WEBVTT

1
00:00.000 --> 00:01.410 align:middle line:84%


2
00:01.410 --> 00:04.000 align:middle line:90%
When we're using IPsec, and
we're using IKE version one,

3
00:04.000 --> 00:06.050 align:middle line:90%
there's going to be two
phases, the IKE phase one

4
00:06.050 --> 00:08.870 align:middle line:90%
tunnel and the IKE phase two
tunnel, or the IPsec tunnel.

5
00:08.870 --> 00:11.858 align:middle line:90%
When is the best time to
plan out the details, as far

6
00:11.858 --> 00:14.150 align:middle line:90%
as the encryption algorithms
and the hashing that we're

7
00:14.150 --> 00:15.260 align:middle line:84%
going to use for those?

8
00:15.260 --> 00:17.180 align:middle line:90%
I would suggest
the best time to do

9
00:17.180 --> 00:19.640 align:middle line:90%
that, to plan it out would
be before we're actually

10
00:19.640 --> 00:21.300 align:middle line:84%
at the CLI and typing it in.

11
00:21.300 --> 00:23.690 align:middle line:90%
So let's spend a few moments
in this video planning

12
00:23.690 --> 00:27.200 align:middle line:90%
out what we want to use for IKE
phase one and IKE phase two,

13
00:27.200 --> 00:28.970 align:middle line:90%
and then we'll proceed
in the next video

14
00:28.970 --> 00:30.695 align:middle line:84%
by implementing our design.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.970 --> 00:30.695 align:middle line:84%
by implementing our design.

15
00:30.695 --> 00:32.570 align:middle line:90%
All right, let's go
ahead and do our planning

16
00:32.570 --> 00:34.610 align:middle line:90%
for IKE phase one
and IKE phase two

17
00:34.610 --> 00:36.710 align:middle line:90%
as we're going to protect
that GRE traffic going

18
00:36.710 --> 00:37.700 align:middle line:84%
over the network.

19
00:37.700 --> 00:39.540 align:middle line:90%
So for encryption,
let's do this.

20
00:39.540 --> 00:41.720 align:middle line:84%
Let's use AES for IKE phase one.

21
00:41.720 --> 00:45.230 align:middle line:84%
Let's use AES 256 for hashing.

22
00:45.230 --> 00:49.250 align:middle line:90%
Let's use SHA 256
for authentication.

23
00:49.250 --> 00:51.080 align:middle line:84%
Let's use pre-shared keys.

24
00:51.080 --> 00:53.520 align:middle line:90%
For the diffy element
group, let's use group five.

25
00:53.520 --> 00:57.182 align:middle line:90%
And for the lifetime,
let's use 5,000 seconds.

26
00:57.182 --> 00:58.640 align:middle line:90%
And if we're using
pre-shared keys,

27
00:58.640 --> 01:01.310 align:middle line:90%
we'll also need to specify
what that pre-shared key is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.640 --> 01:01.310 align:middle line:90%
we'll also need to specify
what that pre-shared key is

28
01:01.310 --> 01:03.210 align:middle line:90%
and who we're willing
to use it with.

29
01:03.210 --> 01:05.269 align:middle line:90%
Now for IKE phase
two, for encryption,

30
01:05.269 --> 01:09.110 align:middle line:90%
let's use it AES 128, and we
could choose any flavor that's

31
01:09.110 --> 01:11.300 align:middle line:90%
supported by both sides
for IKE phase two,

32
01:11.300 --> 01:12.680 align:middle line:90%
but I want to
point out that they

33
01:12.680 --> 01:15.410 align:middle line:90%
don't have to match what
we use for IKE phase one,

34
01:15.410 --> 01:17.450 align:middle line:90%
because this is a
separate transform going

35
01:17.450 --> 01:20.540 align:middle line:90%
to be used for IKE phase two
or the IPsec tunnel itself.

36
01:20.540 --> 01:22.260 align:middle line:90%
And for the HMAC,
which is hashing

37
01:22.260 --> 01:24.260 align:middle line:90%
with the benefit of using
the secret key as part

38
01:24.260 --> 01:26.690 align:middle line:90%
of the formula, so only
the person with the key

39
01:26.690 --> 01:30.440 align:middle line:90%
could do the correct
hash, let's use SHA 384.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:26.690 --> 01:30.440 align:middle line:90%
could do the correct
hash, let's use SHA 384.

40
01:30.440 --> 01:31.482 align:middle line:84%
So that will be our plan.

41
01:31.482 --> 01:33.440 align:middle line:90%
And you might be saying,
well, Keith, you know,

42
01:33.440 --> 01:35.810 align:middle line:90%
when we did crypto maps,
we also had a crypto ACL

43
01:35.810 --> 01:38.180 align:middle line:90%
to identify the traffic
we wanted to protect.

44
01:38.180 --> 01:42.290 align:middle line:90%
Now, we could create a crypto
ACL that says, you know,

45
01:42.290 --> 01:43.858 align:middle line:84%
GRE traffic protocol 47.

46
01:43.858 --> 01:45.150 align:middle line:84%
Just go ahead and encrypt that.

47
01:45.150 --> 01:46.040 align:middle line:84%
That'll be it.

48
01:46.040 --> 01:49.640 align:middle line:90%
Or a better way of doing it is
to create a tunnel protection

49
01:49.640 --> 01:53.720 align:middle line:90%
profile, not a crypto map, and
applying that tunnel protection

50
01:53.720 --> 01:56.570 align:middle line:90%
profile to the tunnel
interface and boom.

51
01:56.570 --> 01:57.350 align:middle line:84%
We're done.

52
01:57.350 --> 02:00.110 align:middle line:90%
Any traffic going out or coming
in on that tunnel interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:57.350 --> 02:00.110 align:middle line:90%
Any traffic going out or coming
in on that tunnel interface

53
02:00.110 --> 02:02.150 align:middle line:90%
is going to be assumed
to be encrypted

54
02:02.150 --> 02:04.587 align:middle line:90%
if it's outbound or
decrypted if it's inbound.

55
02:04.587 --> 02:06.920 align:middle line:90%
So that's going to be a slight
difference, and an easier

56
02:06.920 --> 02:09.320 align:middle line:90%
difference, when we go to
implement the IPsec, which

57
02:09.320 --> 02:12.150 align:middle line:90%
we'll do, now that we have
a plan, in our next video.

58
02:12.150 --> 02:14.010 align:middle line:90%
So I'll see you there
in just a moment.

59
02:14.010 --> 02:16.640 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

60
02:16.640 --> 02:19.840 align:middle line:90%
and I'd like to thank
you for viewing.