WEBVTT

1
00:00.000 --> 00:03.360
In the previous video, we took a look at a plant regarding what we want to go

2
00:03.360 --> 00:04.560
in the IKE Phase 1

3
00:04.560 --> 00:08.480
policy. And now it's our opportunity to actually implement it. So they walk you

4
00:08.480 --> 00:09.680
through the syntax

5
00:09.680 --> 00:14.210
and the methods that we'd use on a Cisco router to implement our IKE Phase 1

6
00:14.210 --> 00:14.960
policy.

7
00:14.960 --> 00:18.970
So as a quick sanity check and reminder for me, here are the details that we

8
00:18.970 --> 00:19.840
want to implement

9
00:19.840 --> 00:24.480
for IKE Phase 1 from our previous video. So with those in mind, let's go to the

10
00:24.480 --> 00:24.880
command line

11
00:24.880 --> 00:28.410
interface right here on R1 and let's get to work. So before we start config

12
00:28.410 --> 00:29.200
uring, let's just

13
00:29.200 --> 00:32.670
verify real quick that we're on the right router with the show IP interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.200 --> 00:32.670
verify real quick that we're on the right router with the show IP interface

14
00:32.670 --> 00:33.040
brief

15
00:33.040 --> 00:41.120
just to confirm. So gig 0/1 is 15111 and gig 0/3 is 10101. Let's compare that

16
00:41.120 --> 00:41.520
against our

17
00:41.520 --> 00:49.120
topology. So R1, 0101 is 15111, good, good, good and R1, 0/3 is on the 101010

18
00:49.120 --> 00:49.760
network

19
00:49.760 --> 00:52.640
ending in dot 1 as well. All right, looks like we're on the right device.

20
00:54.320 --> 00:59.350
And just for grins, let's also before we start, this is so important for IPsec.

21
00:59.350 --> 01:00.000
Before we start,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.350 --> 01:00.000
Before we start,

22
01:00.000 --> 01:03.400
let's just verify that we have connectivity over to our peers. So from our 1's

23
01:03.400 --> 01:04.080
perspective,

24
01:04.080 --> 01:08.480
we should be able to ping R2. And also before we implement the IPsec on top of

25
01:08.480 --> 01:09.200
all this,

26
01:09.200 --> 01:14.610
PC1 should be able to ping or reach PC2. So let's do a quick couple of

27
01:14.610 --> 01:15.520
verification checks

28
01:15.520 --> 01:23.530
before we start implementing IPsec. So here at R1, we'll do a ping of 25.2.2.2.

29
01:23.530 --> 01:24.720
That looks good.

30
01:24.720 --> 01:31.040
And let's also go to this client, PC1, and verify that PC1 can reach PC2 at 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:24.720 --> 01:31.040
And let's also go to this client, PC1, and verify that PC1 can reach PC2 at 10.

31
01:31.040 --> 01:33.120
2.0.50. Now in my lab

32
01:33.120 --> 01:37.100
environment, everything is reachable and a public internet, of course, if we

33
01:37.100 --> 01:39.120
had private IP addresses

34
01:39.120 --> 01:43.500
from RFC 1918 space here, the internet would not forward them. But in my lab

35
01:43.500 --> 01:44.320
environment,

36
01:44.320 --> 01:48.800
I just want to make sure everything is reachable and routable before we overlay

37
01:48.800 --> 01:49.520
on top of it the

38
01:49.520 --> 01:54.450
IPsec site site VPN. So this is PC1. Let's just verify its IP address with IP

39
01:54.450 --> 01:55.440
ADDR. It's a Linux

40
01:55.440 --> 02:00.950
box. And for its ethernet zero interface, its IP address is 10.1.0.50.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:55.440 --> 02:00.950
box. And for its ethernet zero interface, its IP address is 10.1.0.50.

41
02:00.950 --> 02:02.880
Fantastic. If we do a

42
02:02.880 --> 02:06.590
route and press center, if we spelled route correctly and press enter, it's got

43
02:06.590 --> 02:07.120
a default

44
02:07.120 --> 02:15.830
gateway of 10.1.0.1. And let's do a trace route over to 10.2.0.50. And just

45
02:15.830 --> 02:18.000
verify we have a full path.

