Hello and welcome to this lecture in this lecture we configure the essay final for site to site VPN
through going through the Internet up to the headquarters though.
So to the HQ for the gate firewall.
So now let's jump and connect to the here's the m.
Let's see if the session has expired or not.
No we're actually.
So let's go to wizards and let's say VPN wizards and let's select site to site VPN wizard.
So this is the setup and it is between two two devices through the Internet.
This is what we need.
So use this wizard to set up new side to side VPN tunnel a tunnel between two devices is called side
to side tunnel and is bidirectional.
Side to side VPN tunnel protects data using the IP SEC protocol.
Actually it's IP SEC protocol suite.
So anyway let's go and say next so peer device ID.
What's the IP address of.
In this case of the HQ for the gate firewall.
So let's check the diagram and it's ADHD 80 and 81.
So let's configure this so the IP address it's 80 that 80 80 that 1 VPN access interface.
So we are accessing we are reaching this IP address through the outside interface.
Let's just click next.
Now what is the local network.
So again traffic to protect or proxy ACL what Cisco calls it.
Or interesting traffic.
So what's my private IP address.
My local land and was the remote network.
What's the remote private network that we are going to talk to or connect to.
So local network I'll just click here and our local network is this insight network 1 and 2 1 6 8 3
0 and I'll now click on local network so that I select this this object.
This is what they're called they're objects and I'll pick.
OK now for the remote network we don't have one defined.
We don't.
We do not have it in the least.
So we'll just create one.
So click on add and say network object the name will be let's say HQ for the gate private land.
This is not a host but this is a network.
So the IP address will be one name to that one six say that one the zero and the net mask is 2 5 5 2
5 5 5 5 0.
So net will we will not add to any net so we don't want these traffic to be netted.
And let's just say OK I will select it now and say remote network is this and click ok.
Now we have to say next.
Now in this in this step in the fourth step the security step we can say that we can go through I mean
select simple configuration or customized configuration.
Now here's the here's the thing in the simple configuration option says NSA uses the pressure key entered
here to authenticate this device with the pier.
So remember on the on the photo gate we have defined the pressure key as 14 at as GM will select common
icon Isaac Cam security parameters for that will allow tunnel establishment foot means that it will
select.
It will have more than one available as security associations as well as proposals better said.
And from that list the SDM will try to select one in order to match one percent what the 48 will present
when trying to establish the tunnel.
But we are network engineers we're going to select customized configuration.
Why is this.
Because we want to be as exact as possible and select only what we need not select everything that's
available right so let's go for I.
Version 1.
This is what we have configured on.
On the footnote firewall and the authentication method.
So we are not using any certificate the authentication is appreciate key.
And let's say now 40 net.
So again let me just make sure I'm typing it correctly for net encryption algorithms.
So we see here that there are a lot a lot of policies and IP SEC proposals.
So we want to make sure that we select only what we need.
Appear first we have selected first and the group was five.
Let's get back to encryption algorithms and say manage OK
and from this list we will delete everything and only let the one we need.
So there is a Shah with pressured key so I'll delete this one and RSA Sig means authentication through
certificates.
We don't need it.
So we need only this.
We said there's encryption Shah as the algorithm did we had one group.
This is not good.
I'll just say.
Edit And if you had one should be five.
This is what we said.
This is what we have configured.
So again we have seen a bunch of things here a bunch of a bunch of Ivy one policies.
We have configured only one.
And this is what we need.
So let's just verify again.
Shah if you have one group five preshow keys and eighty six thousand four hundred seconds if we look
on the H Q four to get five roll.
So again for the VPN to establish we have to match these parameters.
So if you go now into the custom one and say EDIT Let's go and and for the phase one we have this show
one group five perfect and we have eighty six thousand four hundred.
I can remember it correctly.
Anyway just check edit 86.
Four hundred thousand seconds for the key.
Lifetime.
Now I'll say cancel and get back to you.
So now I will say OK and this is the policy.
So this is pressure pressure.
There's a sharp IP SEC proposal now let's say select again we have a bunch of them here.
I will just go and delete everything.
Hopefully it's possible.
Actually you know we have to select here on the list and delete everything that we don't need.
And I will just leave this one which is there's a sharp and delete everything else.
So I will assign as an IP SEC proposal this for this is for phase two.
By the way.
So there's a shot and click OK.
Again we can go back to the 40 legged firewall for the second tunnel going to the NSA and click edit
phase to selectors look at it and then move to the advanced section.
We need theirs and share one with peer first and group five.
So going back to this one peer Fest has been enabled with Group Five encryption algorithm.
Yes speed is.
So we are ready to say next.
Now the net exempt.
So this step allows you to exempt the local network address from network translation and that'll just
enable this option.
We don't want traffic going from mom from our private private land going to the private land on the
on the HQ side to be translated.
Otherwise the the the traffic will not flow correctly so exempt essay site host network from others.
Translation in this I mean with this configuration with this private with its private IP addressing
1 9 2 1 6 8 3 that one slash 24.
So this is good and click next.
So this is an overview of the configuration pure IP.
This is the VPN the VPN access we're using a virtual one with pressure key peace efforts is enabled
with Group Five.
I view on policy.
Pressured the Shah I was a proposal ESPN calculating security payload with this and shot.
And regarding net the protected traffic is not subject to network address translation which is good.
I will now say let's see say finish and luckily I have this option enabled and I will show you exactly
in a moment where you can enable it as well.
So we are running and we are configuring basically everything we need in these graphical user interface.
But basically what's happening behind the scenes is that at the end a configuration is generated like
you see here and these commands will be pushed to the NSA device so that it is configured like you have.
We have entered in the graphical user interface but there is an option that you have to check so that
you can see the commands before they're pushed to the device anyway.
Now I will say send and the configuration has been has been sent to the device.
So here in file let me just check.
So tools and let's see what it is so file no you tools.
I think it's here.
So tools preferences and here is so preview commands before sending them to the device and they have
enabled this this option and it's a good practice so that you also get a good understanding of what's
happening there and what commands are really delivered to your device in a way.
This has been the configuration to the NSA.
Nothing.
Nothing more to be to be done now.
Let's just meet in the next lecture where we do some testing and verification and any troubleshooting
if needed.
So thanks a lot and see you in the next section.