WEBVTT

1
00:00.000 --> 00:01.280 align:middle line:84%


2
00:01.280 --> 00:03.620 align:middle line:90%
Now, one of the benefits
of using GET VPN

3
00:03.620 --> 00:05.970 align:middle line:90%
is that all that policy
is on the key server.

4
00:05.970 --> 00:09.710 align:middle line:90%
So the crypto ACL, the
transforms, the policies,

5
00:09.710 --> 00:12.620 align:middle line:90%
we don't have to specify all
the detail on the group members.

6
00:12.620 --> 00:14.412 align:middle line:90%
All we have to do is
tell the group members

7
00:14.412 --> 00:16.640 align:middle line:90%
about IKE phase 1,
who the key server is,

8
00:16.640 --> 00:18.380 align:middle line:90%
and which interface
to pay attention

9
00:18.380 --> 00:20.707 align:middle line:90%
to regarding encrypting
and decrypting traffic.

10
00:20.707 --> 00:21.290 align:middle line:84%
And that's it.

11
00:21.290 --> 00:23.810 align:middle line:90%
All the policy and details
will be rained down

12
00:23.810 --> 00:25.958 align:middle line:90%
from the key server
to the group member.

13
00:25.958 --> 00:27.500 align:middle line:90%
So to calibrate
where we're at, we've

14
00:27.500 --> 00:32.392 align:middle line:90%
got R1, R2, and R3 that are
going to be GMs, Group Members.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.500 --> 00:32.392 align:middle line:90%
got R1, R2, and R3 that are
going to be GMs, Group Members.

15
00:32.392 --> 00:33.850 align:middle line:90%
So we're going to
need to configure

16
00:33.850 --> 00:36.760 align:middle line:90%
IKE phase 1 policies that are
compatible with the key server

17
00:36.760 --> 00:38.990 align:middle line:90%
so we can build that
secure channel with it.

18
00:38.990 --> 00:41.383 align:middle line:90%
We also need to specify what
group we intend on joining.

19
00:41.383 --> 00:43.300 align:middle line:90%
So when we talk to the
key server, we can say,

20
00:43.300 --> 00:45.050 align:middle line:90%
hey, we're supposed
to join this group.

21
00:45.050 --> 00:47.480 align:middle line:90%
The other element is we're
going to apply a crypto

22
00:47.480 --> 00:50.877 align:middle line:90%
map to the transport
network interfaces.

23
00:50.877 --> 00:53.210 align:middle line:90%
So if this is our MPLS network
and we've got our service

24
00:53.210 --> 00:56.870 align:middle line:90%
provider for our PEs here
and R2 is a customer edge,

25
00:56.870 --> 00:59.840 align:middle line:90%
we would want to apply
that crypto map to 0/2.

26
00:59.840 --> 01:02.510 align:middle line:90%
On R1 we're going
to apply it to 0/1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.840 --> 01:02.510 align:middle line:90%
On R1 we're going
to apply it to 0/1.

27
01:02.510 --> 01:04.610 align:middle line:84%
And R3 is going to be 0/3.

28
01:04.610 --> 01:07.010 align:middle line:90%
So that's really the
biggest difference

29
01:07.010 --> 01:09.800 align:middle line:90%
between the configuration
of these three group members

30
01:09.800 --> 01:12.450 align:middle line:84%
is what interface gets--

31
01:12.450 --> 01:15.590 align:middle line:90%
G-E-Ts-- what interface
gets the crypto map that

32
01:15.590 --> 01:17.510 align:middle line:90%
actually applies
this policy as they

33
01:17.510 --> 01:19.790 align:middle line:90%
encrypt and decrypt
traffic using the rules

34
01:19.790 --> 01:22.160 align:middle line:90%
pushed down to them
from the key server.

35
01:22.160 --> 01:23.660 align:middle line:90%
So let's take a
look at the configs,

36
01:23.660 --> 01:24.702 align:middle line:84%
and then we'll deploy it.

37
01:24.702 --> 01:26.118 align:middle line:90%
So if we were going
to take a look

38
01:26.118 --> 01:27.740 align:middle line:90%
at the full config
for a group member,

39
01:27.740 --> 01:29.753 align:middle line:84%
this is the IKE phase 1 policy.

40
01:29.753 --> 01:30.920 align:middle line:84%
There is the pre-shared key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.753 --> 01:30.920 align:middle line:84%
There is the pre-shared key.

