WEBVTT

1
00:00.000 --> 00:05.190
We are making progress. We've configured iG phase one on router one and I also

2
00:05.190 --> 00:09.130
went over to our two and I implement the same iG phase one policy there so they

3
00:09.130 --> 00:10.000
're matching.

4
00:10.000 --> 00:13.290
So in this video I'd like to walk you through the syntax and demonstration of

5
00:13.290 --> 00:18.000
implementing our policy for IP sec the iG phase two tunnel on a Cisco router.

6
00:18.000 --> 00:22.740
And to get this ball rolling I just want to remind mostly me to be quite honest

7
00:22.740 --> 00:23.000
.

8
00:23.000 --> 00:27.670
Remind myself of the parameters that we want to use for the iG phase two tunnel

9
00:27.670 --> 00:31.000
. So we're going to configure an ACL on router one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.670 --> 00:31.000
. So we're going to configure an ACL on router one.

10
00:31.000 --> 00:36.180
Router one that would be an ACL that says traffic from 10 1 0 going to 10 2 0

11
00:36.180 --> 00:40.360
and over here on router two that ACL would be traffic from 10 to 0 going to 10

12
00:40.360 --> 00:41.000
1 0.

13
00:41.000 --> 00:45.790
Now this access list which is called a crypto ACL we're not going to apply it

14
00:45.790 --> 00:50.180
directly to an interface as a filter but rather we're going to include it as

15
00:50.180 --> 00:52.000
something called a crypto map.

16
00:52.000 --> 00:55.940
That lets the routers know what traffic needs to be encrypted and what traffic

17
00:55.940 --> 00:58.000
doesn't if it doesn't match the ACL.

18
00:58.000 --> 01:02.010
We also are going to specify the encryption for the iG phase two tunnel we use
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:58.000 --> 01:02.010
We also are going to specify the encryption for the iG phase two tunnel we use

19
01:02.010 --> 01:06.610
a s 128 we're going to use an h Mac of 384 Shaw and we're going to point to the

20
01:06.610 --> 01:11.000
peers so our two will point to our one are one will point to our two and we're

21
01:11.000 --> 01:11.000
going to use tunnel mode

22
01:11.000 --> 01:12.590
and just for grins we're not going to rely on the diffi helmet that was run

23
01:12.590 --> 01:18.760
during IKE phase one we're going to run our own diffi helmet generate our new

24
01:18.760 --> 01:24.000
keys and as a result we'll use that key material for our secret for encrypting

25
01:24.000 --> 01:26.000
and decrypting data for our IP

26
01:26.000 --> 01:30.340
So back where we left off there's our IKE phase one policy and the key all set
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:26.000 --> 01:30.340
So back where we left off there's our IKE phase one policy and the key all set

27
01:30.340 --> 01:35.330
up let's go into the details for configuring IKE phase two or the IP sec tunnel

28
01:35.330 --> 01:36.000
details.

29
01:36.000 --> 01:39.170
So we're going to configuration mode the first thing we're going to create is a

30
01:39.170 --> 01:40.000
transform set.

31
01:40.000 --> 01:44.400
Now a transform set is just set of instructions on how we want to manipulate

32
01:44.400 --> 01:50.520
the data so an IP sec transform set to create one the syntax would be crypto IP

33
01:50.520 --> 01:54.000
sec and then the keyword transform set space and then we name it.

34
01:54.000 --> 01:58.000
I'm going to call this one our set for you and me so we'll call our set.

35
01:58.000 --> 02:01.590
I'm also going to be just aware of the case sensitivity that I put in because
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.000 --> 02:01.590
I'm also going to be just aware of the case sensitivity that I put in because

36
02:01.590 --> 02:05.010
later when we call on this we want to use the same exact name for this

37
02:05.010 --> 02:06.000
transform set.

38
02:06.000 --> 02:09.450
So in this transform set we can specify are we going to use a h or we're going

39
02:09.450 --> 02:12.960
to use ESP and if we're using those do you want to use respectively the h Macs

40
02:12.960 --> 02:15.000
with them as well as the encryption.

41
02:15.000 --> 02:19.550
So the syntax would go something like this let me peek at our plan real quick

42
02:19.550 --> 02:23.970
let me peek at our plan real quick okay for encryption we want a yes 128 and

43
02:23.970 --> 02:28.000
for h Mac we wanted shop 384 great let's go back to the CLI and let's do it.