46
02:18.000 --> 02:23.280
And look at that. We didn't get this. So we may have had some ARPs in the path

47
02:23.280 --> 02:24.080
that needed to

48
02:24.080 --> 02:29.960
get resolved. So this is going from this PC to its default gateway 10.1.01 with

49
02:29.960 --> 02:30.320
the next
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:29.960 --> 02:30.320
the next

50
02:30.320 --> 02:34.800
top of 15.115, which is my cloud router in the cloud there. And then the next

51
02:34.800 --> 02:36.080
top is R2. It is

52
02:36.080 --> 02:41.140
outside address 25222. And then it got forwarded to the final destination 10.2.

53
02:41.140 --> 02:42.320
0.50. Great. I just

54
02:42.320 --> 02:47.010
wanted to verify before we start that we have connectivity, because if routing

55
02:47.010 --> 02:47.920
isn't working,

56
02:47.920 --> 02:51.490
if we don't have reachability or the desired a forward traffic, the IPsec

57
02:51.490 --> 02:52.240
tunnel is not going

58
02:52.240 --> 02:57.280
to be too useful. So back at the CLI, let's go ahead and create our policies.

59
02:57.280 --> 02:58.080
Now before we start

60
02:58.080 --> 03:04.800
to, we need to show run type section crypto and press enter. And we can just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:58.080 --> 03:04.800
to, we need to show run type section crypto and press enter. And we can just

61
03:04.800 --> 03:05.760
verify that we don't

62
03:05.760 --> 03:10.080
have any crypto configs currently in our running config. But if we do a show

63
03:10.080 --> 03:10.720
crypto

64
03:10.720 --> 03:15.190
ICANN policy, check this out. So show crypto ICANN policy, we've got all these

65
03:15.190 --> 03:16.560
default policies

66
03:16.560 --> 03:20.700
that are built into this flavor of iOS. So if we wanted to just say, well, I

67
03:20.700 --> 03:21.440
hope one works,

68
03:21.440 --> 03:26.320
unfortunately, the lower the policy number, the more preferred it is. So if we

69
03:26.320 --> 03:26.880
just use these

70
03:26.880 --> 03:31.460
defaults, router one or router two, if they both chose this policy based on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:26.880 --> 03:31.460
defaults, router one or router two, if they both chose this policy based on the

71
03:31.460 --> 03:32.560
elements matching,

72
03:32.560 --> 03:36.880
it would be trying to use for the authentication method RSA, which we don't

73
03:36.880 --> 03:37.520
have a search

74
03:37.520 --> 03:41.680
training set up like that. So it failed based on failed authentication. So the

75
03:41.680 --> 03:42.640
actual priority

76
03:42.640 --> 03:46.460
number doesn't have to match between devices, but the core ingredients inside

77
03:46.460 --> 03:47.120
that policy,

78
03:47.120 --> 03:50.080
such as what encryption should we use, what authentication methods should we

79
03:50.080 --> 03:50.560
use, what

80
03:50.560 --> 03:54.480
if you help them should we use those do need match. Now there is some, some

81
03:54.480 --> 03:56.240
little fudge areas

82
03:56.240 --> 04:00.090
regarding the lifetime. So two devices for iK phase one have a slightly
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:56.240 --> 04:00.090
regarding the lifetime. So two devices for iK phase one have a slightly

83
04:00.090 --> 04:01.520
different lifetime.

84
04:01.520 --> 04:04.980
They will choose the one with the lower lower lifetime. As far as Diffie, Hell

85
04:04.980 --> 04:05.360
man, and the other

86
04:05.360 --> 04:09.320
properties, they do need to match if we want the iK phase one tunnel to proceed

87
04:09.320 --> 04:10.080
. So what we're

88
04:10.080 --> 04:12.440
going to do is we're not going to use one of the defaults we'll create our own.

