WEBVTT 1 00:00.000 --> 00:03.610 Hey welcome back in the previous video we took a look at many of the settings 2 00:03.610 --> 00:08.100 that we need to supply or at least plan on for IP sec for like phase one and 3 00:08.100 --> 00:08.940 like phase two. 4 00:08.940 --> 00:12.370 So I thought let's take a moment in this video and let's actually write those 5 00:12.370 --> 00:15.550 out what we're going to use and that way we go to implement it's not like a 6 00:15.550 --> 00:18.440 mystery or guessing game as far as what were we can use there again. 7 00:18.440 --> 00:22.960 We can plan it out here and then we can implement it based on our plan testing 8 00:22.960 --> 00:25.560 one two three testing one two three. 9 00:25.560 --> 00:29.250 And to say this little time I've just written out the elements that were in 10 00:29.250 --> 00:33.520 supply so for encryption this is for the Ike phase one tunnel for encryption. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.250 --> 00:33.520 supply so for encryption this is for the Ike phase one tunnel for encryption. 11 00:33.520 --> 00:39.460 Let's use a yes the advanced encryption standard and let's use two fifty six 12 00:39.460 --> 00:43.060 and if it comes to a point where these routers don't support that we may have 13 00:43.060 --> 00:46.650 to revisit but I think I'm fairly current IOS supports all these options that 14 00:46.650 --> 00:50.360 we're going to want to apply for the hashing for the ice phase one tunnel. 15 00:50.360 --> 00:55.130 Let's use Shaw and let's use this two fifty six flavor now for the hashing we 16 00:55.130 --> 00:56.360 don't have to use. 17 00:56.360 --> 00:59.800 Shaw to fifty six because we use the encryption of a yes to fifty six weekend 18 00:59.800 --> 01:02.850 you know that numbers just applicable to the hashing in this case or to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 18 00:59.800 --> 01:02.850 you know that numbers just applicable to the hashing in this case or to the 19 01:02.850 --> 01:04.160 encryption that case. 20 01:04.160 --> 01:09.590 So let's use Shaw to fifty six and for authentication let's use pre shared keys 21 01:09.590 --> 01:14.700 for a pre shared key let's use this Cisco exclamation mark two three on both 22 01:14.700 --> 01:19.320 sides and that way when our one initiates a tunnel for Ike phase one with our 23 01:19.320 --> 01:19.800 two. 24 01:19.800 --> 01:19.900 If they're both using the appropriate key and they're willing to use that key 25 01:19.900 --> 01:20.010 we should have a successful authentication for a phase one and if we do then 26 01:20.010 --> 01:29.200 they'll go ahead and proceed to do Diffy Helen. 27 01:29.200 --> 01:34.200 So for Diffy Helen let's use Diffy Helen group number five and for the lifetime WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:29.200 --> 01:34.200 So for Diffy Helen let's use Diffy Helen group number five and for the lifetime 28 01:34.200 --> 01:38.400 instead of using the number of seconds in a full day let's go ahead and make 29 01:38.400 --> 01:41.680 that shorter and we'll set that to five thousand. 30 01:41.680 --> 01:46.050 So let's use that on both sides and that's right phase one and for like phase 31 01:46.050 --> 01:50.150 two let's set up a plan there to all right so here we go for the Ike phase to 32 01:50.150 --> 01:55.070 the IP sec tunnel details for the ACL the crypto ACL it's referred to with the 33 01:55.070 --> 01:56.800 traditional IP six site tunnel. 34 01:56.800 --> 02:01.480 From our ones perspective is can be traffic from ten dot one zero going to ten WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 34 01:56.800 --> 02:01.480 From our ones perspective is can be traffic from ten dot one zero going to ten 35 02:01.480 --> 02:06.080 to zero and from our two's perspective traffic from ten to zero going to ten 36 02:06.080 --> 02:10.150 one zero to specify that in the access control list and then we'll include that 37 02:10.150 --> 02:12.800 in the crypto map that binds all of this together. 38 02:12.800 --> 02:17.950 I'll step you through all those details for the encryption let's go ahead and 39 02:17.950 --> 02:23.400 use AES 128 and for the hashing let's use Shaw and let's use 384. 