{"id":167,"date":"2015-06-22T15:16:36","date_gmt":"2015-06-22T15:16:36","guid":{"rendered":"http:\/\/www.balajibandi.com\/blog\/?p=167"},"modified":"2017-02-05T17:55:45","modified_gmt":"2017-02-05T17:55:45","slug":"cisco-asa-setting-up-anyconnect-vpn-with-ssl-and-ipsec","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=167","title":{"rendered":"Cisco ASA: Setting up anyconnect vpn with SSL and IPsec"},"content":{"rendered":"

http:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/flexvpn\/115941-flexvpn-ikev2-config-00.html<\/p>\n

https:\/\/supportforums.cisco.com\/document\/98366\/flexvpn-ikev2-windows-7-builtin-client-ios-headend-part-i-certificate-authentication<\/p>\n

Introduction<\/span><\/b>
\nThis post demonstrates how to set up anyconnect vpn for your mobile devices. In this post I am using an android mobile phone and downloaded anyconnect ICS+. Cisco ASA software version 9.1(4), ASDM version 7.1, with anyconnect essential license and anyconnect for mobile license.<\/p>\n

This demonstration will configure IPsec and SSL remote access VPN, using AAA and Certificate authentication respectively.<\/p>\n

User\u2019s data to internal network will be tunnelled in VPN, other traffic will be through the internet.<\/p>\n

\"ANYCONNECT1\"<\/a><\/p>\n

Services to be enabled for anyconnect vpn<\/span><\/b>
\n1. Enable anyconnect on the outside interface of the Cisco ASA.
\n2. Enable crypto ikev2 for IKEv2 phase 1 on the outside interface. (crypto ikev2 enable outside client-services port 443<\/code>)
\n3. Enable crypto map for IKEv2 phase 2 on the outside interface. (crypto map RA_VPN_MAP interface outside<\/code>)
\n4. Enable trustpoint of the identity certificate on the outside interface.<\/p>\n

Create anyconnect profile<\/span><\/b>
\nAnyconnect profile is in xml format, you can create a simple one using notepad. However you can create a complete on using ASDM anyconnect profile editor. For my case I used ASDM anyconnect profile editor.<\/p>\n

\"ASDM<\/a><\/p>\n

You can start your anyconnect profile by listing the available server list you intend to create, after which you can click on apply the command anyconnect profiles YOUR_PROFILE disk0:\/YOUR_PROFILE.xml<\/code> will be added for you in the webvpn section.<\/p>\n

Enable anyconnect on the outside interface<\/span><\/b><\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n<\/td>\n
\n
\n
conf t<\/code><\/div>\n
webvpn<\/code><\/div>\n
\u00a0<\/code>enable outside<\/code><\/div>\n
\u00a0<\/code>anyconnect-essentials<\/code><\/div>\n
\u00a0<\/code>anyconnect image disk0:\/anyconnect-linux-3.1.05187-k9.pkg 1<\/code><\/div>\n
\u00a0<\/code>anyconnect image disk0:\/anyconnect-win-3.1.05187-k9.pkg 2<\/code><\/div>\n
\u00a0<\/code>anyconnect image disk0:\/anyconnect-macosx-i386-3.1.05187-k9.pkg 3<\/code><\/div>\n
\u00a0<\/code>anyconnect profiles RA_VPN disk0:\/ra_vpn.xml<\/code><\/div>\n
\u00a0<\/code>anyconnect enable<\/code><\/div>\n
\u00a0<\/code>tunnel-group-list enable<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Those commands that are required are highlighted. You do not need the anyconnect image to be installed in Cisco ASA for your mobile device to connect to VPN using anyconnect ICS+.<\/p>\n

