Hello and welcome to this lecture in this lecture we'll do some verification and check the results both
on HQ and branch 48 firewalls.
So let's log in now to.
This is the branch 1 and click on later.
Something wrong with the browser.
I will just close it and open it up again so 172 16 one hundred one and 172 16 208 1.
If I log in now to the user interface let's say later remind me later and I will do the same on the
branch one.
So admin log in and later and later let us examine now what was different or if anything happened here
in the in the VPN in the VPN menu.
So I be sick tunnels.
We see that we have a tunnel so going to branch one through Port one.
This is the template that has been used when configuring this site to site VPN.
But we see that the status is inactive.
Can you guess why.
I mean if the configuration is correct probably we we should see here that the status is upright or
something like enabled or I don't know.
But anyway not inactive but probably active.
So something something else still has to be has to be done in order for the VPN to to work to be functional.
Now remember from the from the previous and the beginning lecture we said that the end goal of the VPN
of the site to site VPN configuration is that we are able to ping from one LAN P.C. to the other lan
P.C. as if they were directly connected.
And when we configured both the HQ and the branch firewalls we said that.
Well interesting traffic.
Well interesting meaning that traffic that has to be encrypted it's where the source wanted to once
except one that one going to two dozen euro or the other way around traffic the traffic coming from
two that zero going to one that zero.
And this VPN tunnel it's on demand type meaning that the VPN tunnel will be up will be active only when
traffic from this P.C. or from this LAN will be seen by this HQ firewall going to this subnet.
So as as of now we don't have any traffic going between these two sites.
So that's why this is the reason why we're seeing the the tunnel being as inactive now anyway.
If the if the configuration is correct we should see that the status should change when we try again
to ping let's say from this P.C. going to this P.C. list right now.
So let's go to VPC is one so this is VPC this one and I will try to ping so let's say being a question
mark I want to have multiple packets minus C as the option so being Minus C. Let's say one hundred packets
to the destination 1 9 2 1 6 say that 2 that 0 so we will say being this
and now.
Question mark.
And now we have the option so again minus C one hundred and let's wait time out time out time out.
Actually the IP address is not correct so it's not too that 0 but it's 2 that 1 2 2 0 0 is the something.
And here it is.
So we have connectivity between Test B C or land P.S. 1 Going to the the P.S. On the other side of the
network.
So guess what.
Let's see if the tunnel has changed.
So I'll just say click on something else and go back to our basic tunnels and the status is up.
So this is the desired.
This is the desired output you would like to see.
So now going in the monitor menu.
So we were here we are in the VPN and IP tunnels.
When you click on on the tunnel and specifically click on up it will jump to monitor section and IP
monitor.
So we see that we are on the branch the branch firewall we see we have HQ as the name.
It is a side to side the remote IP is this.
The stat is up incoming data outgoing data is good and we have this specific kilobytes of of traffic
also.
We would like to look maybe in the log and report and if we go into VPN events we should see something
here because some some negotiation has happened before before before having this this VPN up so we can
see some failures here.
Failure failure failure and now we see our success.
So if you click so this is basically for troubleshooting and troubleshooting and reporting purposes.
So if something happens you would like to see basically how how everything happened and get get more
details.
Double click on any row and you can see here more detail so log description progress through IP sic
Phase 1.
And we have let's say we have we have used this port for no UDP 500 and this is the remote IP remote
remote port five hundred main mode progress.
Let's see log remote roll which is something I don't need.
Phase 1 Phase 1 Install IP SEC assay.
So this means that the the IP SEC Phase 1 has been successful.
And then you can see here IP Sig Phase 2 status change so let's see what happened from route with this
IP address.
Action Phase 2 up.
So now we have also Phase 2 up which means when you have also Phase 1 and Phase 2 up that traffic can
pass can pass in the tunnel.
And anyway you would have to you have to play with these options a little bit so that you understand
more.
But this is where we go.
So again logger report to see what has happened and what were the steps when the tunnel was negotiated.
And when you just want to see the status obviously the menu it's monitor and you go to IP sic monitor
and get more details about your your side to side tunnel.
So this is all with this section.
Thanks a lot.
In the next section we will do some.
I would say more advanced configuration.
We will try to set up a site to site VPN between a fortunate firewall and a Cisco AC.
Thanks a lot.