40 02:23.400 --> 02:28.360 Now with hashing as far as the IP sec Ike phase to tunnel is literally using 41 02:28.360 --> 02:32.990 what's called an H Mac which stands for a hash message authentication code WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 41 02:28.360 --> 02:32.990 what's called an H Mac which stands for a hash message authentication code 42 02:32.990 --> 02:36.700 which is a hash of the data each packets going to get a hash but it also 43 02:36.700 --> 02:38.400 includes in the algorithm for that. 44 02:38.400 --> 02:41.590 Some of the secret king material that's only going to be known by our one and 45 02:41.590 --> 02:44.840 our two so that makes the hashing more secure it also verifies when somebody 46 02:44.840 --> 02:48.040 receives that one are to receive this as well the only person who could have 47 02:48.040 --> 02:49.800 created that hash on that packet. 48 02:49.800 --> 02:53.340 The only is it correct but the only person who the keys involved to do that 49 02:53.340 --> 02:56.960 would be my good buddy R1 so not only is it data integrity it's also helping to 50 02:56.960 --> 02:58.800 verify who sent that packet. 51 02:58.800 --> 03:03.250 So for the peers are to have the peer of fifteen one one one over here are one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 02:58.800 --> 03:03.250 So for the peers are to have the peer of fifteen one one one over here are one 52 03:03.250 --> 03:07.620 and our one is going to have the peer of twenty five two two two which is the 53 03:07.620 --> 03:12.130 reachable address here on our two so the peers will be each other based on 54 03:12.130 --> 03:13.800 their reachable global addresses. 55 03:13.800 --> 03:17.040 And then for the mode we are going to use tunnel if you don't specify a mode it 56 03:17.040 --> 03:20.200 will default to tunnel but just to make sure that we have the option. 57 03:20.200 --> 03:23.860 We want to specify what we want here and then for PFS if you don't want to use 58 03:23.860 --> 03:27.340 it you don't have to but if we do want to use PFS where it runs DIFI helmet 59 03:27.340 --> 03:28.000 again. 60 03:28.000 --> 03:32.170 We can choose our DIFI helmet group so appear we use five because this is the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 03:28.000 --> 03:32.170 We can choose our DIFI helmet group so appear we use five because this is the 61 03:32.170 --> 03:35.800 IP sec tunnel like phase two we don't have to use the same you know. 62 03:35.800 --> 03:39.480 DIFI helmet group we could use group fifteen for example as long as both 63 03:39.480 --> 03:43.350 routers support it so now we have our details regarding what we want to happen 64 03:43.350 --> 03:46.770 for like phase one like phase two the next step is to implement the 65 03:46.770 --> 03:51.240 configurations to make it happen so what we're going to do the next videos as 66 03:51.240 --> 03:53.800 they come up is in the very next video which I'll see you there in just a 67 03:53.800 --> 03:53.800 moment. 68 03:53.800 --> 03:57.920 We'll configure the Ike phase one policy on both routers we'll do some quick 69 03:57.920 --> 04:01.920 checks make sure we are all in place and then as we proceed in the next video WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 69 03:57.920 --> 04:01.920 checks make sure we are all in place and then as we proceed in the next video 70 04:01.920 --> 04:05.800 we'll layer on top of that the Ike phase two policy or the IP sec policy 71 04:05.800 --> 04:10.090 including the transform sets so you can see the configuration hot to make our 72 04:10.090 --> 04:14.400 plans that we just designed a reality on our routers for the IP sec site to 73 04:14.400 --> 04:14.800 site tunnel. 74 04:14.800 --> 04:18.840 So we'll continue this journey in the next video as we configure the Ike phase 75 04:18.840 --> 04:21.800 one policies so I'll see you there in just a moment. 76 04:21.800 --> 04:25.050 Meanwhile I hope this has been informative for you and I'd like to thank you 77 04:25.050 --> 04:25.800 for viewing. 78 04:25.800 --> 04:27.800 you