WEBVTT

1
00:00.000 --> 00:04.800
All right, so what we're going to do to demonstrate IP seconds to pull up the

2
00:04.800 --> 00:04.960
same

3
00:04.960 --> 00:09.640
topology, it should look a little familiar, we just ran through this with GRE,

4
00:09.640 --> 00:09.920
we set up

5
00:09.920 --> 00:13.900
a tunnel between routers three and four. So now we're going to do is get that

6
00:13.900 --> 00:14.520
tunnel back

7
00:14.520 --> 00:19.690
online, and then we want to secure it, because again, there's all these insec

8
00:19.690 --> 00:20.540
urities, not

9
00:20.540 --> 00:24.500
just from an encryption perspective where routers one and two can see all of

10
00:24.500 --> 00:25.200
the packets

11
00:25.200 --> 00:30.020
in plain text, but there's also the issue of do I really know I'm connecting to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:25.200 --> 00:30.020
in plain text, but there's also the issue of do I really know I'm connecting to

12
00:30.020 --> 00:30.400
router

13
00:30.400 --> 00:35.860
four if I'm router three and vice versa. And so let's go ahead and log in to

14
00:35.860 --> 00:37.040
our lab environment

15
00:37.040 --> 00:41.170
here and start to perform our configuration. Now we have to start by getting

16
00:41.170 --> 00:41.600
our three

17
00:41.600 --> 00:45.020
and R four connected again. And this is always good practice, it's not going to

18
00:45.020 --> 00:45.560
take us too

19
00:45.560 --> 00:49.330
long to get this tunnel up and running, we're going to create the tunnel

20
00:49.330 --> 00:50.280
interface, give

21
00:50.280 --> 00:57.830
it an IP address, this is dot 34.3. And this is last 24 from router three's

22
00:57.830 --> 00:59.360
perspective.

23
00:59.360 --> 01:06.160
The source is going to be 13.3. The destination is going to be 24.4. And then I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.360 --> 01:06.160
The source is going to be 13.3. The destination is going to be 24.4. And then I

24
01:06.160 --> 01:06.760
'm going to

25
01:06.760 --> 01:13.230
go ahead and enable EIGRP with a network statement to look for neighbors out

26
01:13.230 --> 01:16.080
this specific interface.

27
01:16.080 --> 01:19.860
So that's all we need to do for router three. Let's go ahead and do this same

28
01:19.860 --> 01:20.680
configuration

29
01:20.680 --> 01:25.600
on router four. And we're going to go through this pretty quickly. It's just

30
01:25.600 --> 01:26.440
getting the

31
01:26.440 --> 01:38.430
IP address on there. And then the tunnel source and destination we're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:26.440 --> 01:38.430
IP address on there. And then the tunnel source and destination we're going to

32
01:38.430 --> 01:38.680
flip. And then

33
01:38.680 --> 01:43.610
once again, we're going to get on to our EIGRP process and enter a network

34
01:43.610 --> 01:46.520
statement for

35
01:46.520 --> 01:52.160
10 dot zero dot 34, this time dot four. And we should see a GRP come up pretty

36
01:52.160 --> 01:53.000
much immediately.

37
01:53.000 --> 01:57.840
And there it is. So now if I try to ping from router five over to router six, I

38
01:57.840 --> 01:58.240
'm going

39
01:58.240 --> 02:03.170
to get on the router five, say ping six dot six dot six dot six dot six, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:58.240 --> 02:03.170
to get on the router five, say ping six dot six dot six dot six dot six, we

40
02:03.170 --> 02:03.760
might as well

41
02:03.760 --> 02:08.600
do source five dot five dot five dot five. And that shows that we can ping from

42
02:08.600 --> 02:09.280
this loop

43
02:09.280 --> 02:13.310
back interface here, paying off a router five to the loop back hanging off of

44
02:13.310 --> 02:14.360
router six.

