WEBVTT

1
00:00.000 --> 00:00.308 align:middle line:84%


2
00:00.308 --> 00:02.350 align:middle line:90%
In this video, we're going
to do a couple things.

3
00:02.350 --> 00:04.370 align:middle line:90%
Number one, we're going to
identify many of the components

4
00:04.370 --> 00:06.662 align:middle line:90%
that we're going to need to
configure on the key server

5
00:06.662 --> 00:08.908 align:middle line:84%
and plan those out beforehand.

6
00:08.908 --> 00:10.950 align:middle line:90%
That way when we get to
the CLI we won't be like,

7
00:10.950 --> 00:12.310 align:middle line:84%
hmm, what should we use.

8
00:12.310 --> 00:13.350 align:middle line:90%
We'll have a good
plan and then we'll

9
00:13.350 --> 00:14.530 align:middle line:84%
follow through on the plan.

10
00:14.530 --> 00:16.830 align:middle line:90%
So, let's go to the
chalkboard and identify

11
00:16.830 --> 00:18.330 align:middle line:90%
some of the major
components that we

12
00:18.330 --> 00:20.840 align:middle line:90%
are going to want to
configure on the key server.

13
00:20.840 --> 00:23.190 align:middle line:90%
So, in our topology we
will imagine this is MPLS

14
00:23.190 --> 00:25.140 align:middle line:90%
and that our service
provider is providing

15
00:25.140 --> 00:27.900 align:middle line:84%
us MPLS layer 3 VPN services.

16
00:27.900 --> 00:30.060 align:middle line:90%
Which basically means
that the 10.1.0 network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:27.900 --> 00:30.060 align:middle line:90%
Which basically means
that the 10.1.0 network,

17
00:30.060 --> 00:33.256 align:middle line:90%
if we have a customer here
who routes packets to 10.2.0,

18
00:33.256 --> 00:35.490 align:middle line:90%
the service provider knows
about all of our routes,

19
00:35.490 --> 00:38.740 align:middle line:90%
they're keeping track of it with
MPLS layer 3 VPNs themselves,

20
00:38.740 --> 00:39.990 align:middle line:84%
and we have full reachability.

21
00:39.990 --> 00:43.740 align:middle line:90%
And the reason that's important
is because with group encrypted

22
00:43.740 --> 00:45.810 align:middle line:90%
transport we are
not swapping out

23
00:45.810 --> 00:48.430 align:middle line:90%
the IP headers with a
different set of IP addresses.

24
00:48.430 --> 00:52.140 align:middle line:90%
So, if 10.1.0 doesn't have
reachability to 10.2.0

25
00:52.140 --> 00:54.540 align:middle line:90%
over this network,
it's not going

26
00:54.540 --> 00:56.280 align:middle line:84%
to have it after we do IPsec.

27
00:56.280 --> 00:58.680 align:middle line:90%
So, we want to make sure
we have full reachability

28
00:58.680 --> 01:01.380 align:middle line:90%
in the solution before we
do group encrypted transport
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.680 --> 01:01.380 align:middle line:90%
in the solution before we
do group encrypted transport

29
01:01.380 --> 01:03.810 align:middle line:90%
because the IP headers
are going to be preserved

30
01:03.810 --> 01:04.817 align:middle line:84%
after the encryption.

31
01:04.817 --> 01:06.650 align:middle line:90%
So, let's plan for IKE
phase 1 because we're

32
01:06.650 --> 01:08.567 align:middle line:90%
going to need that between
R4, the key server,

33
01:08.567 --> 01:10.380 align:middle line:90%
and the individual
group members.

34
01:10.380 --> 01:13.680 align:middle line:90%
Now, R2 and R1 and R3 don't
need IKE phase 1 between them

35
01:13.680 --> 01:15.720 align:middle line:90%
because we're not
building tunnel overlays,

36
01:15.720 --> 01:18.720 align:middle line:90%
but what we do need is IKE
phase 1 compatible between each

37
01:18.720 --> 01:20.567 align:middle line:90%
of the group members
and the key server.

