Hello and welcome to this lecture.
So in this lecture we start the configuration of the headquarter or HQ for the great firewall.
So let's see how we do it.
Let's go now to the graphical user interface.
So 172 the sixteen one hundred that one let's log in admin.
No password so enter.
I will change the password later.
And anyway remind later so here it is now on the left side you have the menu of the user interface and
we will go to VPN and let's go now to IP SEC Weezer just click on IP SEC Weezer and now we have to create
the tunnel.
So there are some templates available template type side to side remote access or custom if you want
to define your own.
And let's look what's available so I be tunnel template side to side so too for the Gates side to side
with the Cisco dial up with a 40 gauge dial up with the Cisco firewall.
Now in this case.
So IP SEC IP SEC wizard in this case we are configuring a side to side and remote device type.
It's a 48.
So the default the default options are the ones that we need.
So let's say here what's the VPN.
What the VPN name.
We will name it.
We'll name it.
What we'll name it.
Branch let's say branch one for the gate too many letters branch one it's enough No not between sites
because we have a direct connection like you see here on the right they are directly connected kind
of directly connected but through the Internet no netting devices in between.
So no net.
Now let's click Next so here is what the configuration guide is asking for us.
So the remote device IP address is and we have to provide it here.
So it's ninety nineteen ninety and ninety dollars.
Let's fill that in so 90 that 90 that 90 that the 90.
You know what.
This is one thing that I have told you but we haven't yet tested it.
So before going through the configuration we should first we should first see that we have connectivity
between the two to 48.
So let's go to let's say that HQ 48 and I'll now want to ping so how do we do that.
Let's say again let's say at mean and now we say execute execute ping and let's try to ping the other
rental 90 that 90 that 90 not 90.
Ok so now that the ping is successful we can continue with the with the configuration.
So basically we're trying to make sure that nothing in between will provide any trouble.
So that's the idea of making sure that connectivity is good before going on with with a configuration
or advanced configuration.
Now the authentication method is pressured key so signature meaning configuration using certificate.
We're doing a basic site to site VPN so we'll use pressure key.
Now the pressure key let's say it's fortunate and now we have to just click next now policy routing
the local interface.
So what's the local the local land IP address.
So 1 9 2 1 6 8 1 that one so port number two and this is the local subnet 1 and 2 1 6 8 1 1.
Now in the remote subnet we have to provide the remote lan subnets of 1 9 2 1 6 8 2 0 slash 24.
Basically the traffic between these two subnets 1 9 2 1 6 8 1 0 in 2002 will be inserted in the tunnel.
So this is where the this is where the VPN tunnel or the VPN wizard configuration knows exactly what
traffic will be included and encrypted in the tunnel.
So now we just have to play to click on Create and let's see.
So VPN set up authentication policy writing this is done.
The VPN has been setup for Phase 1 interface branch one local address branch one local.
This is these are objects that have been defined in the 48 VM Phase 2 interface called also branch 1
and some other configuration that has been added.
Now I can say show tunnel list and we're going in this in this menu IP SEC tunnels and the status now
it's inactive and it's obviously inactive because we haven't yet configured the IP tunnel on the other
end.
So on the branch if I now select it and click edit just for your reference we don't know by looking
at this configuration what exactly included in Phase 1 and Phase 2.
And if you want to know what this configuration in the template.
Again this is a pre configured template.
You'll you'll find it in the in the 40 get VM you will have to click on convert custom tunnel and now
we can go and click on edit and see and also change the options that have been have been chosen.
So for Phase 1 if I click on add it is going to use does and authentication and B5 and also another
another essay proposal.
So security association proposal does and show one division among groups 14 and five key lifetime and
so on.
So again not that the 48 firewall doesn't know Triple DES or a s or something like that but it's running
in evaluation mode and these are the only option only options available here.
The same for Phase 2.
Now if I say edit so if I click on the pencil here basically is represented what's the local address
and remote address meaning what traffic again will be encrypted or inserted in the tunnel.
And if you also go into advanced you'll have the possibility like in Phase 1 to choose what's your encryption
what's your authentication if you want to enable or not profess of perfect for secrecy by the way be
a first means that after a period of time which in this case by default is for the four three two hundred
seconds the the keys the keys used in the encryption and authentication will be changed.
So new ones will be generated.
That's what that's what peer means.
It means using twice.
So two times the keys and different keys but anyway we don't need to change anything here.
It's just it's just that for your reference to understand more where do you go if you want to see the
configuration applied.
And what does what does the template mean to be more to be more precise.
So anyway this is the configuration for the HQ 48 in the next lecture we will configure the branch location
and see if the VPN comes up.
Thanks a lot.