Network security a virtual private networks setting up an SS VPN portrait or on the firewall.
I am going to send Cisco A is say 5 5 or 5 fight a war and show you how to enable SSL VPN on it.
It will be there for Larb.
It means we are going to start from scratch.
There is absolutely no configuration on this for your war.
All I did I signed an IP address there to show you how easy it is to set it up.
The neighbour played on it pretty advanced and sophisticated.
It's a Issei firewalls.
To manage an a safe firewall we use a piece of software that is cold.
A sdm A is the M It is.
Locate it on the fire of war itself and we have only a small application that will connect to this A
is the M on C A is say.
As is an IP address pen though that seven books seven but 1 and I am connected with a cable.
God is my inside interface.
It doesn't really matter for now.
The idea is to connect through it enable SS so and see how it works.
We go to configuration.
Hand in here you have a few options.
We are interested in remote access VPN.
There are two maybe three things that we have to do to make it happen.
First of all we are interested in the client less version of SSL VPN.
We wanted to create design a portal right buzzword you want to win.
Two main things here a group bolly see the connection.
5.
We're out of a group poissy which is pretty simple aren't We are not going to modify a lot of options
here.
We're name it.
Group poissy one when you go for more options.
If the most important thing is to lock it down to a protocol that we're going to use.
You should know that dart's unearths notice that there are a lot of protocols available.
It makes sense to enable the one that were going to use it now were a case it is cliental less SSL VPN.
We don't need a VPN client to t.p nothing out.
As you can see there are some options for our product or well tweak all these things later on.
We apply and send it to the device.
The next thing is more important connection profi before we go Dad.
It's like an additional step you have to tell this guy you wore which interfaces are l.r. out to establish
an espresso connection.
I will enable it for bowls.
And will apply it.
It is time to create our will.
Prof fire we can ignore that message.
We click our.
Give it a name.
Profile one.
The first question is what about the authentication with this cast there are two main solutions available.
Lol.
Or we can have a dedicated server like a radius server.
In our case we want to keep it simple.
Will you use their local authentication.
We don't really need DNS settings because it is a portal on group policy.
It is the one that we create it.
We go to advance and to get it started.
We have to create a you were our something that we will not give to a user.
All if it is lets say you were setting up for yourself you will use data to connect to the say mechanic.
And in my case I will use the inside IP address in very well.
In most cases you use specify.
I would say the AP address or the DNS name for instance.
I don't know let's say this Microsoft dot com for or its slush SSL or whatever you are and you're interested
in.
You can have more than one.
By the way and then cast my vote.
Craig.
Paul he says it is very flexible.
For now we want to keep it simple.
I will copy darts.
Cause I will need that when I.
Open Firefox.
Let's go to Firefox and see if it works.
That is a message saying dart's 5 fogg's can not verify the identity of the ACA and of course it makes
sense because the NSA generated it's all an cert.
I am okay with that.
I will confirm and move on.
That's a good sign.
We can see a you can amend passwords kareen.
I will log in as deep.
I mean we show you how to create a local car and we can log in.
That's a good start.
But the SSL VPN poorer.
The main page Dhat you will see or your user Swades see when they connect.
What what can you do from here for instance you can browse a website an internet website secure Web
site.
This is if you have a shared folder or you can use f.t. P.
There are some additional protocols that you could enable.
Let me.
Let's log out for now.
That was simple right.
Let's create a user cause that's what we want to do.
We go to device management.
Here if I manage to click you will see darts.
But what is allowed on the ACA unp.
I am interested in this option.
User Accounts.
I will create a new user account.
Hard.
I will call it past passwords Cisco and its very important to goal for this option.
It means that this is a VPN user only he is not allowed to manage my device.
Just a VPN and access whatever I allow this user to access.
Lets go to Firefox again.
Log on and test it.
It makes sense to test every single feature especially if its like your first VPN set up.
Make sure that you were happy.
On the year you say you can go to monitoring VPN.
Aunt if you go for client less you would see this connection has been established.
What do you have to remember is thats NASA like Bach will heif to assist Sal licences only.
It means that or yes you have to pay some money if you want to add more lie.
You have to if you want to have more you a assigned allow more connections.
You have to pases go out.
Believe me it is not cheap especially especially for an SS So poor at all it can be really expensive.
This the main reason why Cisco they have been pushing Darte in their last couple of years.
Let's go back to the configuration.
Now we are very happy we can connect but it's you know there is absolutely nothing on these VPN.
We can add a lot of options and features he I want to show you how you can create a bookmark and customize
this screen.
Let's start with bookmarks.
What does a bookmark.
It's very similar to a bookmark for assessing Firefox are into an explorer.
Are you will tell you users old pipe.