41
01:30.920 --> 01:34.093 align:middle line:90%
So all of this is identical to
what's over on the key server.

42
01:34.093 --> 01:35.510 align:middle line:90%
And then what we're
going to do is

43
01:35.510 --> 01:38.240 align:middle line:90%
we are going to create
this gdoi group.

44
01:38.240 --> 01:40.090 align:middle line:84%
We'll name it GETVPN-Group.

45
01:40.090 --> 01:41.840 align:middle line:90%
We're going to do the
identity number that

46
01:41.840 --> 01:44.840 align:middle line:90%
matches the gdoi group that
we have on the key server.

47
01:44.840 --> 01:47.220 align:middle line:90%
And then we're going to
specify who the key server is.

48
01:47.220 --> 01:48.380 align:middle line:84%
Bada bing, bada boom.

49
01:48.380 --> 01:50.900 align:middle line:90%
So once we have this
group defined we are then

50
01:50.900 --> 01:52.430 align:middle line:84%
going to create a crypto map.

51
01:52.430 --> 01:54.680 align:middle line:90%
Now, you might think, wow,
we created crypto maps for,

52
01:54.680 --> 01:57.970 align:middle line:90%
like, the legacy site-to-site
VPN tunnels with IPsec.

53
01:57.970 --> 01:58.470 align:middle line:84%
We did.

54
01:58.470 --> 02:00.980 align:middle line:90%
But instead of using the ISAKMP
option with the crypto map,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.470 --> 02:00.980 align:middle line:90%
But instead of using the ISAKMP
option with the crypto map,

55
02:00.980 --> 02:01.640 align:middle line:84%
check this out.

56
02:01.640 --> 02:03.200 align:middle line:84%
We are going to specify gdoi.

57
02:03.200 --> 02:06.350 align:middle line:90%
So this is sequence number 10 in
this crypto map called GM-Map.

58
02:06.350 --> 02:07.410 align:middle line:84%
And we're using gdoi.

59
02:07.410 --> 02:09.160 align:middle line:90%
And then we're going
to specify the group.

60
02:09.160 --> 02:11.150 align:middle line:90%
So that group we
created we'll just

61
02:11.150 --> 02:13.520 align:middle line:90%
pop right there, which
includes the identity

62
02:13.520 --> 02:15.830 align:middle line:90%
number for that group, and
also the key server address.

63
02:15.830 --> 02:18.980 align:middle line:90%
Then we're going to go to
that exit interface of g0/1.

64
02:18.980 --> 02:22.610 align:middle line:90%
And we're going to apply that
crypto map, crypto map GM-Map.

65
02:22.610 --> 02:25.170 align:middle line:90%
And then once we do that,
this router is going to go,

66
02:25.170 --> 02:28.010 align:middle line:90%
whoa, I need to go ahead and I
need to talk to the key server.

67
02:28.010 --> 02:30.770 align:middle line:90%
It's going to negotiate
IKE phase 1, rain down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.010 --> 02:30.770 align:middle line:90%
It's going to negotiate
IKE phase 1, rain down

68
02:30.770 --> 02:32.603 align:middle line:90%
all the information,
including the policies.

69
02:32.603 --> 02:34.895 align:middle line:90%
And once it does so, it'll
be a fully functional member

70
02:34.895 --> 02:37.010 align:middle line:90%
with all the keys and
crypto ACLs and everything

71
02:37.010 --> 02:40.070 align:middle line:90%
it needs to implement
the GET VPN encryption.

72
02:40.070 --> 02:41.960 align:middle line:90%
So let's take that
configuration.

73
02:41.960 --> 02:44.000 align:middle line:84%
We'll copy it, and we'll get R1.

74
02:44.000 --> 02:45.680 align:middle line:84%
And we will paste it in.

75
02:45.680 --> 02:46.830 align:middle line:84%
Look at that.

76
02:46.830 --> 02:48.920 align:middle line:90%
So it says right
here, TEK_UPDATED.

77
02:48.920 --> 02:51.290 align:middle line:90%
That's the Traffic
Encryption Key.

78
02:51.290 --> 02:53.030 align:middle line:90%
The KEK is the
Key Encryption Key

79
02:53.030 --> 02:55.010 align:middle line:90%
that we're going to
use for the rekeying.

80
02:55.010 --> 02:57.815 align:middle line:90%
It registered with the
key server right there.

