WEBVTT

1
00:00.000 --> 00:01.220 align:middle line:84%


2
00:01.220 --> 00:03.650 align:middle line:90%
One of the challenges
of working with FlexVPN

3
00:03.650 --> 00:06.500 align:middle line:90%
is that there are a lot of
individual pieces and parts

4
00:06.500 --> 00:09.530 align:middle line:90%
that can be tweaked or modified,
and that's partly also in place

5
00:09.530 --> 00:11.540 align:middle line:84%
because it uses IKE version 2.

6
00:11.540 --> 00:13.328 align:middle line:90%
So what I'd like
to do in this video

7
00:13.328 --> 00:14.870 align:middle line:90%
is walk you through
and introduce you

8
00:14.870 --> 00:17.600 align:middle line:90%
to some of those components and
pieces regarding IKE version

9
00:17.600 --> 00:21.170 align:middle line:90%
2, which is heavily
relied on by FlexVPN.

10
00:21.170 --> 00:24.320 align:middle line:90%
So let's begin by taking a look
at IKEv2 specific components

11
00:24.320 --> 00:26.780 align:middle line:90%
in the configs that if
we're using the defaults,

12
00:26.780 --> 00:28.080 align:middle line:84%
we still want to be aware of.

13
00:28.080 --> 00:29.390 align:middle line:84%
So let's take a look at these.

14
00:29.390 --> 00:31.020 align:middle line:84%
We'll just do one at a time.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.390 --> 00:31.020 align:middle line:84%
We'll just do one at a time.

15
00:31.020 --> 00:32.509 align:middle line:84%
And let's start with policy.

16
00:32.509 --> 00:36.962 align:middle line:90%
What exactly is an IKEv2 policy,
and do I need to create one?

17
00:36.962 --> 00:39.170 align:middle line:90%
Let's take a look at what
the default is, and then we

18
00:39.170 --> 00:41.780 align:middle line:90%
can make a decision-- do we need
to create one or modify that,

19
00:41.780 --> 00:44.630 align:middle line:90%
or can we use the
default IKEv2 policy?

20
00:44.630 --> 00:46.250 align:middle line:90%
So on a router and
this router has not

21
00:46.250 --> 00:48.270 align:middle line:90%
been configured with
IKE version 2 yet.

22
00:48.270 --> 00:52.100 align:middle line:90%
So we do a show crypto and
IKEv2 and a question mark.

23
00:52.100 --> 00:56.010 align:middle line:90%
And let's go ahead and ask for
seeing the policies that exist.

24
00:56.010 --> 00:59.390 align:middle line:90%
So we do a show crypto IKEv2
policy and press Enter.

25
00:59.390 --> 01:01.010 align:middle line:84%
That is the default policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.390 --> 01:01.010 align:middle line:84%
That is the default policy.

26
01:01.010 --> 01:02.460 align:middle line:84%
Da-da-da-da!

27
01:02.460 --> 01:05.840 align:middle line:90%
So here are the details for
the default IKEv2 policy--

28
01:05.840 --> 01:07.460 align:middle line:84%
Match front door VRF.

29
01:07.460 --> 01:09.800 align:middle line:90%
So if you're using
VRFs, and you're

30
01:09.800 --> 01:14.385 align:middle line:90%
specifying one VRF that you want
to use for your IKEv2 policy,

31
01:14.385 --> 01:15.260 align:middle line:84%
you can specify that.

32
01:15.260 --> 01:18.110 align:middle line:90%
But by default, it
says any VRFs will do.

33
01:18.110 --> 01:19.070 align:middle line:84%
Match address?

34
01:19.070 --> 01:19.730 align:middle line:84%
Any address.

35
01:19.730 --> 01:20.430 align:middle line:84%
I don't care.

36
01:20.430 --> 01:21.500 align:middle line:84%
And the proposal?

37
01:21.500 --> 01:24.920 align:middle line:90%
Default. So what this
IKEv2 policy says

38
01:24.920 --> 01:27.770 align:middle line:90%
is that I'm really
open, and I want

39
01:27.770 --> 01:30.680 align:middle line:90%
to use a proposal
called default.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:27.770 --> 01:30.680 align:middle line:90%
to use a proposal
called default.

40
01:30.680 --> 01:34.760 align:middle line:90%
Now the next question is, what
is the IKEv2 proposal default,

41
01:34.760 --> 01:36.708 align:middle line:84%
and what does it include?

42
01:36.708 --> 01:37.500 align:middle line:84%
I'm glad you asked.

43
01:37.500 --> 01:38.700 align:middle line:84%
That's next on our list.

44
01:38.700 --> 01:39.600 align:middle line:84%
Let's take a look.

45
01:39.600 --> 01:42.050 align:middle line:90%
So the proposals are
about the negotiation,

46
01:42.050 --> 01:45.650 align:middle line:90%
what we're willing to use
for the IKEv2 SA, which

47
01:45.650 --> 01:48.935 align:middle line:90%
is another way of saying the
security association for IKEv2.

48
01:48.935 --> 01:52.340 align:middle line:90%
So we're going to specify or
use the defaults regarding

49
01:52.340 --> 01:56.420 align:middle line:90%
encryption and hashing and
also the Diffie-Hellman Group.

50
01:56.420 --> 01:58.940 align:middle line:90%
And if we want to see what
the default proposal is,

51
01:58.940 --> 02:01.320 align:middle line:90%
we can just go to the
CLI and take a look.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.940 --> 02:01.320 align:middle line:90%
we can just go to the
CLI and take a look.

52
02:01.320 --> 02:03.500 align:middle line:90%
So the default policy
says that we want

53
02:03.500 --> 02:04.820 align:middle line:84%
to use the default proposal.

