That was a great demo about configuring the IPsec connection with
DMVPN and seeing the authentication header in action.
In this clip,
let's talk about the remote access VPN and configure it so that we
can protect our individual endpoint connection.
First,
we'll go over the connection between the endpoint
and the VPN termination device.
Then,
we'll configure the VPN connection from our Windows machine and
connect to the NordVPN servers to protect our data.
We'll be running a packet capture right from the Windows box so that we
can see the data being transmitted out of the interface.
This will give us the ability to analyze the VPN connection and its components,
as well as how it's built out in an IP stack of an operating system.
Let's hop in and give it a shot.
Now we're going to hop in and configure and analyze an IKEv2
remote access VPN using a service called NordVPN.
You can do this with just about any commercial VPN provider though,
so whatever your chosen flavor is,
go ahead and configure it so that you can protect yourself.
You can also do this with your organizational VPN termination devices so
that you can connect to the corporate network if needed.
This is where the remote worker connecting to the
organizational resources comes into play.
So here, as you can see, we're able to see our IP address,
the public one anyway, and some information about the owner and location of it.
This isn't good and doesn't provide us with much security,
so we'll set up our VPN connection.
The first thing I'm going to do is install the certificate from the vendor.
This is going into our Trusted Root Certificate Authorities store.
Windows makes it relatively easy to install certificates on your machine,
so walking through the wizard should be fairly simple.
This certificate is going to make sure that we can trust the
servers from the vendor that we're connecting to so that we can
successfully establish the VPN connection.
Now that that's installed,
we're going to hop over to our network connections in the
Control Panel and configure a new connection.
Most VPN providers have an app that you can
download to do this all automagically,
but I like to have manually set up connections,
if possible, so that you can get granular and control the setup.
Plus, who likes having additional unnecessary apps on your device?
We're going to walk through the connection setup
wizard and connect to a workplace, selecting to set up a VPN connection.
The Internet address is going to be our VPN termination server.
In this case, I'm just randomly selecting one of the available ones for me.
I like naming my VPN connections based on what they provide,
so this one is going to be labeled IKEv2 Secure VPN.
Now that it's created,
let's look at some of the options that we can tweak within it.
Opening up the properties for this newly created connection,
we're able to customize this a little bit.
I'm going to focus on the Security and Networking tab right now since
that's where a lot of the changes need to be made.
In the Security tab, I want this to only be for IKEv2,
so I'm going to change this Type of VPN to just that.
It's really the most secure, in my opinion, out of the options here.
Within the Advanced Properties, we can define the network outage time for it.
For encryption, we want to encrypt our data.
Remember the last demo we had where we didn't?
Yeah, I don't want anyone to see my device's traffic.
For the Authentication piece, we have two options, EAP or machine certificates.
I'm going to be using EAP for this one,
but certificates are a great way to securely connect your devices.
So we're just going to use MSCHAP v2 with username and password to connect.
Talking about the different EAP types is something
outside of the scope of this course.
Looking at the properties for this,
we can have it automatically use our Windows login credentials if we wanted to.
This is helpful for organizations using the same
credentials for login and VPN access.
Moving to the Networking tab,
we're disabling IPv6 since that's a requirement for
this particular vendor to do.
Okay, now it's showtime.
We're going to start our Wireshark capture on our
internet interface and connect to the VPN.
I have the connection set up to cache my credentials for now on,
so it's only going to prompt me this first time.
As you can see in the background, my Wireshark capture is going crazy.
Moving back to the browser,
I'm refreshing it so that we can verify that our IP address changed,
and it did.
Okay, let's stop the capture now and check out what's going on here.
Doing a little scrolling,
we can see here that this is where our IPsec connection has started.
We see our DNS request going out to find out exactly
where the server is that we configured.
Then it gets to the fun part.
Now,
we'll be talking about the different IKEv2 modes and
phases later on in the course,
but here is where that ISAKMP SA negotiation starts.
Notice the port is 500 here within this packet.
Within these packets,
we see a lot of the same information that we saw
earlier in other ISAKMP packets.
We have the SPI, as well as the exchange types and payloads.
For IKEv2, look at all of these Payload fields.
And check this one out!
It automatically detected that we have NAT going on somewhere in the path,
and I bet you this is going to trigger the NAT-T
function so that the port will change.
Moving into the next packet, after the detection of the NAT device,
the port changed to 4500!
This is the beauty of the functionality of IKE and how it
can help us set up our connections.
And scrolling down just a tad bit more,
we have the ESP packets that started after the negotiations finished. Again, everything is encrypted, so we can't see the payload at all.