Hello and welcome to this lecture in this lecture will try to initiate the VPN connection from the remote
worker going to the Internet going through the HQ port gate firewall.
So now let's connect on the windows.
P.S. And here it is.
And because we have the 40 client installed we should initiated so right click and open 40 client console
and we will go into the remote access section.
So it says no vpn connected so we should click on the remote access and then go to configure VPN so
click on configure VPN.
We will have to provide by the way not in the SSL but in the IP sic.
We will have to provide a connection name.
So let's say this is the HQ or the HQ firewall.
If you file the remote Gateway should be the IP address of the open gateway you're trying to connect.
Right.
So now it's here going to the genius tree.
So it's ADHD 80 and 81.
So let's fill in these these details.
ADHD 80 81.
Appreciate key.
It's 14 net.
And now let's show let's click on the advanced settings and you will see why.
So although this is remote access VPN maybe you are familiar or you're not familiar with this kind of
a VPN setup.
It is the same as you you would configure a site to site VPN so some settings should be configured for
Phase 1 and Phase 2 of the VPN whole setup.
So let's now navigate and see what's available here.
So in terms of VPN settings I will I will leave it to let's say aggressive at the moment and mode config.
Now let's go to Phase 1.
So in terms of encryption and authentication you see that for phase one by default the fully client.
It's using a yes 128 and show one or 8 56 and shot 46.
This is absolutely a valid configuration but because we are running the 40 net firewall VM in evaluation
mode we do not have this specific encryption and authentication Piers available.
So remember we have Emily five and Emily five and this.
So let's go for that with SHA 1.
And basically that's it because again we do not have this this available.
So we should.
We could not should but we could configure here multiple multiple pairs of encryption and authentication.
But we have to have some matching matching attributes for Phase 1 and Phase 2 that are available on
the.
The fortunate firewall.
So because we are doing testing and we are learning you know we are in a learning process we should
leave Des and shell one so that it matches what we have on.
On the other side on the on the Gateway in terms of Phase Two again we should use something that's available
on the 40 gate firewall.
So there is and show one and I will leave everything the same.
So peer fast perfect forward secrecy enable this one group it's five and four Phase 1 I proposal we
have deeply held one group five let's say now apply and the VPN should be configured.
Please note that the name has changed.
It is now HQ firewall.
So I will say close
and we have to provide here username and password.
So let's look in at mean later let's look in the groups so where the user and device user groups.
We have remote access group and we have one member member each user user definition user in the password
of let's say user with the password Oh for the net just to make sure.
And OK now going back so here
here we have user name user and password for the net.
Let's try.
So for the net let's try and connect and we'll see what happens.
Perfect.
So for a client connected to HQ firewall.
Now if we take a look or let's do it this way if we take a look in.
OK please close in adaptive settings.
Now remember from previous sections and lectures now we have an ethernet adapter that is no longer disabled.
As you see this one.
So this is the SSL VPN virtual ethernet adapter.
And this one is for IP Sec.
So now because we have remote access VPN connection up and running this niqab these virtual niqab has
now been enabled and we have received an IP address.
So let's see.
And basically so properties and fund let's make it something bigger
if we now say I mean one that if you now say IP coffee we should check
and here it is.
So this is the niqab connecting to Internet.
OK so 19 19 1990.
Let's check that.
Here it is.
Nineteen ninety ninety and ninety.
And we have another niqab which is this one which has received an IP address 1 9 2 1 6 8 1.
That 200 and again if we look here we don't have this.
We have two cards physical cards one for the ISP Internet connection and one for management purposes
but another niqab a virtual one here on the window station on the remote worker has been assigned an
IP address that we have defined when configuring the remote access VPN on the HQ for the gate file.
All right.
So going back we now have as I said this niqab up and running it's enabled.
It has received an IP address when when doing the connection.
Now the ultimate goal for this remote access VPN is that the remote worker is able to access through
Internet and through the HQ for the Great Firewall some resource that's available in the in the in the
remote site or in the HQ site in this case and the land P.C..
Let's check again anyway.
NBC has 1 into 2 1 6 8 1.
That 100 is the IP address.
We can't think of it as a server or mail server or a file sharing server anyway.
So now that we have the VPN connected we should be able to ping and access this resource through the
VPN and let's try to do that.
So ping one line to that one succeed that one that one hundred one hundred and let's say enter and here
it is.
So we have connectivity and everything works as expected.
Now in terms of in terms of the risk in terms of the photo gate for the gate user interface or the glory
the graphical user interface you can do some verification.
And here if you go into the monitor and again I basic monitor you can see your connection here.
This is the same that you would do for site to site VPN with 48 firewalls.
Again if you're interested in this topic site aside not remote access VPN like this course I have another
one published already and available for you.
So again core connection is up.
Everything is working now in the VPN.
If you go into basic tunnels you have here and it says one dial up connection so the status has been
changed to one dial up connection is in progress.
Now logging and reporting.
So this is a manual logging reporting going through VPN events you can see here logs for specifically
for this connection and so on.
So it is working as expected.
Let's now move on.
I would like to show you some some some troubleshooting scenarios in the next section but because whether
you're familiar or you're not familiar with this with this kind of troubleshooting in terms of VPN it
doesn't matter that the vendor.
You should expect that the logs and the bugs that are generated are not self-explanatory.
So they're not easy to read.
Not always.
It depends on what's the problem.
And so on.
So the idea is that if you know what are the bugs generated when the set up works and you're familiar
with with the with these logs it means that or it should mean that when something breaks you should
spot the problem faster.
In Europe you're going to be able faster to to generate a resolution and solve the problem anyway.
So what I would like to do now is break the connection.
So let's say going to monitor IP sic monitor if I say right click I'll say bring down and are you sure.