44
02:28.000 --> 02:32.000
So in this transform set I'm going to go ahead and choose those from the list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:28.000 --> 02:32.000
So in this transform set I'm going to go ahead and choose those from the list.

45
02:32.000 --> 02:36.950
Let's start off with ESP dash a s and now it's asking okay what flavor of a s

46
02:36.950 --> 02:42.810
do you want and based on our plan we want to use 128 so a s 128 space and if we

47
02:42.810 --> 02:48.000
want to have h Mac which we do which is the hashing with the secrets involved.

48
02:48.000 --> 02:53.930
We type in ESP dash shah dash and we want to use 384 based on our plan and I

49
02:53.930 --> 02:59.720
need to go ahead and make sure I specify the right one we wanted this guy right

50
02:59.720 --> 03:02.000
here so I just copy paste it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:59.720 --> 03:02.000
here so I just copy paste it.

51
03:02.000 --> 03:07.710
We wanted ESP Shaw 384 h Mac I think that was it so a yes 128 for encryption

52
03:07.710 --> 03:13.430
and Shaw 384 h Mac for data integrity and great so now we've got this transform

53
03:13.430 --> 03:14.000
set.

54
03:14.000 --> 03:17.680
So we're going to go ahead and select the transform set and then we're going to

55
03:17.680 --> 03:20.810
go ahead and select the transform set and then we're going to go ahead and

56
03:20.810 --> 03:26.520
select the transform set and then we're going to go ahead and select the

57
03:26.520 --> 03:30.000
transform set and then we're going to go ahead and select the transform set and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
03:26.520 --> 03:30.000
transform set and then we're going to go ahead and select the transform set and

58
03:30.000 --> 03:30.000
then we're going to

59
03:30.000 --> 03:34.100
go ahead and select the transform set and then we're going to go ahead and

60
03:34.100 --> 03:36.490
select the transform set and then we're going to go ahead and select the

61
03:36.490 --> 03:44.270
transform set and then we're going to go ahead and select the transform set and

62
03:44.270 --> 03:49.000
then we're going to go ahead and select the transform set and then we're going

63
03:49.000 --> 03:49.000
to

64
03:49.000 --> 03:54.360
until we take one final step and that is associating something called a crypto

65
03:54.360 --> 03:55.660
map with the egress

66
03:55.660 --> 03:59.260
interface on that router so that's a step that's coming up in a video or two so

67
03:59.260 --> 04:00.120
we're building
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:59.260 --> 04:00.120
we're building

68
04:00.120 --> 04:04.100
that and putting all the building blocks together for the final result so we

69
04:04.100 --> 04:05.000
have a transform set

70
04:05.000 --> 04:09.270
next let's create a crypto ACL and so for this crypto ACL it's going to be an

71
04:09.270 --> 04:10.300
extended access

72
04:10.300 --> 04:14.870
control list so we can you know use 100 or 101 or a named access control list

73
04:14.870 --> 04:15.780
either way would work

74
04:15.780 --> 04:25.010
let's do IP access list extended and let's call this crypto dash ACL press

75
04:25.010 --> 04:26.780
enter and let's just have

76
04:26.780 --> 04:31.380
one entry and from our ones perspective is going to be a permit meaning a match
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
04:26.780 --> 04:31.380
one entry and from our ones perspective is going to be a permit meaning a match

77
04:31.380 --> 04:33.120
for any IP traffic

78
04:33.120 --> 04:38.970
in the IPV4 protocol suite that's coming from 10.1.0.0 then we use a wildcard

79
04:38.970 --> 04:40.620
mask which means we only care

80
04:40.620 --> 04:45.360
about matching on the first two octets of 10.1 and the destination would be 10.

