WEBVTT 00:00:01.740 --> 00:00:07.050 All right, now that we have a pfSense installed and our network segmented, 00:00:07.440 --> 00:00:11.020 it's time to set up the remote access VPN connection, 00:00:11.640 --> 00:00:15.410 tie ourselves back to the authentication server or Active Directory, 00:00:16.040 --> 00:00:18.720 and segment those VPN users as well. 00:00:18.890 --> 00:00:21.950 So, let's hop over to our jump box again, 00:00:22.440 --> 00:00:23.430 and as you can see, 00:00:23.430 --> 00:00:27.350 we have our firewall rules that we created in the previous demo, 00:00:27.450 --> 00:00:31.030 and our MGMT network is a little bit more restricted now. 00:00:31.030 --> 00:00:34.990 These are similar rules to what we have on the user side as well. 00:00:35.740 --> 00:00:38.600 If we discover that we need any additional ones throughout the whole 00:00:38.600 --> 00:00:42.330 process of configuring the firewall for VPN termination, 00:00:42.340 --> 00:00:45.170 then we'll come back in here and configure some more. 00:00:45.180 --> 00:00:46.180 But remember, 00:00:46.180 --> 00:00:49.710 these firewall rules are for traffic that originates on those 00:00:49.710 --> 00:00:52.960 interfaces or in the networks attached to those interfaces. 00:00:54.240 --> 00:00:54.650 All right, 00:00:54.650 --> 00:00:57.790 so the first thing that we need to do is go set up an authentication server. 00:00:57.790 --> 00:01:02.440 To do that, I'm going to go to the User Manager and then Authentication Servers. 00:01:02.480 --> 00:01:04.530 Right now we only have the local database, 00:01:04.550 --> 00:01:08.160 so I'm going to go ahead and click Add, and we'll go 00:01:08.160 --> 00:01:10.000 through the configuration options for this. 00:01:10.000 --> 00:01:15.950 So our name is going to be our GloboDC_LDAP. We'll call it GloboDC. 00:01:16.740 --> 00:01:21.410 Our host name or IP address, we'll type in the IP for it. We'll leave 00:01:21.410 --> 00:01:29.060 it at the default port 389 and standard TCP. Our Peer CA is going to be 00:01:29.060 --> 00:01:32.310 the Global CA because that's what we're going to use to validate the 00:01:32.310 --> 00:01:37.500 LDAP server certificate itself. We'll leave the protocol version and 00:01:37.500 --> 00:01:40.050 the timeouts the same, the search scope the same. 00:01:40.940 --> 00:01:49.850 Our base DN is going to be dc=globomantics,dc=com. Okay. 00:01:51.140 --> 00:01:54.540 And we'll leave our authentication containers alone. 00:01:54.580 --> 00:01:57.160 If we wanted to add some of these, we could. 00:01:58.140 --> 00:02:01.930 And as far as the authentication containers go, we'll go ahead and add those. 00:02:01.930 --> 00:02:11.310 So we'll do cn=Users and then the dc=globomantics. And we'll change the 00:02:11.310 --> 00:02:14.900 search scope to the entire subtree, that way we have the entire scope 00:02:14.910 --> 00:02:17.360 there. We'll leave everything else the same. 00:02:18.520 --> 00:02:23.840 The initial template is going to be Microsoft AD. So our user 00:02:23.840 --> 00:02:28.460 naming attribute is going to be samAccountName, and then our 00:02:28.470 --> 00:02:30.850 group naming attribute is going to be cn. 00:02:32.140 --> 00:02:38.090 And then we're going to go ahead and make sure that this is UTF8 encoded and 00:02:38.090 --> 00:02:41.380 we're not going to strip away parts of the username. All right. 00:02:41.390 --> 00:02:42.360 We'll save that. 00:02:44.540 --> 00:02:48.160 All right, and now that we have it created, we can actually go ahead and use it. 00:02:49.640 --> 00:02:52.370 So now to set up the actual VPN connection, 00:02:52.370 --> 00:02:57.860 we can either use the wizard to help walk us through it, or we can 00:02:57.870 --> 00:03:01.210 configure it on our own. If we're using the wizard, 00:03:01.240 --> 00:03:04.170 we just go over to the OpenVPN section, and there's 00:03:04.170 --> 00:03:05.580 the Wizard button right here. 00:03:05.590 --> 00:03:08.160 It makes everything fairly easy to do. 00:03:08.540 --> 00:03:12.190 Just walks us through step‑by‑step and gives us options to input 00:03:12.200 --> 00:03:14.150 different configuration parameters for it. 00:03:15.440 --> 00:03:18.140 Instead, we're going to go just create it ourselves. 00:03:18.150 --> 00:03:26.720 So in the servers area, we'll call this GloboVPN. In our options here, 00:03:26.730 --> 00:03:30.790 we're going to select Remote Access (User Auth), and the back end for the 00:03:30.790 --> 00:03:35.510 authentication, we're going to use our GloboDC back end, that LDAP back end 00:03:35.510 --> 00:03:40.830 that we just configured. We'll leave it in tunnel mode. We'll leave it UDP 00:03:40.840 --> 00:03:44.260 on IPv4. The port is going to be 1194. 00:03:45.340 --> 00:03:47.370 We'll go through and configure these certificates. 