Welcome to today's session on Cisco Secure Access, focusing on remote access VPN. We will explore the essentials of remote access VPN or also known as VPN as a service. Let's explore the significance in enabling secure remote connectivity.00:04On today's agenda, we have three key topics. 1st, we'll provide an overview of remote access VPN. Next, we'll cover the prerequisites necessary to set up and validate the service. Finally, we will demonstrate these concepts in action through a practical demo. Let's proceed with our 1st section.00:21A remote access VPN is integral for providing secure encrypted connections for remote users, which is essential in today's mobile and hybrid work environments. It ensures consistent access to company resources, enhances productivity, and minimizes connectivity issues. Key authentication methods include digital certificates, radius integration.00:39And SAML SSO, our demonstration will focus on SAML authentication, utilizing Cisco Duo as our identity provider.00:59Simplicity delivers a consistent, intuitive connection experience across all endpoints, which reduces help desk overhead and simplifies user onboarding by standardizing how employees access corporate resources. Efficiency optimizes traffic flow to provide low latency connectivity, ensuring that mobile users maintain peak productivity regardless of their.01:07Network environment or physical location.01:27Before we begin, let's review the critical prerequisites. Network tunnel group, ensure a network tunnel group. Ipsec is established connecting your on premises environment to Cisco secure access to reach your private resources. SAML IDP, your duo SAML IDP must be configured for VPN authentication. We will need this.01:31Service provider XML file from Cisco secure access to finalize this configuration in duo.01:51User provisioning. Ensure user provisioning is complete, so your users are ready to authenticate via remote access VPN. Private resource configuration. Private resources must be configured correctly ensuring that the VPN connection's apostrophe dot.option is enabled under the endpoint connection method settings. These steps are crucial to.01:56To ensure a smooth and successful demonstration.02:16Secure client with the anyconnect module installed on a test PC. In this segment, we will put these concepts into practice. We'll walk through the configuration steps necessary to implement a functional and secure remote access VPN. As we explore the interface, pay close attention to the specific settings required to establish end user connection.02:19Activity. This walkthrough will provide you with a comprehensive understanding of how to operationalize remote access VPN in your own environment.02:39To start with a configuration, navigate to connect, click on end user connectivity. Click on virtual private network. As we don't have any pool yet, we will need to configure one. Under regions and IP pools, click on Manage to add an IP pool.02:48Click add IP pool. We will define our IP pool and DNS server and associate them with the region closest to our remote users. The IP pool is management VPN operations. E.g., if we're using radius for authentication, the request will originate from one of the IP addresses within this management pool.03:06Next, click add IP pool. This pool is required for your remote access VPN endpoints. Once a user connects, they will be dynamically assigned an IP address from this defined range. Next, provide a name for your IP pool and define the IPV four subnets that will be used to assign addresses to your remote user.03:28Users upon connection.03:48Take a second to look at the FQDN section. We can now use it to connect to your VPN secure access instance. Click on VPN profile. Next, we configure the VPN profile. Enter a name and display name, then specify the default domain and associate your DNS server.03:51If you haven't created a DNS server yet, you can do so by navigating to resources greater than DNS servers. Once you have associated the IP pool we just created, click next to proceed. Here we define SAML as the authentication protocol. Download the service provider XML file and upload it to your Duo app. This is the.04:09The step missing to complete for the prerequisite number two. Upload the duo's metadata XML file and click next.04:29You can configure how VPN traffic moves through your network. Selecting Connect to secure access enables a full tunnel while bypass secure access enables a split tunnel. For this demonstration, we are selecting bypass secure access. Finally, click add to define the specific internal networks that should be reachable through the VPN.04:37Add the private required subnets. Click save. Finally, you can configure advanced settings. To mention a few trusted network detection, TND, always on VPN, and start before log on While these features offer additional security and flexibility, they aren't required for this demonstration, so we will simply.04:58To click save to complete the configuration.05:17Here, you can see the VPN profile we have successfully configured. Navigate to secure access policy. Click on add rule. Private access. These rules within your access policy to govern interactions with private internal resources. This ensures controlled and secure access to intern.05:21Systems and applications.05:42This rule illustrates the process of granting access to AD users for our test server. We begin by specifying the rules name, test rule one. Next, we set the action to allow, meaning traffic is permitted only when specific security requirements are met, we then link the rule to the AD users, ensuring access is restricted to AD users only.05:45Finally, we set the destination to our private resource, test server, ensuring only the designated server is reachable. These configurations provide a secure, granular method to control access to vital network assets. Remember, precise rule configuration is fundamental to maintaining a strong security posture while enabling seamless access to essential resource.06:04Courses.06:24Navigate to connect greater than end user connectivity. Here, you can download the VPN XML profile to deploy to your test PC. Alternatively, if you prefer not to use an XML file for the initial connection, you can simply copy the profile URL from your VPN profile and paste it directly into the Cisco secure client. From there, the client will.06:27Will automatically handle the connection to your secure access environment.06:47Click on Cisco Secure Client. Select the VPN module, choose your specific VPN profile from the dropdown menu, and then download the associated XML profile. Go to your test PC where you're attempting the VPN connection.06:52In the exact directory path as seen in the screen, and drop the VPN XML profile. After an XML profile is manually copied, you need to restart the VPN agent service and close the secure client software. Understanding the location and management of these profiles allows for better troubleshooting and configuration of VPN settings.07:07Now, open the Cisco Secure Client, select your Duo VPN profile, and click connect. Complete the authentication process through the duo. Once connected, attempt to access your private resource. Access will be granted based on the policy rule we configured earlier.07:27Navigate to monitor, activity search. In this final segment, we'll explore the activity search feature. We can filter our logs by the access policy rule we created. Test rule one to isolate specific traffic. You can further refine your search by domain, identity or URL, allowing you to quickly trace a.07:44Events and actions across your environment.08:04Here, we can clearly see the users successfully accessing the private resource. This visibility is vital for monitoring and auditing your security policies. That concludes our walkthrough on remote access VPN. Thank you for watching.08:06
