Hear you and welcome back.
So today's video is going to be an interesting one, primarily because we'll be implementing declined.
We've been in pointing AWB so competitively it will be a little longer.
VIDEO.
Basically, I wanted to show you the exact implementation steps in detail, primarily because VPN technology
based knowledge is very important in a multitude of domains like solutions architect, DevOps security
and so on.
So if you have VPN knowledge and the configuration related knowledge, it will help you a great deal
in your career.
And this is one of the reasons why I wanted to focus about this in more detail.
So let's look into it now before we discuss about declined VPN implementation.
The first important concept is related to the mutual authentication, so mutual authentication, which
is also referred as to the authentication, is a security process in which the entities authenticate
each other before the actual communication occurs.
So what really happens here is that you have a plan and you have a VPN.
Now both of them will have a certificate, so Klein will have a blind certificate, so it will have
a server certificate and you have a certificate authority.
And this certificate authority basically has issued both of those certificates already.
Now what will happen?
Blind will go ahead and when connecting to the VPN, the will provide that line certificate.
The sorrow will Gordon provide the service certificate and both of them will be verified against the
certificate authority that had issued both of these certificates.
So in the network and do I meet with the mutual authentication is introduced.
This requires that both the client and the server must provide that digital certificate to provide their
identities.
Now, when you discuss about the client VPN, do note that data multiple ways in which the authentication
would work.
Force One is through the Active Directory authentication, where you can go ahead and specify the user
credentials.
Then you have a mutual authentication, which is certificate based.
The one that we were discussing just now and third one is based on the single signer, which uses salmon
based federation authentication audio.
So what we will be doing since we do not really have an Active Directory setup, we do not really have
a Single Sign-On based setup.
We will be going with a straightforward and user authentication based approach.
Now, in this approach, the first step is to go ahead and generate the certificates.
So there will be three certificates that would be required for this one this this year certificate,
the Sartore Certificate and the claim certificate.
So what we'll be doing first will be creating a Certificate Authority Certificate once this year.
Certificate is created from this year certificate.
We will issue the server certificate and the Claim Certificate Server Certificate will be associated
with the Client VPN endpoint and the Client Certificate.
We will be downloading it in our laptop so that when we connect to the client, we believe we can make
use of this client certificate.
Great.
So let's do one thing first.
Let's go ahead and create these set of certificates post, which will be discussing things in more detail.
So for today's video, what we'll be doing will be creating a new easy to instant and that easy doing
since Israel will go ahead and create the certificates that adequate.
So let's go ahead and quickly launch.
An instance will be using the Amazon Linux based DMA.
Let's quickly do a review and launch and will launch a two.
That's great.
Honorifics are easy to instances running.
Let's go ahead and copy the public IP and from the says it's terminal that you use.
Let's go ahead and quickly connect.
What is he to greet?
No.
There are multiple ways in which the certificates can be created and its associated configurations.
So we'll keep it simple, primarily because our aim is to go ahead and understand the claim to be winning
points.
So the simplest method is something that will be using great.
Now I already have the configuration commands available that will allow us to create our own certificate.
So what we do yet for us to install Git, we go ahead and clone a specific, easy RSA based project.
And from here we go ahead and create a CE certificate.
We go ahead and create a server certificate.
And we go ahead and create that line certificate.
So these are the three commands over here.
First, let's go ahead and install it.
So now from this yearly, let's go ahead and quickly install the gate.
Great ones, get us in, so let's go ahead and do get glow.
So if you do a list, you should see a new directory of easy IRS it.
Let's quickly go over here and within here again, there are multiple files available.
So what will you be doing?
Let's go ahead and initialize the PCA.
Oops.
We have to ensure that we under another easy RSA three direct three audio.
So this is the directory where you have to initialize it.
Let's go ahead and do it.
Great.
So now let's go ahead and create CAA certificate, the common name you can give whatever you intend
to do.
Let's say cedar key pillars or internal great.
So now you see it states that your nuclear certificate is available in this specific location.
The next step is to go ahead and create a server certificate.
Let's do that.
And the last step is to go ahead and create that line certificate.
Perfect.
Now, all of these certificates are basically stored in this decay directory.
So if they do a bigger audio, you'll see you have a C certificate and then another issue directly.
In fact, let me quickly show you under the issued directly, you have the server certificate, as well
as the blind certificate that we were discussing.
So in the next wave, what we'll be doing will be copying all of the certificates and its associated
key in a central folder.
So let's go ahead and do that.
So first, we'll create a central directory called Custom Underscored Folder, and then let's go ahead
and copy.
That's the Certificate Server Certificate, Sorority Line Certificate Client Key.
So in order to do that, let's go a bit out.
Let's do a list and let me go ahead and copy this up.
Great.
So the last command was to do a CD under the custom folder, and this is the reason why we ended the
custom folder here.
If I do it elsewhere here, in fact, let's quickly clear the screen.
So you're in this custom folder, you see a Certificate Client Certificate Client key.
So those server key?
Great.