81
02:57.815 --> 03:00.260 align:middle line:90%
It registered to key
server at 4.4.4.4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:57.815 --> 03:00.260 align:middle line:90%
It registered to key
server at 4.4.4.4.

82
03:00.260 --> 03:03.438 align:middle line:84%
And it installed policies.

83
03:03.438 --> 03:04.980 align:middle line:90%
I love it when a
plan comes together.

84
03:04.980 --> 03:12.288 align:middle line:90%
Let's do a show crypto
and gdoi, and press Enter.

85
03:12.288 --> 03:13.580 align:middle line:84%
So it shows the group identity.

86
03:13.580 --> 03:14.990 align:middle line:84%
It shows the name of the group.

87
03:14.990 --> 03:18.380 align:middle line:90%
It has the sever
list of 4.4.4.4.

88
03:18.380 --> 03:21.040 align:middle line:90%
Here it's showing us the
details about its IP address.

89
03:21.040 --> 03:22.310 align:middle line:84%
This is R1's address.

90
03:22.310 --> 03:24.020 align:middle line:84%
And UDP port 848.

91
03:24.020 --> 03:27.170 align:middle line:90%
And it's communicating
with the server at 4.4.4.4

92
03:27.170 --> 03:28.263 align:middle line:84%
also using 848.

93
03:28.263 --> 03:29.930 align:middle line:90%
So if we were using
a protocol analyzer,

94
03:29.930 --> 03:33.890 align:middle line:90%
we'd see UDP packets
with port 848 being used.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.930 --> 03:33.890 align:middle line:90%
we'd see UDP packets
with port 848 being used.

95
03:33.890 --> 03:35.000 align:middle line:84%
It's currently registered.

96
03:35.000 --> 03:35.870 align:middle line:84%
Fantastic.

97
03:35.870 --> 03:37.880 align:middle line:90%
And if we continue
scrolling down,

98
03:37.880 --> 03:41.210 align:middle line:90%
here it has the access list
that it got from the key server.

99
03:41.210 --> 03:43.070 align:middle line:84%
Traffic from 10 going 10.

100
03:43.070 --> 03:44.700 align:middle line:90%
So for the key
encryption key policy,

101
03:44.700 --> 03:45.950 align:middle line:84%
we didn't really specify that.

102
03:45.950 --> 03:47.242 align:middle line:84%
I'm checking the defaults here.

103
03:47.242 --> 03:49.370 align:middle line:90%
We specified an
IKE phase 1 policy.

104
03:49.370 --> 03:51.710 align:middle line:90%
We also did the IKE phase
2 or IPsec policy up

105
03:51.710 --> 03:53.550 align:middle line:84%
on the key server.

106
03:53.550 --> 03:56.480 align:middle line:90%
But as far as the KEK policy,
it just took the defaults,

107
03:56.480 --> 03:59.370 align:middle line:84%
including 3DES and the hashing.

108
03:59.370 --> 04:01.100 align:middle line:90%
That's for the
private conversation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
03:59.370 --> 04:01.100 align:middle line:90%
That's for the
private conversation

109
04:01.100 --> 04:03.350 align:middle line:90%
during rekeying that's going
to happen between a group

110
04:03.350 --> 04:04.942 align:middle line:84%
member and the key server.

111
04:04.942 --> 04:07.400 align:middle line:90%
And then going down here to
the TEK, the Traffic Encryption

112
04:07.400 --> 04:11.250 align:middle line:90%
Key, that's based on the
IPsec profile that we created,

113
04:11.250 --> 04:13.560 align:middle line:90%
including the transform
set that's in that profile.

114
04:13.560 --> 04:15.350 align:middle line:90%
So on the transform
set on the key server,

115
04:15.350 --> 04:17.690 align:middle line:90%
we specified AES 128,
which is the default here.

116
04:17.690 --> 04:19.410 align:middle line:90%
That's why it's not
showing the number.

117
04:19.410 --> 04:21.829 align:middle line:90%
And we also specified
esp-sha-hmac.

118
04:21.829 --> 04:26.090 align:middle line:90%
It also has the time
remaining of 3,569 seconds.

119
04:26.090 --> 04:29.330 align:middle line:90%
And that's because we specified
for IPsec of the key server

120
04:29.330 --> 04:31.073 align:middle line:84%
we specified 3,600 seconds.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:29.330 --> 04:31.073 align:middle line:84%
we specified 3,600 seconds.