Create IKEv2 phase 1 proposal<\/span><\/b>
\nIKEv2 phase 1 requires negotiation between server and client to setup phase 1 encrypted channel, the below are proposed encryption, integrity and DF group. Phase 1 is for authentication between peers.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n<\/td>\n
\n
\n
crypto ikev2 policy 1<\/code><\/div>\n
\u00a0<\/code>encryption aes-256 aes-192 aes<\/code><\/div>\n
\u00a0<\/code>integrity sha256 sha md5<\/code><\/div>\n
\u00a0<\/code>group 5 2<\/code><\/div>\n
\u00a0<\/code>prf sha<\/code><\/div>\n
\u00a0<\/code>lifetime seconds 86400<\/code><\/div>\n
crypto ikev2 policy 65000<\/code><\/div>\n
\u00a0<\/code>encryption aes-256 aes-192 aes 3des des<\/code><\/div>\n
\u00a0<\/code>integrity sha512 sha384 sha256 sha md5<\/code><\/div>\n
\u00a0<\/code>group 2<\/code><\/div>\n
\u00a0<\/code>prf sha<\/code><\/div>\n
\u00a0<\/code>lifetime seconds 86400<\/code><\/div>\n
crypto ikev2 policy 65001<\/code><\/div>\n
\u00a0<\/code>encryption aes 3des des<\/code><\/div>\n
\u00a0<\/code>integrity sha md5<\/code><\/div>\n
\u00a0<\/code>group 5 2 1<\/code><\/div>\n
\u00a0<\/code>prf sha<\/code><\/div>\n
\u00a0<\/code>lifetime seconds 86400<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Enable crypto ikev2 on the outside interface<\/span><\/b>
\nThis is required so that inbound initiator can initiate phase 1 with Cisco ASA.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n<\/td>\n
\n
\n
crypto ikev2 enable outside client-services port 443<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Enable CA trustpoint<\/span><\/b>
\nFor this setup I have made Cisco ASA to be a local certificate authority and issued itself a self-signed identity certificate as well as certificate for authentication. The trustpoint has to be pointed to the identity certs.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
!RA_VPN_TP is the name of my CA trustpoint<\/code><\/div>\n
crypto ikev2 remote-access trustpoint RA_VPN_TP<\/code><\/div>\n
ssl trust-point RA_VPN_TP outside<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Proposal for IKEv2 phase 2<\/span><\/b>
\nPhase 2 is negotiated and setup under phase 1. The below is a list of proposal for phase 2 negotiation with inbound peers.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n<\/td>\n
\n
\n
crypto ipsec ikev2 ipsec-proposal AES<\/code><\/div>\n
\u00a0<\/code>protocol esp encryption aes-256 aes-192 aes<\/code><\/div>\n
\u00a0<\/code>protocol esp integrity sha-1 md5<\/code><\/div>\n
crypto ipsec ikev2 ipsec-proposal 3DES<\/code><\/div>\n
\u00a0<\/code>protocol esp encryption 3des des<\/code><\/div>\n
\u00a0<\/code>protocol esp integrity sha-1 md5<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Create crypto dynamic-map<\/span><\/b>
\nThe cypto dynamic-map is to attach the phase 2 proposal, this dynamic map is in turn attached to the crypto map and the crypto map is enabled on outside interface.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n<\/td>\n
\n
\n
!Attach phase 2 proposal to the dynamic map.<\/code><\/div>\n
!RA_VPN is the name of the dynamic map.<\/code><\/div>\n
crypto dynamic-map RA_VPN 1 set ikev2 ipsec-proposal AES 3DES<\/code><\/div>\n
<\/div>\n
!Whenever a vpn peer has successfully connected, <\/code><\/div>\n
!a static route to the connected peer is injected <\/code><\/div>\n
!as long as the peer stays connected.<\/code><\/div>\n
crypto dynamic-map RA_VPN 1 set reverse-route<\/code><\/div>\n
<\/div>\n
!Attach the dynamic map onto crypto map<\/code><\/div>\n
crypto map RA_VPN_MAP 1 ipsec-isakmp dynamic RA_VPN<\/code><\/div>\n
<\/div>\n
!Enable crypto map on the outside interface.<\/code><\/div>\n
crypto map RA_VPN_MAP interface outside<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

IP address pool for VPN users<\/span><\/b><\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n<\/td>\n
\n
\n
ip local pool RA_VPN 192.168.10.33-192.168.10.62 mask 255.255.255.224<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Split tunnel ACL<\/span><\/b>
\nIn group policy the default split tunnel policy is to tunnel all traffic to the vpn, however I can choose to exclude traffic to the vpn or specified the traffic I want to be sent through vpn, the interesting traffic is defined in ACL.<\/p>\n