So step one is complete it.
Now the step two is to go ahead and upload the certificates to the ACM, so you will be uploading the
CTA certificate, as well as the certificate of the software and certificate of the key.
Now do note that declined VPN endpoint only supports the certificates that are part of the ACM.
So this is one of the important steps that needs to be done.
Now there are multiple ways in which you can upload the certificates to use.
Let me quickly show, you know, within the certificate manager, you can go ahead and either upload
them certificates manually.
You or you can use this command to do it for you.
So we'll be using a simple approach.
So since we already have the easy to instance, we'll be using the IWC command to upload the certificates
to the certificate manager.
Now, before we do that, let's go ahead and quickly create a new IBM rule that will allow us to do
that within the IBM console.
Let's open up the rules will create a new rule.
And the policy, let's go ahead and search for a certificate manager, so for simplicity will be giving
a certificate manager full access audio.
Let's go ahead and create a we'll call it as a rule.
And we've created.
So now what we'll do, we'll go ahead and associate this rule with the easy doings then.
So another security, let's modify the rule and let's associate the gate all with the easy two.
And now what we'll do, we'll go ahead and use the IWC CNBC command to upload the certificate.
And what are the certificates that will be importing the service?
CRT does so to key as well as this year, Heidi.
All right.
Let's go ahead and copy this gunman and from the custom folder.
Let's go ahead and run this.
Now you are to make sure that you give the right region.
In my case, since I'm going to create a client, we've been in point in Singapore.
I've used the app Southeast Asian region.
So now if you'll refresh the certificate manager page, you should see that you have a certificate in
Botelho area.
Now, in the next wave, what we do will create a client VPN endpoints.
And once that line VPN endpoints are connected from our Windows laptop or from the Mac laptop or from
the Linux that you have.
We'll go ahead and connect to the client VPN endpoint and then will connect to the easy to instance.
So let's do one thing.
Let's go ahead and open up the client VPN endpoints audio, and let's go ahead and create a client VPN
endpoint.
The name Les Qualités a demo client VPN.
Now the next important part is the client IPB Fourcade.
Yet and again, there are multiple other options here.
One of the options that you will see is whether you want a mutual authentication or user based authentication.
As we were discussing a you select user base authentication, then you have an Active Directory based
authentication and separation based authentication.
However, since we do not really have any will be using a simple approach of a mutual authentication
and within you, it is also asking for this sort of a certificate, he added.
Now, before we go ahead and use this, let's go ahead and discuss about these options in more detail.
Now, the first option here is the client IPV for Thieriot, so you'll have to specify the IP address
read in C++ notation from which a client IP address is izing.
So within this diagram, you'll see that there are certain addresses that get assigned to client.
So this addresses something that you will be specifying within declined day before the idea.
So let's go ahead and do that.
I also tendered 0.2 0.0 Slide 22.
So this is first, but second part is the server certificate added now since you already uploaded the
certificate in.
The Easy will be using the certificate here, and it will also ask you for that line certificate to
and just use the service certificate.
Add in your ID set.
The next part is the connection logging.
Whether you'd like to log the connections I just see as not just for simplicity, then you added optional
parameters like the Anisotropy Letter specify 172, 31 0.2.
You can even specify the transport protocol will keep it simple within the website.
Let select the default VPC available and within the security group.
By default, it will use the default security group.
However, you can give any of the security group that you'd like to do.
However, will user default one.
Let's go ahead and create a clean sweep in endpoint.
Great.
Now, at this stage it is C pending associate.
Now, if will quickly see over here under this state, it is spending associated right now.
Now that brings us to this IPv4 witches association.
So to enable clients to establish a VPN session, you must associate our target network with the client.
We've been endpoint.
So you can have multiple subnet within your website, so you'll have to associate your client VPN with
the subnet where you want the client to be able to connect.
So let's go ahead and quickly do the association.
As with now within outlined VPN endpoint.
Let's go to association and let's associate the BBC will user default VPC and the subnet.
Let's do one e and this associate perfect.
Great.
So it is India associating speed.
Now the step five is the authorization step.
So to authorize decline to access the VPC in which the associated subnet is located, you must create
the authorization.
For example, let's say that there are two subnet where lined we've is associated.
So with the authorization rule, you can specify that all the users can access the subnet, but that
isn't critical.
So those that are running in subnet B, which contain sensitive information.
So what will happen?
Only the admin can access this on.
So this is what you can configure in the authorization step.
So within a console, you have the authorization you let Gordon authorize ingress that destination networks
to enable for simplicity, let's say, zero zero zero zero slices zero and grant access to.
You can either give access to all the users or you can even specify a specific access group you will
give it for all the users let's add authorization to.
Great.
Now the step six is to download the VPN configuration file, so basically you will get that configuration
file and you can download it from you.
Let's quickly do that.
So I downloaded.
So currently it is downloaded in my desktop.
Let's quickly open it to understand what it contains.
So within you, you see, it basically contains a lot of important information related to the certificate.