81
04:45.360 --> 04:47.500
2.0.0 with the same

82
04:47.500 --> 04:52.220
wildcard mask meaning we don't care about matching on anything beyond the first

83
04:52.220 --> 04:54.420
two octets boom so

84
04:54.420 --> 04:57.920
there is an extended access list it's not being used yet we need to tie that

85
04:57.920 --> 04:58.900
all together with

86
04:58.900 --> 05:03.300
something called a crypto map that step is coming up so our next step is once
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:58.900 --> 05:03.300
something called a crypto map that step is coming up so our next step is once

87
05:03.300 --> 05:05.020
we have the transform

88
05:05.020 --> 05:08.980
set and we have the access control list that we're going to use as a crypto ACL

89
05:08.980 --> 05:09.660
how in the world do

90
05:09.660 --> 05:13.590
all these things get you know put together in like a bundle the answer is we're

91
05:13.590 --> 05:14.060
going to use like a

92
05:14.060 --> 05:16.930
shopping cart let's imagine we're shopping in a store I want some of this and

93
05:16.930 --> 05:17.500
some of that we're

94
05:17.500 --> 05:22.060
putting on the shopping cart the device in traditional IPsec VPNs that we're

95
05:22.060 --> 05:23.260
going to use is called a

96
05:23.260 --> 05:26.360
crypto map think of a crypto map like a shopping cart and what we're going to

97
05:26.360 --> 05:27.100
do is we're going to

98
05:27.100 --> 05:30.880
say okay here's your shopping cart this crypto map and we want to put this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:27.100 --> 05:30.880
say okay here's your shopping cart this crypto map and we want to put this

99
05:30.880 --> 05:32.380
access list in it which is

100
05:32.380 --> 05:36.540
the interesting traffic we want to put this peer match you know set traffic to

101
05:36.540 --> 05:37.620
this peer we want to

102
05:37.620 --> 05:41.290
put in the transform set like what encryption and hashing do we want to use and

103
05:41.290 --> 05:42.100
also if we want to

104
05:42.100 --> 05:46.440
use PFS perfect forward secrecy we put that in the shopping cart so without

105
05:46.440 --> 05:48.020
further ado let's create

106
05:48.020 --> 05:52.450
our crypto map which is like a shopping cart and will include all those details

107
05:52.450 --> 05:53.940
about the IPsec tunnel

108
05:53.940 --> 05:58.290
that we want to establish so the syntax for this for creating a crypto map is

109
05:58.290 --> 05:59.780
crypto space map space

110
05:59.780 --> 06:03.230
and then we're going to go ahead and give it a word and the word we're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:59.780 --> 06:03.230
and then we're going to go ahead and give it a word and the word we're going to

111
06:03.230 --> 06:05.100
use is our dash map

112
06:05.100 --> 06:09.560
and it is if we use this syntax as part of the upper case lowercase we want to

113
06:09.560 --> 06:10.460
remember that because

114
06:10.460 --> 06:14.710
when we go to apply this to an interface we'd we'd want to use the same exact

115
06:14.710 --> 06:16.620
syntax because if

116
06:16.620 --> 06:20.340
you put if you do a typo or it's not correct it's not going to recognize it as

117
06:20.340 --> 06:21.980
a valid crypto map so

118
06:21.980 --> 06:26.020
we're going to do crypto map our map space and then a question mark and there's

119
06:26.020 --> 06:26.860
this option right

120
06:26.860 --> 06:30.260
here called the sequence number and I'm going to use sequence number 10 let me
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
06:26.860 --> 06:30.260
here called the sequence number and I'm going to use sequence number 10 let me

121
06:30.260 --> 06:31.100
talk about why that

122
06:31.100 --> 06:34.450
might be really important that could be really important because we might have

123
06:34.450 --> 06:35.260
one crypto map

124
06:35.260 --> 06:38.310
that we're going to use but we might have several peers maybe we're hub and

125
06:38.310 --> 06:39.020
spoke and we've got a

126
06:39.020 --> 06:43.170
central site with four different remote sites we're connected with we could

127
06:43.170 --> 06:43.980
have different

128
06:43.980 --> 06:48.980
sections or sequences in one crypto map one appropriate for site 10 one

129
06:48.980 --> 06:50.620
appropriate for site 20 and so

130
06:50.620 --> 06:54.230
forth so we're just going to have one sequence because we only have one peer

131
06:54.230 --> 06:55.340
but that's why we're

132
06:55.340 --> 06:58.980
using a sequence number as part of our crypto map and then we'll do a space and