45
02:14.360 --> 02:18.050
So this tunnel interface is working well. And we know that because routers one

46
02:18.050 --> 02:18.480
and two

47
02:18.480 --> 02:22.930
as we've demonstrated before, they can't ping these destination addresses. They

48
02:22.930 --> 02:23.240
have

49
02:23.240 --> 02:26.690
no idea where the destination is. They don't have to because they're only

50
02:26.690 --> 02:27.440
looking at the

51
02:27.440 --> 02:33.160
outer header. So now we need to secure this connection. So let's go ahead and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:27.440 --> 02:33.160
outer header. So now we need to secure this connection. So let's go ahead and

52
02:33.160 --> 02:33.400
start from

53
02:33.400 --> 02:37.490
scratch here with router three. And we're going to go ahead and do the same

54
02:37.490 --> 02:38.440
thing with router

55
02:38.440 --> 02:44.180
four. But let's get started here on router three. So remember the process we

56
02:44.180 --> 02:44.600
need to

57
02:44.600 --> 02:48.410
go through, we're going to start with IKEV one configuration, which is using

58
02:48.410 --> 02:49.480
crypto isocamp

59
02:49.480 --> 02:53.410
policy. And this is where we can assign that priority value or the lower

60
02:53.410 --> 02:54.480
priorities better.

61
02:54.480 --> 02:58.430
I'm just going to go ahead and say policy 10 here, head enter. And at this

62
02:58.430 --> 02:58.960
point, we're

63
02:58.960 --> 03:03.800
ready to perform our haggle. So I like that phrase. Either way, we're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:58.960 --> 03:03.800
ready to perform our haggle. So I like that phrase. Either way, we're going to

64
03:03.800 --> 03:04.400
say hash

65
03:04.400 --> 03:08.810
here, we can look at this again, MD five and SHA one, these are pretty well

66
03:08.810 --> 03:09.600
deprecated

67
03:09.600 --> 03:13.360
at this point, we should probably be looking at SHA 256 or greater. So we'll

68
03:13.360 --> 03:13.920
just go ahead

69
03:13.920 --> 03:20.770
and say, SHA 256. And then authentication options. We can see that we've got

70
03:20.770 --> 03:21.720
RSA options,

71
03:21.720 --> 03:24.950
but I'm just going to say pre share here, this is going to allow me to use a

72
03:24.950 --> 03:25.520
pre shared

73
03:25.520 --> 03:29.850
key, which we will have to define later. So we have to remember to go back and

74
03:29.850 --> 03:30.560
do that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:29.850 --> 03:30.560
do that.

75
03:30.560 --> 03:33.880
So we're just saying use a pre shared key for right now. Now we're going to

76
03:33.880 --> 03:34.280
specify

77
03:34.280 --> 03:37.900
the group. So I do group question mark, and we start to see the different DIFI

78
03:37.900 --> 03:38.400
home and

79
03:38.400 --> 03:42.310
groups that are available. This is where we've said that group 14 is the

80
03:42.310 --> 03:43.480
minimum recommended

81
03:43.480 --> 03:48.910
these days. But if I do advanced to 15 and 16, we're using larger bit keys here

82
03:48.910 --> 03:49.560
. So we

83
03:49.560 --> 03:53.390
don't want to go with one, two or five, those are not considered to be secure

84
03:53.390 --> 03:54.040
anymore. So

85
03:54.040 --> 03:59.790
I'm just going to go ahead and say group 16. And from here, we'll say lifetime,

86
03:59.790 --> 04:00.040
just kind
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:59.790 --> 04:00.040
just kind

87
04:00.040 --> 04:06.190
of going through our haggle letters here. So lifetime in seconds, 86,400. Yeah,

88
04:06.190 --> 04:06.760
that

89
04:06.760 --> 04:11.230
is 24 hours. That's how many seconds are in a day. And so we could specify that

90
04:11.230 --> 04:11.680
. In

91
04:11.680 --> 04:17.740
fact, we could also do something like, you know, 3600 to specify an hour. Now

92
04:17.740 --> 04:18.160
let's just

93
04:18.160 --> 04:23.390
go ahead and do that here lifetime 3600. And then encryption would be the last

94
04:23.390 --> 04:23.800
thing

95
04:23.800 --> 04:29.050
we have to specify. And this is where again, our phase one options don't, we're

