FlexVPC invented SafeXain, Private Blockchain put to work and invented Flex2N, a redundant virtualized Datacenter. FlexVPN is a framework to configure IPSec VPNs on Cisco IOS devices; it was created to simplify the deployment of VPN solutions of all type (Site-to-Site, Remote Access etc). It uses a common configuration template for all VPN types. FlexVPN is based on IKEv2 and does not support IKEv1. The Best Premium Unlimited VPN Proxy. PlexVPN has one repository available. Follow their code on GitHub. FlexVPNalso known as 'Unified Overlay VPN' is Cisco's implementation of the IKEv2 standard featuring a unified paradigm and CLI that combines site to site, remote access, hub and spoke topologiesand partial meshes (spoke to spoke direct).FlexVPN offers a simple but. FlexVPN network topology The network we’ll be looking at is a dual-hub dual-cloud FlexVPN with PKI authentication. Each FlexVPN cloud is represented by its own domain encoded in Common Name (CN) attribute of X.509 certificate. Each Spoke will have a unique certificate per-cloud and will connect to both FlexVPN Hubs.

Flexvpn Asa
Flexvpn Anyconnect
Best Vpn Service

This post going to consist of my notes for FlexVPN. This is not an exhaustive list. It only covers the topics on the CCIE Enterprise Infrastructure lab exam. If you are looking for more in depth topics I highly recommend this book.

WHY?

Cisco has many different VPN implementations over the years.
Most were developed independently, so they have their own configs, show commands and feature sets. For example, DMVPN uses mGRE, dynamic overlay routing and does not support AAA and per-peer policy out of the box. Meanwhile, EzVPN uses p2p IPsec VTI interfaces, integrates with AAA and supports per-peer policy, but no dynamic overlay routing.

For tunnel protection, IKEv2 brings together a lot of functionalities that were earlier defined in multiple RFCs. The introduction of IKEv2 into IOS was used as an opportunity to unify different VPN solutions, bringing them under the same config & building blocks. This resulted in FlexVPN. Flex VPN was created to simplify VPN deployments and cover all types including remote access, site to site, managed security services, etc.
With the exception of GET VPN, FlexVPN encompasses all previous IPsec VPN functionality. Best wwe moves.

BENEFITS:

Can use over any transport network
Standards based (3rd party compatibility)
Support for multiple topologies, like p2p, remote-access, hub-spoke, dynamic mesh
Multicast Support
Superior QoS – Per tunnel or per SA
Multiple VPN technologies under one CLI
Reduces need to learn multiple VPN technologies
Unified config & show commands across the supported VPN topologies
Support for per-user or per-peer policy
Support for dynamic overlay routing
Integrates with AAA
Supports GRE & Native IPsec encapsulations
Supports IPv4 & IPv6 overlay and underlay with auto-detection of IP transport type

BUILDING BLOCKS

IKEv2

Features like:

IKEv2 redirect for server load balancing
Dos Mitigation
NAT traversal
IKEv2 fragmentation

Cisco IKEv2 Features

Call admission control
Session deletion on certificate expiry

IOS Point-To-Point Tunnel Interfaces

Either GRE or Native IPsec encapsulation
Statically configured on initiators and dynamically instantiated on responders from a virtual template interface
Benefits:
- Most IOS features are interface-centric, meaning they have to be applied to an interface
- This makes it possible to apply a different QoS policy or ACL per-peer
- Because of the per-peer interfaces, multiple peers can be behind the same NAT device. This was not possible with DMVPN

AAA Infrastructure

Majority of this is out of scope for the CCIE EI, but there are a lot of options and it is very flexible
Allows for centralized policies:
- Split-tunnel
- Encryption network policy
- VRF Selection
- DNS Servers
- and more

FlexVPN Components

SERVER – Acts as a VPN headend for remote-access and hub-spoke VPNs
CLIENT – IOS router-based for remote offices and mobile works to provide VPN connectivity to headquarters

FlexVPN Types

SPOKE TO SPOKE
- Enables 2 clients to establish a direct crypto tunnel
- NHRP is used for resolving clients on the network
MPLS over FLEXVPN
- Uses MPLS & MP-BGP to distribute overlay labels for different VRFs
- Used when customers need to dynamically discover overlapping networking with NHRP and be encrypted with IPsec.

FlexVPN is a framework to configure IPSec VPNs on Cisco IOS devices; it was created to simplify the deployment of VPN solutions of all type (Site-to-Site, Remote Access etc). It uses a common configuration template for all VPN types. FlexVPN is based on IKEv2 and does not support IKEv1.

IKEv2 Features

IKEv2 is more secure than IKEv1 because it supports the latest Suite B cryptographic algorithms
Built-in support for Dead Peer Detection (DPD) and NAT-Traversal
Is resistant to DoS attacks
Consolidated IKEv1 main and aggressive modes into one method, called “initial”
Supports more authentication methods; in addition to PSK, certificates it also supports EAP authentication.
XAUTH not used in IKEv2, EAP is used for authentication instead: EAP Tunneling: EAP-TLS, EAP-PEAP, EAP-PSK, EAP Non-Tunnelling: EAP-MSCHAPv2, EAP-MD5, EAP-GTC and EAP Anyconnect

IKEv2 Message Exchange

IKEv2 has only two initial phases of negotiation: IKE_SA_INIT exchange and IKE_AUTH exchange.

IKE_SA_INIT

The initial exchange, in which the peers establish a secure channel by agreeing IKEv2 Proposal.
This happens un-encrypted
The exchange contains 2 packets/messages – combines all the information from IKEv1 MM 1-4

IKE_AUTH

Once IKE_SA_INIT exchange is complete all subsequent communication is encrypted
IKE_AUTH authenticates the remote peer using the method specified in the IKEv2 Profile
Once the peers have successfully authenticated the IPSec SA is established

CREATE_CHILD_SA (Optional)

The CREATE_CHILD exchange is used if the IKE SA or one of the Child SAs needs to be re-keyed. This serves the same function as Quick Mode exchange does in IKEv1.
Only 2 packets in the exchange, but will be repeated for every re-key or new SA.

IKev2 DoS Prevention

IKEv2 uses stateless anti-clogging cookies, which is used for protection of DoS attacks from spoofed source addresses. The initiator sends an IKE SPI to the Responder, who acknowledges the SPI sent and requests confirmation with a cookie specified. The responder will limit resources until the initiator responses with the correct cookie ID.

The anti-clogging cookies are optional Anti-DoS mechanism. They are exchanged in the first 2 messages in the IKE_SA_INIT exchange.

Configuration Components

The following IKEv2/IPSec configuration components are required for FlexVPN

Component	Description
IKEv2 Proposal	Mandatory Defines the encryption, integrity algorithm, DH group used for protection in the negotiation of the IKEv2 SA. Can specify multiple entries for each option Authentication method and SA l

Flexvpn