Yes I'm sure.
Good.
And I would like to generate or start or start logs on the HQ for the gate and see exactly what are
the bugs generated when the VPN is successful and in the next section we will analyze the successful
logs with the love that I'm generating when something is broken.
So let's say now diagnose debug application and the application is like Internet key exchange and the
level it's minus one.
Just take it for granted it means you will get all the all the debug.
Now are you there so something is happening already and diagnose debug and enable good.
And now let's go to let's go to the machine Windows 10 machine and initiate again the connection.
So right click and open for the client console.
It has already been connected let's say disconnect and user and forth net.
I'll just save the password.
Let's look here
so it's any tunnel down.
Trap.
Perfect.
Now let's do the connection.
So connecting
for a client connected to each 48 firewall.
I will now say diagnose the bug disable and let me just take the output from from here.
So I'm going up up up up up
something to see
and from here.
So here's where this would start.
You diagnose debug these evil
let me go the other way around.
Let's say
now that was a bad one.
Oh I see no
logs are generated then I'm not able to copy exactly everything that I want
maybe now.
Perfect and I here
so format and font
this way.
So let's see.
So like internet geeks change comes from this IP address coming to this IP address nineteen ninety nineteen
ninety.
If you look on the diagram it's the the Windows machine which is perfect.
So therefore 48 get firewalls that I have received and I request or an IP request for negotiation and
like packet.
Anyway to my IP address 80 ADHD 81.
So this is what it says here.
So aggressive mode gets first message.
What.
What else.
It's important I view IP version 1 so not version 2 in aggressive mode.
And here is the negotiation result proposal idea number one either camp encapsulation like none.
So it says here that okay we're using does the CBC does and we're using also the the shot algorithm.
So there's an shot pressured key and the lifetime shouldn't be this good.
So essay proposal chews them mashed gateway.
What do we have configured so remote access VPN 40 created connection.
So this is good.
What else what else.
It's important and we should note sending some expert packages or packets and authentication.
Okay this is important.
Appreciate your dedication succeeded authentication okay.
We don't have any net adding a new dynamic tunnel for this IP address on port five hundred.
This is UDP.
Let's look for the next step.
So received extended authentication user name user with the specific password length eight 14.
Which is good.
Okay.
Known server
now here is the IP address.
We have seen on the virtual any card on the windows b c so mode configure designed this IP address with
this IP for subnet mask.
So indeed when you weird when you're connecting the remote worker to the HQ for the firewall.
Again an IP address that we have configured.
We have specified on on the HQ for the Great Firewall setup is a sign from that pool to the to the remote
worker.
And this is the confirmation that this is the IP address and why we have this IP address on on the remote
worker.
Going further so IP for subnet 1 and 2 16 8 1 0.
So you're going to have access to this subnet when when trying to connect to some local resources local
meaning to resources in the HQ what else we should see something related to also Phase Two.
So pure proposal is this here is this one into 168.
One that two hundred and only that me means everything matched phase two.
So here is the Phase 2 dynamic client because we do not have.
We do not have a specific and already specified IP address so we can connect from anywhere.
And again from a cafe from an airport and anything like that.
So that's why we are a dynamic client.
My proposal proposal like one we are using IP sic and USP for encapsulation first group 14 yes does
and encapsulation mode its tunnel what else.
And Sha good proposal idea number two.
So multiple proposal are used but the first matched proposal is the one that is going to be used.
Good.
So these are my proposal in coming proposal is this my proposal meaning what I have configured on myself
on the for the great firewall and the incoming proposal what is the remote worker 40 client able to
two to negotiate with me if we are going to have Phase 1 and Phase 2 matching then we will be able to
establish this this remote VPN and the negotiation result is here proposal I.D. one with this does ESB
does and SHA 1 so using tunnel mode perfect.
This is also important adding a dynamic IP assay so security association selector good adding a route
so something something else that's doing behind the scenes of adding a route for the remote IP that's
going to be configured on the remote worker.
So basically the.
So if you look here basically the land APC has to have a route or has to have some connectivity in the
other side going to the remote worker.
So the issue for a firewall it's adding a route as we can see here for that specific IP address again
the land b c doesn't need to have a specific ground because this is the HQ for the final this is the
default gateway so any way it will send all its packets to the firewall but the firewall to have connectivity
to this IP because it is not in the land it says OK I will add a route so that I know that I can reach
reach you.
And how can I do that through this gateway.
So through this IP address.
So that's the the idea of adding this route now going further let's say so added IP sic with this with
these SBI.
Good.
Now what else
perfect and now because the VPN is up there are just there are just hello messages.
Are you there so saying that.
OK either.
Yes I'm here so the VPN should still be up we should not tear down the connection because we can see
each other.
So some kind of hello packets at specific intervals that those two are sending to each other and acknowledging.
So you can see are you there message received.
And I will send are you there.
Acknowledge.
So a c k so I believe that's it because we can see now only either and acknowledging the packet either
acknowledge and this is everything we should know in terms of how how the logs should appear in case
of or for working of a working VPN setup and in case something breaks we should see hopefully we should
see some some self explanatory messages but I'm definitely not going to tell you that this is going
to happen.
And anyway going.
Going this going this way and trying reverse engineering approach like OK I know how it works and what
messages are locked when it works well if if it's not working then I will work my way from that point
on and see where it breaks so that I can pinpoint the problem.
So this is the problem.
So anyway let's say the shared secret password is not good or maybe I'm not using correct Paramount
parameters for Phase 1 or maybe for Phase 2 in the negotiation.
So that will be all for this for this lecture and section.
Now please join me in the next section where we will talk about different troubleshooting scenarios.
Thanks a lot.