96
04:29.050 --> 04:29.600
not given

97
04:29.600 --> 04:35.090
a whole lot here, just AES does and triple does now AES. I mean, if we do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:29.600 --> 04:35.090
a whole lot here, just AES does and triple does now AES. I mean, if we do

98
04:35.090 --> 04:36.200
question mark

99
04:36.200 --> 04:40.330
here, we see we do actually have additional options. It's not like we have to

100
04:40.330 --> 04:40.840
use the

101
04:40.840 --> 04:46.680
original AES. If we do hit enter here, we'll take the default of 128 bit keys,

102
04:46.680 --> 04:47.240
but AES

103
04:47.240 --> 04:52.330
192 and 256, these are considered to be very secure. So I'm going to go ahead

104
04:52.330 --> 04:53.080
and do AES

105
04:53.080 --> 04:58.260
256 here and exit out. Now we're not done because we said we have one more

106
04:58.260 --> 04:58.960
thing we

107
04:58.960 --> 05:02.820
have to remember to go back and do and that's configure the pre shared key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:58.960 --> 05:02.820
have to remember to go back and do and that's configure the pre shared key.

108
05:02.820 --> 05:03.640
This command

109
05:03.640 --> 05:07.160
starts with crypto as well. A lot of these commands do. And this is going to be

110
05:07.160 --> 05:07.600
crypto

111
05:07.600 --> 05:13.370
isocamp key. And then I specify the key name. So I'm just going to call this CB

112
05:13.370 --> 05:14.800
T key. And

113
05:14.800 --> 05:19.400
then I do have to specify the IP address or the host name of the device that

114
05:19.400 --> 05:19.960
this is

115
05:19.960 --> 05:26.600
going to map to. So I can specify address. And I can just say 0.0.0.0 here. And

116
05:26.600 --> 05:27.080
it would

117
05:27.080 --> 05:31.910
apply it to anyone that I want to communicate with. Or I can target the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
05:27.080 --> 05:31.910
apply it to anyone that I want to communicate with. Or I can target the

118
05:31.910 --> 05:33.120
specific IP address

119
05:33.120 --> 05:38.630
and keep in mind, this would be the physical underlay IP address, not the other

120
05:38.630 --> 05:39.240
side of

121
05:39.240 --> 05:44.080
the tunnel. So in my case, router four, that would be this gig to zero

122
05:44.080 --> 05:45.360
interface here,

123
05:45.360 --> 05:51.880
which is using 10.0.24.4. So I'm going to hit enter. So again, I said camp,

124
05:51.880 --> 05:52.480
when we see

125
05:52.480 --> 05:57.870
isocamp, we are thinking I could be one phase one. That is what isocamps, you

126
05:57.870 --> 05:59.320
know, in iOS

127
05:59.320 --> 06:03.300
X, see, that's what isocamp is referring to. So all of those configurations are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:59.320 --> 06:03.300
X, see, that's what isocamp is referring to. So all of those configurations are

128
06:03.300 --> 06:03.880
done.

129
06:03.880 --> 06:07.210
And that will help us to configure our phase one tunnel. We're now ready to

130
06:07.210 --> 06:07.800
configure

131
06:07.800 --> 06:12.810
our phase two tunnel. So we're going to use again, crypto, I'll start with

132
06:12.810 --> 06:13.800
crypto still.

133
06:13.800 --> 06:18.160
But now we're going to start specifying IP sec, because remember, when we talk

134
06:18.160 --> 06:18.560
about

135
06:18.560 --> 06:22.440
phase two tunnels, we're usually calling those IP sec tunnels. Those are just

136
06:22.440 --> 06:22.920
ways that we

137
06:22.920 --> 06:25.840
can kind of keep in mind what we're doing as we're configuring it, because

138
06:25.840 --> 06:26.560
otherwise it

139
06:26.560 --> 06:30.840
can configure or can feel like it's just a jumbled mess of configurations. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
06:26.560 --> 06:30.840
can configure or can feel like it's just a jumbled mess of configurations. And

140
06:30.840 --> 06:31.160
the last

141
06:31.160 --> 06:35.260
thing we want is just having a hard time keeping track of what commands do what

142
06:35.260 --> 06:35.920
. So isocamp

143
06:35.920 --> 06:40.690
phase one, IP sec would be phase two. So crypto IP sec. And I'm going to