38
01:20.567 --> 01:21.900 align:middle line:84%
So, here's what I propose we do.

39
01:21.900 --> 01:27.450 align:middle line:90%
For encryption let's use AES
128, and for hashing let's use

40
01:27.450 --> 01:31.620 align:middle line:90%
SHA 256, for
Diffie-Hellman let's use
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:27.450 --> 01:31.620 align:middle line:90%
SHA 256, for
Diffie-Hellman let's use

41
01:31.620 --> 01:36.870 align:middle line:90%
group 14, and for authentication
let's use pre-shared keys.

42
01:36.870 --> 01:38.838 align:middle line:90%
That means we need to
set a pre-shared key

43
01:38.838 --> 01:40.380 align:middle line:90%
and we'll use a
pre-shared key that's

44
01:40.380 --> 01:42.900 align:middle line:90%
the same on all the devices
as they authenticate

45
01:42.900 --> 01:44.280 align:middle line:84%
with the key server.

46
01:44.280 --> 01:45.960 align:middle line:90%
And for the address
we'll just tell them

47
01:45.960 --> 01:48.360 align:middle line:90%
all the pre-shared key
can be used with anybody.

48
01:48.360 --> 01:50.860 align:middle line:90%
If we wanted to lock it down
from the key server perspective

49
01:50.860 --> 01:54.070 align:middle line:90%
we can say, OK only use that
key with 15.1.1.1 and 25.2.2.2

50
01:54.070 --> 01:57.780 align:middle line:90%
et cetera, but the wild
card for the pre-shared keys

51
01:57.780 --> 02:00.450 align:middle line:90%
just says whatever the
key is we specify, feel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:57.780 --> 02:00.450 align:middle line:90%
just says whatever the
key is we specify, feel

52
02:00.450 --> 02:01.800 align:middle line:84%
free to use it with everybody.

53
02:01.800 --> 02:03.990 align:middle line:90%
And for IPsec, as part of
the policy that we'll then

54
02:03.990 --> 02:05.830 align:middle line:90%
push down to all
the group members,

55
02:05.830 --> 02:08.190 align:middle line:90%
we are going to need to
create a transform set, which

56
02:08.190 --> 02:11.730 align:middle line:90%
is identical to the other
videos on IPsec we've done.

57
02:11.730 --> 02:13.500 align:middle line:90%
In addition to an
IPsec transform set,

58
02:13.500 --> 02:16.847 align:middle line:90%
we're going to make an IPsec
profile and in that profile

59
02:16.847 --> 02:18.180 align:middle line:84%
we'll include the transform set.

60
02:18.180 --> 02:20.405 align:middle line:90%
We can also set the lifetime
and this information

61
02:20.405 --> 02:22.530 align:middle line:90%
that we configure is going
to be part of the policy

62
02:22.530 --> 02:24.155 align:middle line:90%
that we push down to
the group members.

63
02:24.155 --> 02:26.010 align:middle line:90%
So, this IPsec policy
that we're configuring

64
02:26.010 --> 02:27.927 align:middle line:90%
is going to be part of
the policy we push down

65
02:27.927 --> 02:28.927 align:middle line:84%
to the group members.

66
02:28.927 --> 02:30.510 align:middle line:90%
Now, for the rekeying
we're also going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.927 --> 02:30.510 align:middle line:90%
Now, for the rekeying
we're also going

67
02:30.510 --> 02:33.150 align:middle line:90%
to need to generate
an RSA key pair,

68
02:33.150 --> 02:34.663 align:middle line:90%
just like we would
to enable SSH.

69
02:34.663 --> 02:36.830 align:middle line:90%
And the reason we're going
to generate RSA key pair,

70
02:36.830 --> 02:39.687 align:middle line:90%
it's going to use that key
pair as part of the rekeying

71
02:39.687 --> 02:41.520 align:middle line:90%
when it communicates
with the group members.

