Hello and welcome to this lecture in this lecture we apply the configuration on the HQ for the great
firewall in order to be ready for the IP sex site to site VPN so let's now go to 172.
That sixteen point one hundred that one when we should be able to log in right away and we have admin
and we see later and remind later.
And now let's navigate to the VPN menu so everything looks fine.
Virtual Machine.
It's an evaluation license and that's the reason why we cannot apply any advanced authentication and
encryption algorithms.
But anyway for demo and learning purposes it's absolutely perfect.
So now let's navigate to IP SEC wizard and let's say that this is a side to side and side to side VPN
tunnel and the remote device is going to be Cisco this time.
Now let's name me let's say branch one let's say range.
No not between sites.
Oh now click on Next.
So we can see here that the diagram has changed so I am configuring this for the gate I am connecting
through internet so no net devices in between and the the remote device.
It's a Cisco device.
So now let's say next the IP address of the NSA was the IP address.
Again I have forgotten to test the connectivity between the HQ for the gate and the NSA.
So let's do that now.
So HQ 48 and I will do a ping.
So admin and they're executed being 100 100 or 100 1 or 2
and let's say if we have connectivity and it is like it seems like we don't.
So this is a perfect example of why you should test before applying the advanced configuration you should
you should test basic connectivity and let's see why.
Let's go to the NSA.
And yes I remember I didn't apply any route any default route on the NSA pointing to pointing to the
default gateway pointing to the Internet router.
So if I say now show route I see I don't have any road going outside only connected and local.
So see means connected and l means local only local and connected roads.
So let's apply also the full road here.
So it's a you see road and then you say what's the interface.
In our case the interface is outside and will say that this is the default route and the address of
the Gateway by which the foreign network is rich.
So what's the next hub.
The next top is 100 the 100 that 100 that 1 or 1.
This is configured on the Internet router and let's say and let's also verify that the Internet rather
has this IP address configured so enable show IP interface brief.
Yes it is configured and it's in the up and up state.
Perfect.
So now let's try again from the HQ for the gate.
Let's go again and run Bing and the Bing a successful.
So now this is the moment where we can now start the configuration and with no fear that any layer one
layer two earlier three meaning connectivity it's it's in between.
So let's go again to
this so the remote device.
We need to we need to configure here the IP of the NSA.
So again it's one hundred one hundred one hundred up one or two.
So let's do that so one hundred not hundred of one hundred one or two port one detected the roaring
lookup.
Again the authentication method.
Are we going to use appreciate key or certificate.
So we will use pressure key now and let's say that this is fortunate.
Now everything is good let's just click on.
Next.
Now the local interface.
Again this means what's my private address space.
This is one that one and I'm going to connect to remote subnets which should be 3.0.
Let's look on the diagram.
Yes.
1 and 2 1 6 8 3.0 and this is a slash 24 mask.
So let's go and configure this one line to that one 6 say that 3 0.
And this is a slash 24.
This is good.
Perfect.
In the Index is none.
Let's just click on Create so this has been set up.
Show tunnel list.
Now we have a side to side for the gate.
It's in the upstate and we have another one side to side with a Cisco device and it's inactive.
Let's check now what's the configuration apply for both.
Phase 1 and Phase 2 so that we are 100 percent sure of what's there and what needs to be configured
on the end.
On the other side on the AC so network this is the network authentication and Phase 1.
So let's check what's configured here.
Let's say that we only have again only this because it's in evaluation evolution mode of VM We are running
encryption it's theirs and dedication it's SHA 1 we are running that if you have one group number 5
and the lifetime is this.
Let's take this value and we will not do.
We will not change anything here but I want to make sure that we have the same configured for Phase
2.
Now if you click on the pencil which means added you'll have the possibility to click on the advanced
here and see basically the Phase 2 proposal.
Again we will use Des and Shell 1 so enable perfect forward for secrecy.
Let's say we don't want that or we do anyway.
Let's say we won.
That again is this show one development group it's 5.
Let's modify here.
The second and I will say paste and just click OK.
So this is the configuration we have applied on the on the 48 firewall.
We have now to to run the wizard on the on the essay and match the 1 percent.
The parameters here so that the VPN will come up.
So thanks a lot and see you in the next lecture.