144
06:40.690 --> 06:42.600
configure that transform

145
06:42.600 --> 06:47.060
set. I have to give it a name. I'm just going to call this lab underscore TS

146
06:47.060 --> 06:48.000
for transform

147
06:48.000 --> 06:53.350
set. And that was okay. And this is where I always want to hit enter and start

148
06:53.350 --> 06:53.600
to do

149
06:53.600 --> 06:58.030
my configurations. I mentioned this earlier, if we hit question mark here, this

150
06:58.030 --> 06:58.440
is going

151
06:58.440 --> 07:02.950
to start to show us what we have to do to configure the transform set. Remember
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
06:58.440 --> 07:02.950
to start to show us what we have to do to configure the transform set. Remember

152
07:02.950 --> 07:03.160
, the

153
07:03.160 --> 07:07.810
transform set is how I configure either my ESP or AH headers. And then I have

154
07:07.810 --> 07:08.480
to decide

155
07:08.480 --> 07:12.290
if what my authentication mechanism is going to be and what my encryption

156
07:12.290 --> 07:13.080
mechanism is

157
07:13.080 --> 07:19.080
going to be if I'm using ESP might expect for me again to hit enter here and

158
07:19.080 --> 07:20.400
just configure

159
07:20.400 --> 07:24.620
those options. But that's not how this works. I have to hit question mark and

160
07:24.620 --> 07:25.400
see that these

161
07:25.400 --> 07:30.800
are all the options that are listed. Furthermore, I have to identify two of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
07:25.400 --> 07:30.800
are all the options that are listed. Furthermore, I have to identify two of

162
07:30.800 --> 07:32.160
these if I'm using

163
07:32.160 --> 07:36.950
ESP one for authentication and one for encryption. So I can look at this and

164
07:36.950 --> 07:37.920
say, well, I could

165
07:37.920 --> 07:43.410
run AH. And if I want to run AH, maybe I'd want to run with MD five or SHA or

166
07:43.410 --> 07:44.680
SHA 256,

167
07:44.680 --> 07:49.440
384 512. We see all of those options. HMAC by the way is a reference to that

168
07:49.440 --> 07:51.520
message integrity,

169
07:51.520 --> 07:55.780
the making sure that none of the bits have been changed and swapped around. So

170
07:55.780 --> 07:56.280
this is

171
07:56.280 --> 08:01.940
my authentication mechanism. And this is my message integrity option. So we see
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
07:56.280 --> 08:01.940
my authentication mechanism. And this is my message integrity option. So we see

172
08:01.940 --> 08:02.200
it's

173
08:02.200 --> 08:06.760
the same option for all of these. So authentication header provides two levels

174
08:06.760 --> 08:07.640
of security, whereas

175
08:07.640 --> 08:12.660
ESP is meant to provide all three. So I'm going to go ahead and choose an ESP

176
08:12.660 --> 08:13.240
option.

177
08:13.240 --> 08:19.630
Let's go and start with our encryption. And we do see we have more options here

178
08:19.630 --> 08:20.400
. I can

179
08:20.400 --> 08:27.190
specify AES. Don't use triple desert or or does here. But we also have some

180
08:27.190 --> 08:28.320
additional

181
08:28.320 --> 08:34.750
options specifically GCM and GMAC. When we're talking about GCM Galois, that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
08:28.320 --> 08:34.750
options specifically GCM and GMAC. When we're talking about GCM Galois, that's

182
08:34.750 --> 08:36.440
just a different

183
08:36.440 --> 08:40.950
mechanism for encryption that we could consider. We can also still just go with

184
08:40.950 --> 08:41.760
AES. And we'll

185
08:41.760 --> 08:46.470
see also if I run a question mark here, I can still specify the amount of bits

186
08:46.470 --> 08:46.960
I want

187
08:46.960 --> 08:51.690
to use for AES. So let's go ahead and specify 256 and hit question mark again.