In this setup if VPN user is sending data destined to the subnet or host specified in the split tunnel, the data will be sent through VPN, otherwise will be sent through public internet.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n<\/td>\n
\n
\n
access-list SPLIT_TUNNEL standard permit 192.168.20.0 255.255.255.224<\/code><\/div>\n
access-list SPLIT_TUNNEL standard permit 192.168.30.0 255.255.255.240<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Group policy<\/span><\/b>
\nCisco ASA has a system generated default group policy, if no group policy is specified in your tunnel-group the default will be used. The default group policy however does not include ikev2, anyconnect requires ikev2. For this setup I have created my custom group-policy for both ipsec as well as ssl vpn.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
!Cisco ASA default group policy. This policy only defines protocol used.<\/code><\/div>\n
group-policy DfltGrpPolicy attributes<\/code><\/div>\n
\u00a0<\/code>vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

the group policy for SSL VPN.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n<\/td>\n
\n
\n
group-policy RA_POLICY internal<\/code><\/div>\n
group-policy RA_POLICY attributes<\/code><\/div>\n
\u00a0<\/code>wins-server none<\/code><\/div>\n
\u00a0<\/code>dns-server value 192.168.30.2<\/code><\/div>\n
\u00a0<\/code>!protocol required for ssl vpn<\/code><\/div>\n
\u00a0<\/code>vpn-tunnel-protocol ssl-client ssl-clientless<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Traffic destined to the network specified in the ACL will be through VPN.<\/code><\/div>\n
\u00a0<\/code>split-tunnel-policy tunnelspecified<\/code><\/div>\n
\u00a0<\/code>split-tunnel-network-list value SPLIT_TUNNEL<\/code><\/div>\n
\u00a0<\/code>default-domain none<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!VPN IP address pool<\/code><\/div>\n
\u00a0<\/code>address-pools value RA_VPN<\/code><\/div>\n
\u00a0<\/code>webvpn<\/code><\/div>\n
\u00a0\u00a0<\/code>!Anyconnect profile created by ASDM anyconnect profile editor.<\/code><\/div>\n
\u00a0\u00a0<\/code>anyconnect profiles value RA_VPN type user<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

The group policy for IPsec VPN.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n<\/td>\n
\n
\n
group-policy RA_IPSEC_POLICY internal<\/code><\/div>\n
group-policy RA_IPSEC_POLICY attributes<\/code><\/div>\n
\u00a0<\/code>dns-server value 192.168.30.2<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!anyconnect ipsec only requires ikev2, you do not need to follow this.<\/code><\/div>\n
\u00a0<\/code>vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Data destined to the address in ACL will be sent via VPN.<\/code><\/div>\n
\u00a0<\/code>split-tunnel-policy tunnelspecified<\/code><\/div>\n
\u00a0<\/code>split-tunnel-network-list value SPLIT_TUNNEL<\/code><\/div>\n
\u00a0<\/code>default-domain value yourdomain.net<\/code><\/div>\n
\u00a0<\/code>!VPN IP address pool<\/code><\/div>\n
\u00a0<\/code>address-pools value RA_VPN<\/code><\/div>\n
\u00a0<\/code>webvpn<\/code><\/div>\n
\u00a0\u00a0<\/code>anyconnect profiles value RA_VPN type user<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Configure AD as authentication server<\/span><\/b>
\nIn this setup AD is used as the authentication server for IPsec VPN.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n<\/td>\n
\n
\n
!Define the aaa-server protocol first, in this setup is ldap.<\/code><\/div>\n
aaa-server LDAP protocol ldap<\/code><\/div>\n
<\/div>\n
!Define the ip address of AD.<\/code><\/div>\n
aaa-server LDAP (inside) host 192.168.30.2<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Define the domain name, in this setup the AD domain is testlab.local.<\/code><\/div>\n
\u00a0<\/code>ldap-base-dn dc=testlab,dc=local<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Active directory listing will be the entire forest.<\/code><\/div>\n
\u00a0<\/code>ldap-scope subtree<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!sAMAccountName is the default attribute for Microsoft Active Directory.<\/code><\/div>\n
\u00a0<\/code>ldap-naming-attribute sAMAccountName<\/code><\/div>\n
\u00a0<\/code>ldap-login-password *****<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Define the AD user account, in this setup I used the administrator user.<\/code><\/div>\n
\u00a0<\/code>!If you are unsure the attribute of your user, in your MS AD server issue <\/code><\/div>\n
\u00a0<\/code>!this command: dsquery user -samid Administrator<\/code><\/div>\n
\u00a0<\/code>ldap-login-dn CN=Administrator,CN=Users,DC=testlab,DC=local<\/code><\/div>\n
\u00a0<\/code>server-type microsoft<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Tunnel group<\/span><\/b>
\nThe group policy will be attached to the tunnel group, if no group policy is defined, the default group policy will be used.<\/p>\n