72
02:41.520 --> 02:43.872 align:middle line:90%
Also, we're going
to need an ACL,

73
02:43.872 --> 02:45.330 align:middle line:90%
I'll put a C there
in front, that's

74
02:45.330 --> 02:49.100 align:middle line:90%
a crypto ACL that identifies
traffic from 10 to 10

75
02:49.100 --> 02:50.370 align:middle line:84%
will be encrypted.

76
02:50.370 --> 02:53.280 align:middle line:90%
And this is the gotcha that I'd
like to talk with you about.

77
02:53.280 --> 02:55.920 align:middle line:90%
The gotcha is that
in the crypto ACL

78
02:55.920 --> 02:59.590 align:middle line:90%
the permit statements identify
what we want to encrypt.

79
02:59.590 --> 03:02.700 align:middle line:90%
So, if we accidentally
include too much,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.590 --> 03:02.700 align:middle line:90%
So, if we accidentally
include too much,

80
03:02.700 --> 03:06.150 align:middle line:90%
like we include NTP
traffic, or OSPF traffic,

81
03:06.150 --> 03:09.938 align:middle line:90%
or other control plane traffic
that shouldn't be encrypted

82
03:09.938 --> 03:11.730 align:middle line:90%
because the other side
is not expecting it,

83
03:11.730 --> 03:12.660 align:middle line:84%
we might have fail--

84
03:12.660 --> 03:14.410 align:middle line:90%
we will have failures
in our network

85
03:14.410 --> 03:17.033 align:middle line:90%
as far as our routing protocols
and things like that in NTP.

86
03:17.033 --> 03:18.450 align:middle line:90%
So, what you'd
want to do is, what

87
03:18.450 --> 03:21.320 align:middle line:90%
we'll do this example is
we'll create a crypto ACL that

88
03:21.320 --> 03:24.720 align:middle line:90%
says permit from 10
to 10 and then we'll

89
03:24.720 --> 03:26.440 align:middle line:84%
deny everything else.

90
03:26.440 --> 03:28.140 align:middle line:90%
And that way only
the traffic that's

91
03:28.140 --> 03:30.780 align:middle line:90%
going from the 10 networks
to the other 10 networks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.140 --> 03:30.780 align:middle line:90%
going from the 10 networks
to the other 10 networks

92
03:30.780 --> 03:31.710 align:middle line:84%
will be encrypting.

93
03:31.710 --> 03:34.410 align:middle line:90%
They'll match the encryption
policy and everything else

94
03:34.410 --> 03:35.050 align:middle line:84%
won't.

95
03:35.050 --> 03:38.460 align:middle line:90%
So, the hard way of learning
that is accidentally

96
03:38.460 --> 03:41.190 align:middle line:90%
making that crypto ACL
too loose and having it

97
03:41.190 --> 03:43.800 align:middle line:90%
include protocols
where your router says,

98
03:43.800 --> 03:45.800 align:middle line:90%
oh, I should encrypt this,
it says it encrypted,

99
03:45.800 --> 03:48.120 align:middle line:90%
and the other side is not
expecting it to be encrypted.

100
03:48.120 --> 03:49.000 align:middle line:84%
And that's a problem.

101
03:49.000 --> 03:51.208 align:middle line:90%
So, a word of caution is be
sure you have a good plan

102
03:51.208 --> 03:53.970 align:middle line:90%
and only permit those specific
protocols and addresses

103
03:53.970 --> 03:57.000 align:middle line:90%
that you want to in
a get VPN crypto ACL.