188
08:51.690 --> 08:52.240
And we see

189
08:52.240 --> 08:58.450
that we are not done. We still have to specify the mechanism that we want to

190
08:58.450 --> 08:59.440
use for our

191
08:59.440 --> 09:05.430
authentication. So I'm going to go ahead and choose, let's just do SHA 256,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

191
08:59.440 --> 09:05.430
authentication. So I'm going to go ahead and choose, let's just do SHA 256,

192
09:05.430 --> 09:05.640
which of

193
09:05.640 --> 09:10.550
course includes the message integrity check as well. And now finally, we see

194
09:10.550 --> 09:10.920
that we can

195
09:10.920 --> 09:15.310
be done. We don't need to specify any AH options, we can just hit enter. And we

196
09:15.310 --> 09:15.680
have

197
09:15.680 --> 09:20.420
now told this transform set, not only what header to use, but also what

198
09:20.420 --> 09:21.280
encryption type

199
09:21.280 --> 09:25.670
we want to use as well as what authentication type. So just a little bit odd in

200
09:25.670 --> 09:26.760
my opinion,

201
09:26.760 --> 09:30.610
how that configuration comes together. But it is important that we recognize
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
09:26.760 --> 09:30.610
how that configuration comes together. But it is important that we recognize

202
09:30.610 --> 09:31.160
that that

203
09:31.160 --> 09:35.030
is how it works. Now we run a question mark here, we'll see there's not a whole

204
09:35.030 --> 09:35.560
lot of

205
09:35.560 --> 09:40.110
options, but we do have this mode command and mode is what allows us to specify

206
09:40.110 --> 09:41.320
that transport

207
09:41.320 --> 09:45.410
versus tunnel. And I do like that it specifies here that transport is for

208
09:45.410 --> 09:46.840
payload encapsulation

209
09:46.840 --> 09:51.710
only, whereas tunnel is for the entire data gram. So I'm just going to say mode

210
09:51.710 --> 09:52.280
tunnel,

211
09:52.280 --> 09:57.490
make it more secure. And now I can exit out of the transform set. So remember

212
09:57.490 --> 09:58.400
what we said

213
09:58.400 --> 10:02.100
with that diagram, I don't just create a transform set and apply it to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

213
09:58.400 --> 10:02.100
with that diagram, I don't just create a transform set and apply it to the

214
10:02.100 --> 10:03.200
interface, I actually

215
10:03.200 --> 10:07.250
have to apply it to an IP sec profile. So I'm going to use that crypto IP sec

216
10:07.250 --> 10:08.280
command again,

217
10:08.280 --> 10:13.190
crypto IP sec, and then profile. And now I'll just give this a name like lab

218
10:13.190 --> 10:14.080
underscore

219
10:14.080 --> 10:19.890
PR. This time I do hit enter. And with my options in here primarily I'm going

220
10:19.890 --> 10:20.200
to be

221
10:20.200 --> 10:26.830
looking at this set here at the bottom. So I say set. And then I specify that I

222
10:26.830 --> 10:27.360
want

223
10:27.360 --> 10:32.600
to set my transform set of lab underscore TS. So that's all we're going to do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

223
10:27.360 --> 10:32.600
to set my transform set of lab underscore TS. So that's all we're going to do

224
10:32.600 --> 10:32.960
again, it's

225
10:32.960 --> 10:36.710
sort of a one to one relationship unless we need some of these additional

226
10:36.710 --> 10:37.440
options. But

227
10:37.440 --> 10:42.620
those are certainly going to go beyond the scope of a prime, you know, a common

228
10:42.620 --> 10:43.120
IP sec

229
10:43.120 --> 10:47.680
configuration. So lastly, we need to apply it to the tunnel interface. So

230
10:47.680 --> 10:48.640
interface tunnel

231
10:48.640 --> 10:52.410
zero. And now we need to do two things here, first of all specify that the

232
10:52.410 --> 10:53.040
tunnel mode

233
10:53.040 --> 10:58.940
is now running in IP sec for IP four. And we'll see that we can add this for IP

234
10:58.940 --> 10:59.960
four or IP

235
10:59.960 --> 11:04.880
B six, but I do have to specify. And then I can add the protection mechanism.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

235
10:59.960 --> 11:04.880
B six, but I do have to specify. And then I can add the protection mechanism.