89
04:12.440 --> 04:13.040
So we'll go into

90
04:13.040 --> 04:18.270
configuration mode and type in crypto, if I can spell correctly, crypto, ICANN

91
04:18.270 --> 04:18.800
policy,

92
04:18.800 --> 04:24.440
and then we'll specify a number. Now the reason this is important is because as

93
04:24.440 --> 04:25.200
two neighbors,

94
04:25.200 --> 04:29.250
two peers are negotiating, and they send their policies over like, Hey, here's

95
04:29.250 --> 04:29.840
all the policies

96
04:29.840 --> 04:32.380
I can support. And the other one will say here's all the policy that I support
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:29.840 --> 04:32.380
I can support. And the other one will say here's all the policy that I support

97
04:32.380 --> 04:33.440
and match them.

98
04:33.440 --> 04:38.560
The lower number policies will be seen first or preferred first. And that's why

99
04:38.560 --> 04:39.200
the policy

100
04:39.200 --> 04:42.740
order or the policy number matches. So if you want to create five or six new

101
04:42.740 --> 04:43.280
policies,

102
04:43.280 --> 04:46.640
and you want certain ones to be chosen first, if there's a match, you'd want to

103
04:46.640 --> 04:47.520
give those iK

104
04:47.520 --> 04:51.310
phase one policies lower numbers. So in this case, it's not going to matter too

105
04:51.310 --> 04:52.160
much. So let's go

106
04:52.160 --> 04:56.960
ahead and use a policy number five that'll work. All right. So now it puts this

107
04:56.960 --> 04:58.000
into configuration

108
04:58.000 --> 05:02.560
mode for this crypto ICANN policy. So we're going to specify our details. So if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:58.000 --> 05:02.560
mode for this crypto ICANN policy. So we're going to specify our details. So if

109
05:02.560 --> 05:03.840
we do a question mark,

110
05:03.840 --> 05:07.600
we can just go down the list. So for authentication, if we decided on using pre

111
05:07.600 --> 05:08.480
shared keys, we'd

112
05:08.480 --> 05:11.880
simply specify that's what we want to do for authentication. The other options

113
05:11.880 --> 05:12.400
involve RSA,

114
05:12.400 --> 05:15.810
and I don't have any keys set up currently for RSA. So we're going to use pre

115
05:15.810 --> 05:16.400
shared keys,

116
05:16.400 --> 05:19.620
and then we'll manually configure the pre shared key. So we've got

117
05:19.620 --> 05:21.200
authentication configured for

118
05:21.200 --> 05:25.500
the iK phase one policy. Next, let's set up the hashing that we want to use.

119
05:25.500 --> 05:26.160
And so for hashing,

120
05:26.160 --> 05:30.040
our plan was Shaw, and then if you take a look at our options here, I think we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
05:26.160 --> 05:30.040
our plan was Shaw, and then if you take a look at our options here, I think we

121
05:30.040 --> 05:31.120
planned on 256,

122
05:31.120 --> 05:35.150
looking at my notes. Yep. So we specify the hashing algorithm for the psych

123
05:35.150 --> 05:36.560
phase one policy. So if we

124
05:36.560 --> 05:43.350
do a do show crypto, I secamp policy, and press center, it's going to show us

125
05:43.350 --> 05:44.480
what we have now.

126
05:44.480 --> 05:48.860
What we didn't supply, it will be taking the defaults and using those. So we

127
05:48.860 --> 05:49.440
didn't specify

128
05:49.440 --> 05:53.690
yet encryption, it would use does, which we need to fix that. So for encryption

129
05:53.690 --> 05:55.120
, we want to use AES

130
05:55.760 --> 06:00.520
256 for hashing, we already do that for authentication. We said pre shared key
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
05:55.760 --> 06:00.520
256 for hashing, we already do that for authentication. We said pre shared key

131
06:00.520 --> 06:01.280
for the Diffie Hellman

132
06:01.280 --> 06:05.070
group, the command is group, and then we will specify that we want to use group

133
06:05.070 --> 06:05.840
five based on

134
06:05.840 --> 06:10.180
our plan. And then for the lifetime, instead of using the default of 86,400