121
04:31.073 --> 04:32.240 align:middle line:84%
And so the clock is ticking.

122
04:32.240 --> 04:34.240 align:middle line:90%
And the life time is
getting shorter and shorter

123
04:34.240 --> 04:35.580 align:middle line:84%
as we go forward.

124
04:35.580 --> 04:37.997 align:middle line:90%
And then the anti-replay,
we specified 5 seconds.

125
04:37.997 --> 04:40.080 align:middle line:90%
And that's why it's showing
up right here as well.

126
04:40.080 --> 04:41.622 align:middle line:90%
So with that in
place, let's go ahead

127
04:41.622 --> 04:44.390 align:middle line:90%
and do the other two
group members, R2 and R3.

128
04:44.390 --> 04:46.100 align:middle line:90%
Virtually identical
configurations,

129
04:46.100 --> 04:50.000 align:middle line:90%
except we are going to specify
the correct egress interface,

130
04:50.000 --> 04:52.550 align:middle line:90%
the interface that's facing
the transport network.

131
04:52.550 --> 04:55.340 align:middle line:90%
And for router 2, we'll
take the exact same config.

132
04:55.340 --> 04:57.440 align:middle line:90%
The only difference here
is that the interface

133
04:57.440 --> 04:59.990 align:middle line:90%
we're applying the crypto
map is going to be g0/2.

134
04:59.990 --> 05:03.560 align:middle line:90%
So I'll right-click,
copy, and paste that in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
04:59.990 --> 05:03.560 align:middle line:90%
So I'll right-click,
copy, and paste that in.

135
05:03.560 --> 05:04.100 align:middle line:84%
Awesome.

136
05:04.100 --> 05:06.140 align:middle line:90%
We have very positive
messages there regarding

137
05:06.140 --> 05:08.880 align:middle line:90%
getting the keys
involved, and the policy.

138
05:08.880 --> 05:11.580 align:middle line:90%
And let's go to R3
and do the same thing.

139
05:11.580 --> 05:13.760 align:middle line:90%
So here on R3, we'll
take that configuration.

140
05:13.760 --> 05:15.177 align:middle line:90%
Again, the only
difference here is

141
05:15.177 --> 05:18.285 align:middle line:90%
that we're going to g0/3
to apply the crypto map.

142
05:18.285 --> 05:20.720 align:middle line:90%
We'll copy that,
and paste it in.

143
05:20.720 --> 05:23.010 align:middle line:90%
And sure enough, we
start the registration.

144
05:23.010 --> 05:25.250 align:middle line:90%
We got the TEK, the
Traffic Encryption Key.

145
05:25.250 --> 05:27.530 align:middle line:90%
We got the KEK, the
Key Encryption Key.

146
05:27.530 --> 05:29.150 align:middle line:84%
Registration was successful.

147
05:29.150 --> 05:31.530 align:middle line:90%
And we also got the
policies installed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:29.150 --> 05:31.530 align:middle line:90%
And we also got the
policies installed.

148
05:31.530 --> 05:36.560 align:middle line:90%
So if we were to do a
show crypto gdoi or we

149
05:36.560 --> 05:38.270 align:middle line:90%
could use a question
mark, and we

150
05:38.270 --> 05:41.620 align:middle line:90%
could do like a GM for Group
Membership, and press Enter.

151
05:41.620 --> 05:43.790 align:middle line:90%
And that shows us that we
are a member of the group.

152
05:43.790 --> 05:46.415 align:middle line:90%
In the previous video, we looked
at the master of all the keys,

153
05:46.415 --> 05:47.990 align:middle line:84%
and that is the key server.

154
05:47.990 --> 05:50.390 align:middle line:90%
In this video, we
configured the group members

155
05:50.390 --> 05:51.555 align:middle line:84%
to talk to the key server.

156
05:51.555 --> 05:53.180 align:middle line:90%
And in the next video,
I'd like to walk

157
05:53.180 --> 05:55.370 align:middle line:90%
through some
additional verification

158
05:55.370 --> 05:57.988 align:middle line:90%
that the GET VPN is
actually working.

159
05:57.988 --> 06:00.030 align:middle line:90%
I'll see you in that next
video in just a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
05:57.988 --> 06:00.030 align:middle line:90%
I'll see you in that next
video in just a moment.

160
06:00.030 --> 06:02.420 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

161
06:02.420 --> 06:05.610 align:middle line:90%
And I'd like to thank
you for viewing.