236
11:04.880 --> 11:05.160
Now notice

237
11:05.160 --> 11:10.430
as soon as I applied IP sec to this tunnel, that the tunnel is saying, okay,

238
11:10.430 --> 11:11.320
well, I'm

239
11:11.320 --> 11:15.340
running IP sec, but the other side sure isn't, I need to establish an Ike phase

240
11:15.340 --> 11:16.000
one tunnel,

241
11:16.000 --> 11:21.310
I need to establish an Ike phase two tunnel in order to get this online until I

242
11:21.310 --> 11:21.880
do that

243
11:21.880 --> 11:26.620
this tunnel interface is down, which means I've lost my ERP connection. So

244
11:26.620 --> 11:27.440
something to

245
11:27.440 --> 11:31.390
keep in mind there. So ERP in a way is going to tell us whether this tunnel is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

245
11:27.440 --> 11:31.390
keep in mind there. So ERP in a way is going to tell us whether this tunnel is

246
11:31.390 --> 11:31.960
working

247
11:31.960 --> 11:35.370
because if it's running great, if it's not running, then that means the tunnel

248
11:35.370 --> 11:35.840
is still

249
11:35.840 --> 11:42.350
down. So tunnel mode IP sec, we also have to specify the protection. What are

250
11:42.350 --> 11:42.920
we doing

251
11:42.920 --> 11:48.770
here? Protection IP sec profile and then my lab profile. So the lab profile

252
11:48.770 --> 11:49.280
maps back

253
11:49.280 --> 11:54.040
to the transform set. The transform set gives me my phase two information

254
11:54.040 --> 11:55.400
specifically,

255
11:55.400 --> 12:02.110
the AES and SHA for encryption authentication, as well as the tunnel mode. All
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

255
11:55.400 --> 12:02.110
the AES and SHA for encryption authentication, as well as the tunnel mode. All

256
12:02.110 --> 12:02.920
right. So

257
12:02.920 --> 12:07.990
now we see isocamp is on. So that's good. And we have completed configuration

258
12:07.990 --> 12:08.440
on our

259
12:08.440 --> 12:11.860
three. So now we have to do it again on our four. And we could fast forward

260
12:11.860 --> 12:12.720
through this,

261
12:12.720 --> 12:15.250
but you know what, I think there's value in seeing it from start to finish

262
12:15.250 --> 12:15.800
without all

263
12:15.800 --> 12:19.670
of the question marks. Let's just go ahead and see what this configuration

264
12:19.670 --> 12:20.520
looks like.

265
12:20.520 --> 12:23.620
And we'll see it's not that bad when we go through straight through it. So

266
12:23.620 --> 12:24.120
again, all

267
12:24.120 --> 12:27.330
these commands are starting with crypto. We're going to start with isocamp

268
12:27.330 --> 12:28.320
because isocamp

269
12:28.320 --> 12:34.380
is our phase one tunnel. And again, I'm going to specify policy 10. And then I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

269
12:28.320 --> 12:34.380
is our phase one tunnel. And again, I'm going to specify policy 10. And then I

270
12:34.380 --> 12:34.840
specify my

271
12:34.840 --> 12:41.140
hash. So my hash could be SHA 256. And then I can specify my authentication as

272
12:41.140 --> 12:41.400
being

273
12:41.400 --> 12:48.170
pre shared key, which we still have to configure later. Group 16, lifetime 3600

274
12:48.170 --> 12:49.480
we've said.

275
12:49.480 --> 12:55.720
And then encryption. And then we'll say AES 256. And so that's it. That's not

276
12:55.720 --> 12:56.160
too bad.

277
12:56.160 --> 13:00.740
I do still have to again specify the pre shared key. So I'm going to use crypto
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

277
12:56.160 --> 13:00.740
I do still have to again specify the pre shared key. So I'm going to use crypto

278
13:00.740 --> 13:01.560
again. I see

279
13:01.560 --> 13:06.940
camp again, because it's still phase one tunnel. And then I specify my key was

280
13:06.940 --> 13:09.040
CBT key, I believe.