135
06:10.180 --> 06:11.280
seconds, which is one

136
06:11.280 --> 06:16.250
day, our plan was to use 5000 seconds. So if we do a show crypto, I secamp

137
06:16.250 --> 06:17.040
policy with the do in

138
06:17.040 --> 06:20.230
front of it, because we're in configuration mode, it can just verify for us the

139
06:20.230 --> 06:21.920
details. So AES 256,

140
06:21.920 --> 06:26.220
great shot to do six pre shared key for authentication, Diffie Hellman group

141
06:26.220 --> 06:27.360
five, and a lifetime of

142
06:27.360 --> 06:31.720
5000 seconds. So we'll type in exit here, fantastic. And now one of the things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
06:27.360 --> 06:31.720
5000 seconds. So we'll type in exit here, fantastic. And now one of the things

143
06:31.720 --> 06:32.480
we should do while we're

144
06:32.480 --> 06:36.260
right here, if we're using pre shared keys, we should also specify the pre

145
06:36.260 --> 06:37.040
shared key that we

146
06:37.040 --> 06:41.120
are going to use. And to do that from configuration mode, we type in crypto, I

147
06:41.120 --> 06:44.400
secamp key, then we

148
06:44.400 --> 06:47.590
specify the key we want to use. So we'll use Cisco with the capital C ex

149
06:47.590 --> 06:48.800
clamation mark two, three,

150
06:48.800 --> 06:51.690
and we use the same Campbell size, and we'll put for address, we're gonna

151
06:51.690 --> 06:52.880
specify the address of

152
06:52.880 --> 06:57.640
who we're willing to use this key with. Now, if we did this 25 dot two dot two

153
06:57.640 --> 06:59.440
dot two, this key

154
06:59.440 --> 07:05.730
would be used with that specific peer, no problem, or we could specify 000, 000
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
06:59.440 --> 07:05.730
would be used with that specific peer, no problem, or we could specify 000, 000

155
07:05.730 --> 07:06.880
less secure. But

156
07:06.880 --> 07:12.200
this means I will use this key with anybody. That means if we had 200 sites,

157
07:12.200 --> 07:13.520
and they were all

158
07:13.520 --> 07:19.030
using this key, we could use this key with anybody because the 000 says I'm

159
07:19.030 --> 07:20.000
using this key with

160
07:20.000 --> 07:23.490
anybody who's willing. So for this config, I'm going to go ahead and use 000,

161
07:23.490 --> 07:25.680
000. And then let's

162
07:25.680 --> 07:30.300
do a show command again of do show crypto isocham policy, just to verify that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
07:25.680 --> 07:30.300
do a show command again of do show crypto isocham policy, just to verify that

163
07:30.300 --> 07:32.000
our pieces are in place.

164
07:32.000 --> 07:37.640
And let's also do this, let's do a show crypto isocham key press center. And

165
07:37.640 --> 07:38.880
there it is. So

166
07:38.880 --> 07:42.230
there's the key, and there's who we're willing to use it with, which is

167
07:42.230 --> 07:43.440
basically anybody.

168
07:43.440 --> 07:47.090
So once we have the configuration for the Ike phase one tunnel in place, what

169
07:47.090 --> 07:47.920
about the details

170
07:47.920 --> 07:51.630
for the IP sec tunnel or the Ike phase two tunnel? Those also need to be

171
07:51.630 --> 07:53.200
configured. So in the next

172
07:53.200 --> 07:56.990
video, we'll continue this configuration. And I'll walk you through step by

173
07:56.990 --> 07:58.240
step how to take our plans

174
07:58.240 --> 08:02.060
for Ike phase two, the IP sec tunnel, and how to implement them on the Cisco
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
07:58.240 --> 08:02.060
for Ike phase two, the IP sec tunnel, and how to implement them on the Cisco

175
08:02.060 --> 08:03.120
router. So I'll see

176
08:03.120 --> 08:06.520
you there in just a moment. Meanwhile, I hope this has been informative for you

177
08:06.520 --> 08:07.680
, and I'd like to

178
08:07.680 --> 08:14.680
Thank you for viewing.