All right so we're progressing now.
Let's create a firewall address object for the remote local area network that we want to establish a
tunnel to.
So let's create one let's name it remote IP set lan that's a subnet at the tender 0 that one that is
zero slash 24 and let's use this static crowd configuration so we can use it later on in our static
round configuration.
All right now let's move over to VPN IP SEC tunnels create new customer and let's name or tunnels since
we are the initiator.
Let's name our tunnel to branch
next.
No we will look over at the different parameters the one that are really important and I'll try to explain
each.
Now the remote gateway that's our remote Gateway IP address we will reach to it through our 1 1 interface.
Now we will not use the net since we are not doing any network address translation.
Both gateways have their public IP.
They do not need to translate the IP address.
It's a tunnel between both gateways.
Now we can use that pure detection that will check for any issues in our tunnel.
Let's use a pretty sure key for the authentication between the two piers.
Let's use the one two three four five six eight.
That will be the password that we will use now.
There are two modes at phase one.
The first one is aggressive.
The second one is mean using the main mode.
Actually uses six packets to establish the first phase.
The aggressive mode is much more quicker it only uses treat packets but we will remain with the main
IP protection mode.
These are the encryption algorithms and the hash functions that are used.
We can keep them as they are.
We can eliminate some of them.
Let's use a yes 1 92 and Char.
Let's use shell 1.
Now the defeat Hellman group is the method or the way to initiate a secret key that both parties can
use during the setup.
We will keep the groups as 14 to 5.
This is the key.
Lifetime 86 400.
We will not use local I.D. since we're only establishing one IP SEC tunnel
and now let's move over to our face to face to we will configure the remote and the local private networks
now all local network
and the remote address is the intended zero that 1.0.
Right now we can move over to the advanced configuration where we can determine the encryption algorithms
and the hash functions.
We will keep it as they are.
We will enable replay detection and perfect forward secrecy that is a mechanism that initiates a new
key each time this session ends.
It's much more secure that way.
And there it is.
That's our tunnel.
Step one is completed.