00:03:47.370 --> 00:03:50.560 We'll use the server certificate there. 00:03:51.840 --> 00:03:55.520 We have options to select the encryption algorithms that we're going to use. 00:03:55.720 --> 00:03:57.870 We're going to leave these the default as well. 00:03:59.240 --> 00:04:01.860 So as you can see, there's a lot of configuration parameters that 00:04:01.860 --> 00:04:05.540 we can actually set up here if you want to control how the 00:04:05.540 --> 00:04:10.300 certificate authentication piece works, how the encryption works, 00:04:10.300 --> 00:04:12.450 what algorithms you're going to use, so on and so forth. 00:04:13.420 --> 00:04:17.200 And we're going to program our network in here. We'll force all 00:04:17.200 --> 00:04:21.230 traffic through the tunnel, so we don't want to do split tunneling 00:04:21.230 --> 00:04:24.390 here. And we'll provide our default information. 00:04:24.390 --> 00:04:27.260 So our default domain is going to be globomantics.com. 00:04:28.440 --> 00:04:30.560 We'll give them a DNS server as well. 00:04:31.230 --> 00:04:33.260 And then if we wanted to, we can make Windows 10 clients 00:04:33.260 --> 00:04:37.050 block DNS servers, except for across the VPN. 00:04:38.340 --> 00:04:42.170 I'm not going to make any custom options here. And then 00:04:42.170 --> 00:04:43.580 we'll leave the logging at default. 00:04:44.040 --> 00:04:49.070 All right, so our connection is set up now. And now before we can actually 00:04:49.070 --> 00:04:52.750 connect to the VPN, we need to install what's called a package. 00:04:53.640 --> 00:04:57.350 So there's an export package for OpenVPN that we 00:04:57.350 --> 00:05:00.560 have available to us right here. 00:05:00.570 --> 00:05:02.350 It's called the client‑export package. 00:05:02.350 --> 00:05:05.840 So we'll go ahead and install that. And what this does is it 00:05:05.840 --> 00:05:10.740 gives us an easy way to export the configurations and the 00:05:10.740 --> 00:05:12.550 OpenVPN client if we need it. 00:05:13.340 --> 00:05:17.370 These pfSense packages are really cool and really help us expand a 00:05:17.370 --> 00:05:20.360 lot of the functions of the pfSense firewall. 00:05:21.040 --> 00:05:22.300 All right, now that that's installed, 00:05:22.300 --> 00:05:26.600 let's go back to OpenVPN, and as you can see, we have this Client Export piece 00:05:26.600 --> 00:05:32.030 here. So, the remote access server that we configured just now is right here. 00:05:32.030 --> 00:05:35.500 We're using the IP address for the resolution. 00:05:36.640 --> 00:05:40.760 We are going to verify the server, and then I'm not going to 00:05:40.760 --> 00:05:42.790 do any advanced configuration options here. 00:05:43.820 --> 00:05:47.460 Now here we have a couple of different options as far as downloading the 00:05:47.460 --> 00:05:51.620 client and the configuration parameters themselves. 00:05:51.640 --> 00:05:55.330 So what I'm going to do is hop over to our other Windows box that's still 00:05:55.330 --> 00:06:00.100 connected to the user network and download this stuff, and then we'll 00:06:00.100 --> 00:06:04.710 change the network over to simulate the outside network and allow it to 00:06:04.710 --> 00:06:08.490 connect to the VPN. So we'll download this. And I'm going to choose the 00:06:08.500 --> 00:06:13.800 Inline Configurations for most clients, and then the Current Windows 00:06:13.800 --> 00:06:14.760 Installer as well. 00:06:16.740 --> 00:06:21.060 Okay, now let's throw those on our Globomantics share. 00:06:22.540 --> 00:06:23.150 All right. 00:06:23.160 --> 00:06:28.360 And there we go, now that that's on the share, we'll go over to our Windows box. 00:06:29.740 --> 00:06:30.330 All right. 00:06:30.340 --> 00:06:36.490 And we'll go ahead and run that to install the OpenVPN client on this computer. 00:06:40.340 --> 00:06:42.400 We'll let it run through the installation. 00:06:42.500 --> 00:06:45.300 Now this makes it really easy for us to be able to quickly 00:06:45.300 --> 00:06:47.860 deploy via GPO or anything like that. 00:06:49.840 --> 00:06:51.960 All right, now that the installation is completed, 00:06:53.440 --> 00:06:56.320 we'll go ahead and close the installer and then hop 00:06:56.320 --> 00:06:59.540 over to vCenter. And as you can see, 00:06:59.540 --> 00:07:04.400 we're still on the Globo_31 network, so let's go ahead and edit the 00:07:04.400 --> 00:07:09.170 settings for this virtual machine and change the network over to the 10 00:07:09.170 --> 00:07:12.460 network, that outside network that we're replicating. 00:07:13.740 --> 00:07:17.930 All right, let's verify our IP address. All right. 00:07:17.930 --> 00:07:19.060 We're in the 10 network. 00:07:19.440 --> 00:07:23.360 So let's go ahead and see if we can connect to the VPN.