281
13:09.040 --> 13:12.320
And then the address is the what's on the other side. So this would be

282
13:12.320 --> 13:13.240
targeting router

283
13:13.240 --> 13:18.390
three. So that's it. That's it for phase one, not too bad. Phase two is going

284
13:18.390 --> 13:19.200
to involve

285
13:19.200 --> 13:25.840
crypto. But now instead of isocamp, it's IP sec. And then the transform set.

286
13:25.840 --> 13:26.080
And I name

287
13:26.080 --> 13:30.670
it. And then when I do a question mark, this is where I can get my options. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

287
13:26.080 --> 13:30.670
it. And then when I do a question mark, this is where I can get my options. So

288
13:30.670 --> 13:31.120
I'm going

289
13:31.120 --> 13:39.100
to specify ESP AES 256. I believe that's what we did, right 256. Yeah. And then

290
13:39.100 --> 13:39.400
we're

291
13:39.400 --> 13:49.080
going to also specify ESP dash. And we'll do SHA 256 dash, a Mac, H Mac. And

292
13:49.080 --> 13:50.160
then tunnel

293
13:50.160 --> 13:55.360
mode, not tunnel mode. That would be on the interface. Here we're just going to

294
13:55.360 --> 13:55.960
specify

295
13:55.960 --> 14:01.670
mode tunnels backwards. All right, so we got the transform set. No problem. Now
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

295
13:55.960 --> 14:01.670
mode tunnels backwards. All right, so we got the transform set. No problem. Now

296
14:01.670 --> 14:02.200
we're going

297
14:02.200 --> 14:11.400
to do crypto IP sec profile, give it a name lab PR. And now I set the transform

298
14:11.400 --> 14:12.480
set lab

299
14:12.480 --> 14:19.170
TS. And lastly, we get onto the tunnel interface. And we do those two important

300
14:19.170 --> 14:20.320
commands, tunnel

301
14:20.320 --> 14:30.870
mode, IP sec, IP for IP V four, and then tunnel protection, IP sec profile. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

301
14:20.320 --> 14:30.870
mode, IP sec, IP for IP V four, and then tunnel protection, IP sec profile. And

302
14:30.870 --> 14:32.560
then lab PR.

303
14:32.560 --> 14:38.970
All right, so it's on. Hopefully we see EIGRP come back up or come online. We

304
14:38.970 --> 14:39.840
're going

305
14:39.840 --> 14:43.320
to double check real quick for Oh, yep, there it is. It's already up. All right

306
14:43.320 --> 14:43.720
, good. I

307
14:43.720 --> 14:49.400
couldn't remember for sure if I set 256 here. It looks like we did. Okay, good.

308
14:49.400 --> 14:49.920
All right.

309
14:49.920 --> 14:56.590
So yeah, JRP is online. I look at our five, and we can ping across to our six

310
14:56.590 --> 14:58.000
once again.

311
14:58.000 --> 15:03.520
So that is how we do it. We do have some verification commands that we can run.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

311
14:58.000 --> 15:03.520
So that is how we do it. We do have some verification commands that we can run.

312
15:03.520 --> 15:05.080
We can do show crypto,

313
15:05.080 --> 15:09.570
for example, there's a lot of show crypto commands, isocamp would be a good way

314
15:09.570 --> 15:10.400
to validate

315
15:10.400 --> 15:14.830
Ike configuration. So I can do isocamp policy and see all of the settings that

316
15:14.830 --> 15:16.520
we just set.

317
15:16.520 --> 15:23.520
I can do also do show crypto IP sec, SA as a stands for security association.

318
15:23.520 --> 15:24.160
So I can

319
15:24.160 --> 15:28.170
see a lot of information about this tunnel communication that's happening here

320
15:28.170 --> 15:28.720
and start

321
15:28.720 --> 15:34.010
to digest that. And so other than that, yeah, we've got a tunnel running, we've
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

321
15:28.720 --> 15:34.010
to digest that. And so other than that, yeah, we've got a tunnel running, we've

322
15:34.010 --> 15:34.880
got our routing

323
15:34.880 --> 15:40.150
protocol running inside of the tunnel. And it is now secured using all of the

324
15:40.150 --> 15:41.080
principles

325
15:41.080 --> 15:42.680
we've talked about with IP sec.