Tunnel group for ssl vpn.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n<\/td>\n
\n
\n
tunnel-group RA_VPN_TUN type remote-access<\/code><\/div>\n
tunnel-group RA_VPN_TUN general-attributes<\/code><\/div>\n
\u00a0<\/code>address-pool RA_VPN<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!Define the group policy, if none is defined the default group policy is used.<\/code><\/div>\n
\u00a0<\/code>default-group-policy RA_POLICY<\/code><\/div>\n
tunnel-group RA_VPN_TUN webvpn-attributes<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!Use certificate to authenticate, in ASDM this certificate is installed in CA Certificate.<\/code><\/div>\n
\u00a0<\/code>authentication certificate<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!VPN server address, and the user group, in this setup RA1 is the user group.<\/code><\/div>\n
\u00a0<\/code>group-url https:\/\/domain.yourdomain.net\/RA1<\/a> enable<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Tunnel group for ipsec vpn.<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n<\/td>\n
\n
\n
tunnel-group RA_IPSEC type remote-access<\/code><\/div>\n
tunnel-group RA_IPSEC general-attributes<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!VPN ip address pool<\/code><\/div>\n
\u00a0<\/code>address-pool RA_VPN<\/code><\/div>\n
\u00a0<\/code><\/div>\n
\u00a0<\/code>!AD is the authentication server in this setup.<\/code><\/div>\n
\u00a0<\/code>authentication-server-group LDAP<\/code><\/div>\n
\u00a0<\/code>default-group-policy RA_IPSEC_POLICY<\/code><\/div>\n
tunnel-group RA_IPSEC webvpn-attributes<\/code><\/div>\n
\u00a0<\/code>!If authentication method is not defined, authentication aaa is used, <\/code><\/div>\n
\u00a0<\/code>!show run will not show &amp;quot;authentication aaa&amp;quot;<\/code><\/div>\n
\u00a0<\/code>authentication aaa<\/code><\/div>\n
<\/div>\n
\u00a0<\/code>!group-alias that will appear on anyconnect client after connected.<\/code><\/div>\n
\u00a0<\/code>group-alias RA_IPSEC enable<\/code><\/div>\n
\u00a0<\/code>group-url https:\/\/domain.yourdomain.net<\/a> enable<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Result<\/span><\/b>
\nThis is the result after you have enable group-alias in tunnel-group
\n\"Screenshot_2014-11-18-20-52-02[1]\"<\/a><\/p>\n

The anyconnect client downloads the anyconnect profile and update the server list in the client. If your anyconnect client could not see the updated server list, check your anyconnect profile or check if the group-policy has assigned a correct anyconnect profile or not.
\n\"server-list\"<\/a><\/p>\n

IPsec<\/b>
\nTunneling Mode shows split include means traffic destined for subnet in ACL will be sent through VPN.
\n\"ipsec1\"<\/a><\/p>\n

Protocol and cipher used for the IPsec VPN. Secured routes show the subnet defined in the split tunnel ACL.
\n\"ipsec2\"<\/a><\/p>\n

SSL vpn<\/b>
\nAlthough it is known as SSL vpn, the protocol supported is TLSv1.
\n\"ssl1\"<\/a><\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

http:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/flexvpn\/115941-flexvpn-ikev2-config-00.html https:\/\/supportforums.cisco.com\/document\/98366\/flexvpn-ikev2-windows-7-builtin-client-ios-headend-part-i-certificate-authentication Introduction This post demonstrates how to set up anyconnect vpn for your mobile devices. In this post I am using an android mobile phone and downloaded anyconnect ICS+. Cisco ASA software version 9.1(4), ASDM version 7.1, with anyconnect essential license and anyconnect for mobile license. This demonstration will configure IPsec and SSL remote […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,2],"tags":[],"class_list":["post-167","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=167"}],"version-history":[{"count":3,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions"}],"predecessor-version":[{"id":170,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/167\/revisions\/170"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}