133
06:58.980 --> 06:59.820
a question mark

134
06:59.820 --> 07:03.820
and I'm going to do this one right here of II, IPsec dash iSACAMP what this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
06:59.820 --> 07:03.820
and I'm going to do this one right here of II, IPsec dash iSACAMP what this

135
07:03.820 --> 07:05.740
means is that iSACAMP

136
07:05.740 --> 07:09.680
the internet security association key management protocol what it does behind

137
07:09.680 --> 07:10.540
the scenes for us

138
07:10.540 --> 07:14.510
is a lot of busy work and a lot of dynamic negotiation of keys and that's all I

139
07:14.510 --> 07:15.660
'm saying is I want to

140
07:15.660 --> 07:19.660
use that so basically if this crypto map is applied and there's interesting

141
07:19.660 --> 07:20.780
traffic that it says oh

142
07:20.780 --> 07:24.800
I should encrypt this it will automatically negotiate and work with iKphase one

143
07:24.800 --> 07:25.740
policy that we have set

144
07:25.740 --> 07:29.500
up to build the iKphase one tunnel if it's not already up and then subsequently

145
07:29.500 --> 07:30.700
bring up the IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
07:29.500 --> 07:30.700
bring up the IPsec

146
07:30.700 --> 07:35.090
tunnel if it needs an IPsec tunnel established so that's what iPsec dash iSAC

147
07:35.090 --> 07:36.300
AMP does it does allow

148
07:36.300 --> 07:40.450
that nitty-gritty detail for us automatically then we'll press enter and now it

149
07:40.450 --> 07:41.340
's saying hey

150
07:41.340 --> 07:45.150
whoa this crypto map is empty it's like your shopping cart is empty we need

151
07:45.150 --> 07:46.860
some details in it so

152
07:46.860 --> 07:51.810
let's go ahead and put in the details so let's start off by saying please match

153
07:51.810 --> 07:54.620
on the address

154
07:54.620 --> 07:58.460
or the addresses i should say that are in the access controllers called crypto

155
07:58.460 --> 08:00.140
dash ACL
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
07:58.460 --> 08:00.140
dash ACL

156
08:00.140 --> 08:06.460
so what that says as part of this crypto map is says okay our one says okay

157
08:06.460 --> 08:07.580
traffic from 10.1

158
08:07.580 --> 08:11.230
anything going to 10.2 anything because that's what's in the crypto ACL the ad

159
08:11.230 --> 08:12.220
access list that's

160
08:12.220 --> 08:16.160
interesting traffic and if i see that traffic and if this crypto map is applied

161
08:16.160 --> 08:17.500
somewhere i should

162
08:17.500 --> 08:21.160
you know encrypt the traffic and ship that data over to my peer who then can

163
08:21.160 --> 08:22.540
decrypt it now the

164
08:22.540 --> 08:27.390
other question is who's your peer so that's also set here inside this crypto

165
08:27.390 --> 08:27.820
map so we'll

166
08:27.820 --> 08:31.730
set the peer in this case is our one the peer is going to be 25 let me look at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
08:27.820 --> 08:31.730
set the peer in this case is our one the peer is going to be 25 let me look at

167
08:31.730 --> 08:32.700
the address real

168
08:32.700 --> 08:37.890
quick so our two's address is going to be 252222 that's the reachable address

169
08:37.890 --> 08:39.180
on our two over the

170
08:39.180 --> 08:45.240
transport network here so we'll put 25.2.2.2 boom and we also created a

171
08:45.240 --> 08:46.460
transform set we should

172
08:46.460 --> 08:50.090
specify in this shopping cart called a crypto map what that transform set is so

173
08:50.090 --> 08:50.860
we'll do a set

174
08:50.860 --> 08:57.060
transform set and it was our dash sct and then we also if we want to do pfs

175
08:57.060 --> 08:59.260
perfect forward secrecy

176
08:59.260 --> 09:04.160
we can do it as well so i'll do pfs and based on our plan we use group and i
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:59.260 --> 09:04.160
we can do it as well so i'll do pfs and based on our plan we use group and i

177
09:04.160 --> 09:05.660
think we planned

178
09:05.660 --> 09:11.010
let's take a look real quick here's our plan and we planned on pfs 15 so we'll

