ipsec

The video demonstrates configuration of remote access IPSec VPN with Windows software client on Cisco router. We will look at both simple pre-shared key authentication as well as using client certificate. The client is placed behind a NAT router to demonstrate the significance of NAT Transparency, and compare it to raw IPSec and cTCP (IPSec over TCP). The video finishes off by showing how client can be allowed access to local subnet when a non-split tunnel is used.

The video shows you how to enable Cisco Tunneling Control Protocol, also known as, IPSec over TCP, on Cisco router Easy VPN (EZVPN) connection. cTCP can potentially be a solution when you need to establish a VPN through a device or network that does not support ESP protocol. TCP encapsulation makes IPSec traffic NAT-friendly at the cost of additional overhead of TCP header. In this lab, we will simulate an unsupported network using ACL to block ESP and shows how cTCP provides a workaround.

• EZVPN with cTCP (aka IPSec over TCP)

The video desmonstrates the configuration of Easy VPN (EZVPN) using Dynamic Virtual Tunnel Interface (DVTI) on Cisco routers and explains its benefit over the conventional EZVPN with 'crypto map' or tunnel interface with GRE. Here we introduce the concept of Virtual-Template. The second half of the video shows example of additional features that you can implement with VTI using QoS and multicasting. 

The video demonstrates three different operational modes available on Cisco Easy VPN (EZVPN) router hardware client, namely Client, Network Extension, and Network Extension Plus, and explains when they should be used. We will also look at how to support multiple remote subnets, and NAT compatibility specifically when you run Network Extension or Network Extension Plus. These configurations only pertain to the hardware client side.

The video demonstrates various methods of EZVPN hardware client to initiate an IPSec connection. In this lab, the headend router is setup with Easy VPN (EZVPN) with Pre-shared key authentication, while the client is configured to run in Client Mode. We then explore different 'connect' and 'xauth' configuration options on the client side.

The video walks you through configuration of Easy VPN (EZVPN) with Pre-shared key and certificate authentication on a Cisco headend ASA firewall. The hardware client router is running Client Mode and configured to automatically connect using a locally stored credential. This video is a counterpart of SEC0015 and SEC0016 with the headend router. Here we introduce the concept of 'group-policy' and 'tunnel-group' that are unique to the ASA, while most crypto command syntax is very similar to those on a router.

The video walks you through configuration of Easy VPN (EZVPN) with Certificate authentication on a Cisco headend router. The hardware client router is running Client Mode and configured to automatically connect. Headend router already has a certificate installed through SCEP (See SEC0014 - Certificate Installation on Router and ASA), while we demonstrate a manual certificate import on the hardware client. XAuth can also be enabled concurrently, although we have XAuth disabled in this lab. 

The video walks you through configuration of Easy VPN (EZVPN) with Pre-shared key authentication on a Cisco headend router. The hardware client router is running Client Mode and configured to automatically connect using a locally stored credential. We demonstrate unique characteristics of Client mode where connections can only be initiated from the remote client as the client router performs PAT to the source IP. Any resources local to the client is inaccessible from the headend side.

The video presents an alternative to assigning IP address to DMVPN spoke tunnel interface using a centralized DHCP server. We look at this feature in a dual-hub environment, point out some routing caveats with return DHCP packet to the router acting as a relay agent, and a quick resolution.

The video demonstrates another method of achieving redundancy in your DMVPN deployment using NHS cluster and recovery backup feature. We look at how routing and EIGRP neighbor adjacency changes when a spoke registers to one or more NHS at a time in the same cluster, and observe the failover behavior. This feature provides a good compromise between failover time and routing simplicity.