104
03:57.000 --> 03:58.500 align:middle line:90%
And then the binding
glue that takes

105
03:58.500 --> 04:00.720 align:middle line:90%
the IPsec profile
and the crypto ACL
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:58.500 --> 04:00.720 align:middle line:90%
the IPsec profile
and the crypto ACL

106
04:00.720 --> 04:02.610 align:middle line:90%
and bundles it all
together is called

107
04:02.610 --> 04:06.255 align:middle line:90%
a GDOI, a group domain
of interpretation, group

108
04:06.255 --> 04:08.630 align:middle line:90%
and in the configuration on
the key server in that group,

109
04:08.630 --> 04:11.270 align:middle line:90%
we're going to specify the
IP address of the key server,

110
04:11.270 --> 04:14.120 align:middle line:90%
we're going to specify an
identity number, we're going

111
04:14.120 --> 04:15.870 align:middle line:90%
to specify rekey
information regarding

112
04:15.870 --> 04:18.269 align:middle line:90%
the frequency of the rekeys
and how we want to rekey,

113
04:18.269 --> 04:20.760 align:middle line:90%
are we going to do it
with multicast or unicast.

114
04:20.760 --> 04:22.260 align:middle line:90%
And also, as part
of the rekey we're

115
04:22.260 --> 04:24.660 align:middle line:90%
going to specify
the RSA key pair

116
04:24.660 --> 04:26.430 align:middle line:90%
that we want to use
on that key server

117
04:26.430 --> 04:27.990 align:middle line:84%
as part of that rekeying.

118
04:27.990 --> 04:30.030 align:middle line:90%
So, the configuration
and the binding
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:27.990 --> 04:30.030 align:middle line:90%
So, the configuration
and the binding

119
04:30.030 --> 04:32.040 align:middle line:90%
of all that, I will walk
you through in a couple

120
04:32.040 --> 04:33.790 align:middle line:90%
videos from now, but
I wanted to give us a

121
04:33.790 --> 04:35.700 align:middle line:90%
heads up on the
elements of what would

122
04:35.700 --> 04:38.247 align:middle line:90%
be expected to be configured
on the key server.

123
04:38.247 --> 04:40.080 align:middle line:90%
So, that's a good,
pretty high-level picture

124
04:40.080 --> 04:41.622 align:middle line:90%
of some of the
configuration elements

125
04:41.622 --> 04:43.470 align:middle line:90%
we want to implement
on our key server

126
04:43.470 --> 04:45.790 align:middle line:90%
and then overwrite the group
members that configuration

127
04:45.790 --> 04:46.770 align:middle line:84%
is very small.

128
04:46.770 --> 04:50.130 align:middle line:90%
It basically says, hey, you're
participating in get VPN.

129
04:50.130 --> 04:51.870 align:middle line:90%
You're part of this
GDOI, the group

130
04:51.870 --> 04:55.560 align:middle line:90%
domain of interpretation group,
and here's your key server, go.

131
04:55.560 --> 04:58.890 align:middle line:90%
And he goes, authenticates, gets
the policy, and goes to work.

132
04:58.890 --> 05:01.010 align:middle line:90%
So, we'll turn our
attention to the key server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
04:58.890 --> 05:01.010 align:middle line:90%
So, we'll turn our
attention to the key server

133
05:01.010 --> 05:02.300 align:middle line:84%
first and its configuration.

134
05:02.300 --> 05:04.205 align:middle line:90%
Then after that,
after it's all setup,

135
05:04.205 --> 05:06.080 align:middle line:90%
we'll then go to the
individual group members

136
05:06.080 --> 05:07.470 align:middle line:84%
and implement those as well.

137
05:07.470 --> 05:09.303 align:middle line:90%
So, we'll start the key
server configuration

138
05:09.303 --> 05:10.970 align:middle line:90%
and I'll walk you
through all the config

139
05:10.970 --> 05:12.180 align:middle line:84%
on that in the next video.

140
05:12.180 --> 05:14.130 align:middle line:90%
So, I'll see you there
in just a moment.

141
05:14.130 --> 05:16.550 align:middle line:90%
Meanwhile, I hope this has
been informative for you

142
05:16.550 --> 05:19.690 align:middle line:90%
and I'd like to thank
you for viewing.