This is what's undecide probably now most of them women not memorize anything.
We can create a bookmark they can click on it's on the get to for instance a SharePoint website or a
share to drive whatever you have available in your network.
You can give them access to their local APC a USA supports plugins you can aahed.
A small file on an HSA file War and thanks to that you can.
Are the new protocols for instance our ADP remould there's the protocol that allows you to measure to
connect to spc remotely a very Papilla solution for a user who works from home.
Way to keep it simple for now and we're customize our create some bookmarks.
We go to remote access the pens and almost all options are here under this portrait or option.
We are interested in bookmarks.
We're create a new.
And call it bookmark one.
When we click it where specify a list off.
Protocol is like the options that are available.
I do not have any plug-in.
That's why for instance our ADP vsc is not on the list.
We could do that.
Keep it simple.
Bookmark right.
Tests.
And here you will specify.
This is a protocol that allows you to access share to foreigners and files.
At say 10 but seven that seven but 2 x.
A shared folder.
You can get that from your infrastructure in 10 years of course if you're a whole machine.
Now what's what is the path for you.
Local.
Devices other rithy exist let's call it one a.
As you can see I have play with these solutions are ready.
SEN.
Let's bookmark is there.
However it has not been applied the disconnection profi or group quality will have to go there.
And here.
Aimed at the far east.
Not here.
Is it now under a group policy for a sole many options that's under the group policy.
We came out this bookmark.
Here we go.
Mark.
A click okay.
Apply.
Sam.
Sometimes there's enough to refresh and so Web sites and you have to log in and log off.
Let's look out.
Pest that.
Tests.
Sick.
There's brookmyre.
It's there.
That is my local APC because I specified a real IP address.
Not sure if X is real for there might not work.
It doesn't matter.
Yeah the idea is that you can see Dotti now action passed on.
It asks for ease in the past.
What if I specify something that but not like this.
It will tell you darts.
Straight away.
I missed that.
Let's.
Let's refresh starts.
10 thoughts not a or 8 dot three.
Something that does not exist.
I will try and browse to it.
It will complain that it can not connect to that holst because I specified something that was available.
When I asked for a username and password.
There are some issues with this protocol.
It's not a very reliable solution in many cases you have to find some ways around to make it work.
To be fair does not the most important feature in most cases people who VPN you as this portal to answer
some.
Not Phi's really.
Bart's.
Aren't they use protocols like our ADP remould list the protocol or vanoc.
Let's look out o show you how you can customize this screen.
You can literally change change everything here including the logo text messages everything.
That is under a customization.
We click ARED create a newer test customization one.
In here it is divided into two main sections and logon page and part of page logon page of course.
This.
Test as so it will show with this page when you want to log again.
You can put some additional information.
Copyright's some warning saying dart's connect if you're authorized.
Thus the part of page is something that will be shown to your users or to you when you connect when
you when you are authenticate it.
Here it is.
You can change the logo.
That's what they showed you you can change the kind of let's let's just play with the will show you.
Yes change starts size 1 50.
Paul.
You can lock it down for instance you don't want your users to have access to all options.
Let's say you want to give them answers to web applications.
That's where where you can change.
I'll show you that's in a moment.
Well you can.
Changed out in the connection profile.
Sua.
Handgrip voice he goatherd foust.
Customization is Pest's.
Click okay.
Apply in the group Polisi I think it was under say group Polisi.
Yes poor at all here.
You can lock it down for instance you were there.
Well I don't want.
Them to use these three options.
I don't want them to have our access to Active X.
Really.
It's very very flexible.
You are an entry now.
Disable it.
The best way is to play you have it try click everywhere and see how it behaves.
Let's look.
Gone.
But they named us we apply its user name with this test not their sko.
As you can see there is no field to type.
There you are.
We remove that.
We removed a lot of options on the left hand side.
Well I have set up a lot of s.o.s.
Pierce for a third party.
For companies that were allowed to for instance connect to one server.
It's very important to lock it down and literally they could click on one link very similar to this
green but you can see now there was only one link one.
One bookmark for them.
LR wink to connect to to a server and nothing out.
It's not complicated even though that is a Cisco a safe firewall.
You say it's pretty easy to manage it.
Because thanks to this A as the M.
To.
That is really reliable.
Not sure if you know bucks in Cisco in most cases.
We use this lie.
We do have to type all the commands.
However as you can see as the yem is a reliable tool armed you can use dart to menace your ayissi say
in most cases you don't have to use this year.
Lie is good to know it.
Sometimes a is the yem can be confused.
In our example.
Everything was okay aren't we were able to connect to this SS So poor at all.
In this video I showed you how to set up an SS porritt or on a Cisco ASAP file or thank you very much.