, or at the CLI,
it's important to understand how those pieces work,
and also how to troubleshoot it.
So we're going to take a look at those pieces as well coming up.
So for now, let's take a look at the typology,
and then go straight to the CLI.
And I'll walk you through the config.
So here is our topology.
And our work is going to be primarily done
in this video right here on R1, who's
going to be acting as our head end device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to be acting as our head end device.
So here is our router from our previous video
on getting it set up with a certificate authority
and a digital certificate.
And here are the configs we're about to deploy.
So let's talk about them in groups.
And then we'll put them in.
So aaa new-model, we're going to need to do some authentication
authorization.
So we turn that on.
And we're creating two method lists here, one for logins--
we'll use that to log in Bob when he comes in--
and one for network authorization.
And so these names I pulled straight WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so these names I pulled straight
from the example at Cisco in a document I was looking at.
But effectively, this method list for login authentication
and this method list for network authorization
are both going to rely on the local database.
So I'm not going out to a AAA server or an ISE server
on Radius or anything else.
I'm just going to do it all based on the local config.
Next, if we're authenticating based on the local database,
we probably should have somebody in there.
So I'm just creating a user with Cisco!23,
capital C at the beginning, as the password.
I'm also going to specify a local pool called ACPOOL. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm also going to specify a local pool called ACPOOL.
And this is the pool of addresses
we're going to assign to Bob and other users
as they build a VPN tunnel.
Or I guess in this case, it'll be admin,
because we're using local authentication
as we build the VPN tunnel.
They'll be assigned one of these IP addresses
logically via their AnyConnect client.
Also, I want to create a split tunneling list.
So we can do it this way.
We create an access list.
This specifies the networks that are interesting to us.
So the wildcard mask here says only match on 10.
And we can use this access list called a split tunnel
as part of an authorization policy, which is right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as part of an authorization policy, which is right here.
So in this authorization policy for IKEv2,
we're specifying the pool.
That's where we're going to assign the addresses from.
We're going to assign routes, which is this access that's
called split tunnel.
So for our split tunneling policy,
any traffic going to 10 and any DNS request going to 10.5.5.5
would go through the tunnel.
And as we scroll down here, we have an IKEv2 proposal,
very similar to what we had in our site-to-site VPNs
with IKEv2 with the encryption and the hashing
and the Diffie-Hellman group that we're going to use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the Diffie-Hellman group that we're going to use.
And then we have an IKEv2 policy that says
what proposal we want to use.
Now, we could have used the defaults for the proposals
and also for the policies, but if we
don't want to use the defaults, we
could create them, which we're going to do right here.
And then we have an IKEv2 profile.
And this is just a name.
AnyConnect referring to the AnyConnect client dash
EAP for Extensible Authentication Protocol,
which is going to be used for the authentication.
And for the match, in site-to-site
we matched on the other device's IP address for the identity.
And here we're matching identity remote key-id WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here we're matching identity remote key-id
*$AnyConnectClient$ with the asterisk and the dollar symbols
in front and behind.
And that's a special variable representing
this client is coming in via an AnyConnect client.
And then for authentication, the client's
going to authenticate the server using RSA signatures.
And the remote device is going to authenticate
using AnyConnect EAP.
And then it's going to be followed
by this keyword aggregate, which if you don't put it in,
it won't allow you to continue.
You have to put it there.
And then you could also follow it up
with another authentication method as well.
So you could have multi-factor authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you could have multi-factor authentication.
And the aggregate would allow you to use both.
Then it's specifying the pki trustpoint.
That's the local trustpoint that we configured on R1.
And then for the authentication of the user when they connect,
it's going to use this method list that we created.
And let me scootch this over.
For authentication, this is our AAA method list
for authorization.
And this is our IKEv2 authorization policy
previously defined.
And then if that all matches up and they're successfully
authenticated, then we're going to use virtual template
100, which hasn't been created yet, because we'll create it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
100, which hasn't been created yet, because we'll create it
right down here.
So we'll get to that in just a moment.
Here's an IPsec transform set similar to what
we had in our site-to-site VPN tunnels with FlexVPN.
Here is the IPsec profile that calls on that transform set.
It's also still specifying the IKEv2 profile
to use, which is this bad boy right there.
And then we're going to create a loopback interface of 100.
We could use any number we want.
We just give it an IP address.
The reason we're going to use that
is that we are going to associate
that with our virtual template.
So we don't have to use the same exact number, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we don't have to use the same exact number,
like this could loopback 5.
This could be virtual template 68.
It doesn't matter.
But in this virtual template, it's specifying IP unnumbered.
Just go ahead and borrow the same IP address it's on,
loopback 100.
And that's what this is specifying here.
ip mtu, just like site-to-site VPNs,
we're going to have some overhead, because we're
going to do ESP encapsulation.
And we don't want to have to fragment
after we do the encapsulation.
So by doing an ip mtu here, we're helping to avoid that.
This is specifying that instead of using the default GRE
mode for the tunnel, we're going to use IPsec IPv4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mode for the tunnel, we're going to use IPsec IPv4.
And then we're applying the tunnel protection profile
that specifies what IPsec protection to do,
which kicks off all the other IKE version 2 stuff as well.
And once again, it's not reasonable for a person
to carry all this information in their head.
But I wanted to go through the full config with you,
explain what the various parts do,
and then when we apply it, and then once we get to the client
and test it, if it's not working or if there's a problem,
we can do the debugs we need to.
We can use the show commands and help troubleshoot it.
But for now, let's take these commands as they sit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But for now, let's take these commands as they sit.
And we'll put them into router 1.
So I'm going to go ahead and copy all of that
to my clipboard.
Right-click, Copy.
Go to R1.
We're in configuration mode.
And I will paste those in.
Also, I'd want to make sure I'm looking and making sure
if I have any errors, that I address those.
Sometimes if we refer to like keyrings
and we haven't created the keyrings yet,
it doesn't take the config.
So that's not the case here.
But look at this.
Here we have virtual template 100 changed state to down.
And that's expected. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's expected.
That's just the template that we're
going to use so that when we have
clients connect successfully, that template can
be pulled from.
It can create a virtual access interface.
And that's what the client's going to connect on.
And it says here that ISAKMP is on, which is a very good sign.
So we won't know if that's all working
or not until we actually try it.
So in the next video, I'd like to talk
with you about the AnyConnect Client Profile Editor,
and what that is, why it's important,
and also walk you through how to use it.
And we'll do that in the next video.
Meanwhile, I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.