179
09:11.010 --> 09:12.620
do 15 and then we'll

180
09:12.620 --> 09:17.280
type in exit and let's take a look at the details of our crypto map we'll do a

181
09:17.280 --> 09:18.460
do show crypto map

182
09:19.340 --> 09:25.600
just like that and let's look at this together so this shopping cart called our

183
09:19.710 --> 09:47.180
it's also

184
09:25.600 --> 09:27.020
crypto map has

185
09:27.020 --> 09:32.260
one sequence number 10 and then that it basically says if traffic matches this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
09:27.020 --> 09:32.260
one sequence number 10 and then that it basically says if traffic matches this

186
09:32.260 --> 09:33.500
axis control list

187
09:33.500 --> 09:40.160
which is crypto dash ACL which is spelled out right here 1010 going to 1020

188
09:40.160 --> 09:41.500
then go ahead and

190
09:47.180 --> 09:50.570
specifying that regarding this tunnel that hasn't been established when you

191
09:50.570 --> 09:51.660
build the tunnel

192
09:51.660 --> 09:55.610
that we should use diffihelman group 15 to generate our own keys it's

193
09:55.610 --> 09:56.300
specifying that we

194
09:56.300 --> 09:59.980
should use perfect forward secrecy and that's why the group information is here

195
09:59.980 --> 10:00.620
and the transform
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

195
09:59.980 --> 10:00.620
and the transform

196
10:00.620 --> 10:04.840
set for this tunnel should use AES did we specify okay so because it's not

197
10:04.840 --> 10:05.900
showing right here the

198
10:05.900 --> 10:09.680
value let me just take a look at our notes real quick because it's not showing

199
10:09.680 --> 10:10.540
a value here the

200
10:10.540 --> 10:14.980
default is 128 and that's why that 128 is not showing up and then we're using

201
10:14.980 --> 10:16.700
SHA-384 hmac for

202
10:16.700 --> 10:21.200
the data integrity fantastic so this shopping cart called our map it has all

203
10:21.200 --> 10:22.220
those details in it now

204
10:22.220 --> 10:28.140
the problem the big problem is this guy right here interfaces using crypto map

205
10:28.140 --> 10:29.260
our map nada

206
10:29.260 --> 10:33.030
there's nothing there we don't have this applied yet and that's the actual
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

206
10:29.260 --> 10:33.030
there's nothing there we don't have this applied yet and that's the actual

207
10:33.030 --> 10:34.620
final step in getting

208
10:34.620 --> 10:38.400
ipsec working in a site to site environment we have to take this crypto map

209
10:38.400 --> 10:40.060
that we just created

210
10:40.060 --> 10:44.110
and we have to go back to our topology and looking at our topology we need to

211
10:44.110 --> 10:45.580
apply that crypto map

212
10:45.580 --> 10:50.380
right here on this interface so you apply it on the interface between this pier

213
10:50.380 --> 10:51.020
and the interface

214
10:51.020 --> 10:54.620
it would use as it's talking to the other end of the tunnel also we would do

215
10:54.620 --> 10:55.580
the appropriate the

216
10:55.580 --> 11:00.220
similar configuration over here on r2 including a crypto ACL saying 10 to 0
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

216
10:55.580 --> 11:00.220
similar configuration over here on r2 including a crypto ACL saying 10 to 0

217
11:00.220 --> 11:01.820
going to 10 1 0 and

218
11:01.820 --> 11:05.480
the encryption and the hashing and the transform set which i will do i'll

219
11:05.480 --> 11:06.700
mirror all that over on

220
11:06.700 --> 11:11.090
r2 but the final step on both these routers is we need to take the crypto map

221
11:11.090 --> 11:12.140
and apply it on that

222
11:12.140 --> 11:16.420
interface that they would be using to talk to the pier and that is what

223
11:16.420 --> 11:19.100
activates our ipsec policy

224
11:19.100 --> 11:23.410
and the great news is we're going to do exactly that and watch it come up in

225
11:23.410 --> 11:24.540
the very next video

226
11:24.540 --> 11:27.920
so i will see you there in just a moment meanwhile i hope this has been

227
11:27.920 --> 11:29.580
informative for you and i'd

228
11:29.580 --> 11:33.340
like to thank you for viewing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
11:29.580 --> 11:33.340
like to thank you for viewing