The end point where the VPN is listening to the port, where the VPN is listening to and so on.
So when the client wants to connect to the VPN, employing this configuration file becomes very important.
Now, if you have already seen that, if the client wants to connect to the VPN using mutual authentication,
the climate also supply its claim certificate and you also need that link.
Now we already have both of these details available, so you have the client certificate and that line
that is available and will be downloading both of these data in that laptop.
So if you do a deed, this is the exact location.
Let's log out from the server and let's quickly do the ACP.
Let's specify the IP address of the server will specify the exact location where that line certificates
are present.
I just go, OK, line stuff and will copy it to our desktop.
That's great.
So you see you have both of the client certificate and the client key now in this tapes.
Seven.
What we do we create a single configuration file.
Now this is what really happens is you have a different file for planned certificate.
Different file fault line key.
And a different file for configured OVP.
And so you have three different ways.
What do you do?
You combine all of them into one central site and through the same profile, you go ahead and connect
to the Blind VPN endpoint.
Now to create the sento configuration file is very straightforward.
What do you do?
You already have the whole VPN file.
You go ahead and append both the client certificate and the client key to this specific frame.
So first, what?
Let's do one thing let's copy Distanza submitted Cert Cert.
Let's copy it here in the configuration file, which we downloaded, and within a year, we'll go ahead
and copy that line certificate data.
So let's go ahead and first open up the client certificate.
We'll open up with Adam editor.
Let's open up the client.
He again, we'll open it up, admitted.
I'll copy the client certificate data.
Let's paste it within this third block.
Something similar to this.
And again, we have the E-block audio will go there, will go ahead and paste the client.
All right, let's do that.
Perfect.
So this is what the central configuration file looks like.
And one last thing that you will have to do is within their DNS, you'll just have to abandon the lasers
qualities, keep labs dot, and that's about it.
All right.
Single configuration file is ready.
Now, the last step is to use this intel file to connect to a client VPN endpoint.
Before we do that, we'll have to ensure that there are VPN is created, so this data must be available
now to connect to the client within Endpoint.
You will need us off it.
So what we'll do will quickly download the OpenVPN Connect based software.
Now, when you take open VPN Connect, this is the line that you need.
So let me quickly show you.
So this is the open VPN Connect client.
Again, it's available for a wide variety of operating systems, including Windows, Mac, Linux will
be downloading the Open VPN Connect for Windows.
You can download it for Mac or Linux, whichever operating system you might have.
Great.
So it has been downloaded.
Let's quickly open this up and install it in my windows.
That's great.
So now within the day, stopping will basically get to open VPN Connect.
And this is how it really looks like.
So let's go ahead
and agree.
And within the fight, you have to go ahead and import the central file that was created.
So the name of the single file was download client config or VPN.
So let's click on Ambrose within their desktop.
You have download line config or VPN.
I click on open and it has been imported not just for simplicity.
What will you be doing if you will see the Blind VPN endpoint basically goes to his and it connects
to easy to instant desired via its network?
So what you'll have to do just for simplicity to begin with.
Make sure that the security group here, whatever security group is associated, it has the right set
of inbound rules.
Let's go ahead and add a known rule.
I'll say all traffic, and I'll only allow from 170 to 31 zero zero 60, which is the internal network
of WPC Bovie.
And let's quickly click on Connect both.
So our client is now connected and you will see this great statistics.
So the time for verification has gone.
So now let's go ahead and get deep private IP.
So the private IP 172, 31, 22 26.
So I'll quickly do a ping on Wednesday, 22, 31, 22, 26.
And as expected, we are getting a replay from what you see to instance with the private IP.
No one's surprise here is that if you'll quickly open up the instance, let me rephrase you see, you
will not really see any data at this moment.
Now, in fact, let me quickly show you as they fail to refresh the page.
You see, my internet connectivity went away.
And this is very important when you configure VPN.
One of the very important thing is the routing.
Now, since the internet connectivity went away, so you'll basically only be able to connect to the
private network of 172 31 zero zero 16.
So once you have disconnected, let me rephrase it, you should see our page working.
So now what you need to do under the roundtable, you will see there is one routing dream of destination
172 31 zero zero 16 that is allowed.
And this is the default mode.
So let's say you want the internet connectivity as well.
Let's go ahead and specified our destination of zero zero zero zero.
We will specify the subnet 80 I'll create out.
All right.
So now, if a client is trying to connect to a destination which is not this, then it will be routing
through this specific entry.
If it if this second out entry is also available, let's go ahead and again connect to our VPN.
Yes.
And now let's try and refresh the page to see if internet connectivity works.
And yes, it does.
Along with that, you can also under the connections.
You can also see the connection related information from your.
And it also shows you the status.
In fact, let me show you one status is monitor.
Second, status is active.
Great.
So I hope with this you understood at a high level overview the basics of climbed VPN and point again,
a little long VIDEO But we discuss everything in great detail so that are concept related to the planned
VPN endpoint is fundamentally strong.
So with this will conclude today's video.