54
02:04.820 --> 02:06.325 align:middle line:90%
So to see the
default proposal, we

55
02:06.325 --> 02:09.710 align:middle line:90%
do to show crypto
IKEv2 and proposal.

56
02:09.710 --> 02:11.150 align:middle line:84%
And there it is.

57
02:11.150 --> 02:13.970 align:middle line:90%
So what this says is that
regarding encryption we're

58
02:13.970 --> 02:18.620 align:middle line:90%
willing to do AES 256,
AES 192, and AES 128.

59
02:18.620 --> 02:20.480 align:middle line:90%
For data integrity,
we're willing to do

60
02:20.480 --> 02:22.040 align:middle line:84%
SHA in these flavors.

61
02:22.040 --> 02:24.770 align:middle line:90%
The PRF is a pseudo-random
function that's used.

62
02:24.770 --> 02:26.400 align:middle line:90%
And here's the
Diffie-Hellman Group.

63
02:26.400 --> 02:28.490 align:middle line:90%
So here we have Diffie-Hellman
Group five and also

64
02:28.490 --> 02:29.930 align:middle line:84%
Diffie-Hellman Group two.

65
02:29.930 --> 02:31.427 align:middle line:90%
So if we're OK with
those proposals
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.930 --> 02:31.427 align:middle line:90%
So if we're OK with
those proposals

66
02:31.427 --> 02:33.510 align:middle line:90%
we don't need to tweak
them, but we could do this.

67
02:33.510 --> 02:36.650 align:middle line:90%
We could either create a
brand new IKEv2 proposal

68
02:36.650 --> 02:38.120 align:middle line:84%
and specify that to be used.

69
02:38.120 --> 02:42.080 align:middle line:90%
Or we could modify the default,
and it'll give us a warning too

70
02:42.080 --> 02:42.710 align:middle line:84%
if we do that.

71
02:42.710 --> 02:45.062 align:middle line:90%
But we could modify the
default and specify, hey,

72
02:45.062 --> 02:47.270 align:middle line:90%
you know what we want to
use Diffie-Hellman Group 16,

73
02:47.270 --> 02:50.510 align:middle line:90%
and then that would become part
of the default IKEv2 proposal.

74
02:50.510 --> 02:52.980 align:middle line:90%
Now, next on our
list is a profile.

75
02:52.980 --> 02:56.810 align:middle line:90%
So there is a default policy,
there's a default proposal,

76
02:56.810 --> 02:58.820 align:middle line:90%
but regarding the
profile itself,

77
02:58.820 --> 03:00.230 align:middle line:84%
there's no default profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:58.820 --> 03:00.230 align:middle line:84%
there's no default profile.

78
03:00.230 --> 03:03.290 align:middle line:90%
A profile is going to specify
the details for the router.

79
03:03.290 --> 03:06.110 align:middle line:90%
It could include things
such as the local identity

80
03:06.110 --> 03:08.540 align:middle line:90%
of this device based
on IP, or if we're

81
03:08.540 --> 03:11.072 align:middle line:90%
using digital certificates,
like a fully qualified domain

82
03:11.072 --> 03:12.530 align:middle line:90%
name or other
elements, then we can

83
03:12.530 --> 03:14.910 align:middle line:84%
specify for the device itself.

84
03:14.910 --> 03:18.750 align:middle line:90%
It can also specify in a profile
a match statement saying, OK,

85
03:18.750 --> 03:20.240 align:middle line:90%
I want to use this
profile if I'm

86
03:20.240 --> 03:23.180 align:middle line:90%
matching with a peer
at this IP address

87
03:23.180 --> 03:26.930 align:middle line:90%
or a peer using this fully
qualified domain name or a peer

88
03:26.930 --> 03:28.680 align:middle line:84%
with a certain email address.

89
03:28.680 --> 03:30.320 align:middle line:90%
So if we're using
RSA signature, and we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:28.680 --> 03:30.320 align:middle line:90%
So if we're using
RSA signature, and we

90
03:30.320 --> 03:32.320 align:middle line:90%
have digital certificates
that are being shared,

91
03:32.320 --> 03:34.465 align:middle line:90%
we can pull and match
on that detail as well.

92
03:34.465 --> 03:35.840 align:middle line:90%
And then, as part
of the profile,

93
03:35.840 --> 03:38.090 align:middle line:90%
we can also say, OK,
great based on matching

94
03:38.090 --> 03:40.430 align:middle line:90%
with this peer I want
to go ahead and use

95
03:40.430 --> 03:41.990 align:middle line:84%
this specific key.

96
03:41.990 --> 03:44.990 align:middle line:90%
Except in IKE version
2, we don't just

97
03:44.990 --> 03:47.558 align:middle line:90%
specify the key we
actually point to a keyring

98
03:47.558 --> 03:48.350 align:middle line:84%
think of a keyring.

99
03:48.350 --> 03:50.420 align:middle line:90%
Think of a keyring
like a set of keys

100
03:50.420 --> 03:53.250 align:middle line:90%
that you can pull out on
a single ring and use it.

101
03:53.250 --> 03:55.310 align:middle line:90%
So if you had 15
different peers,

102
03:55.310 --> 03:58.040 align:middle line:90%
and you had 15 different sets
of keys, pre-shared keys you're

103
03:58.040 --> 04:00.480 align:middle line:90%
going to use, you can have
15 different keyrings,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.040 --> 04:00.480 align:middle line:90%
going to use, you can have
15 different keyrings,

104
04:00.480 --> 04:03.230 align:middle line:90%
and you just pick from the
right keyring or authenticating

105
04:03.230 --> 04:04.160 align:middle line:84%
with that peer.

106
04:04.160 --> 04:06.800 align:middle line:90%
Now, in addition to our
IKEv2 specific information

107
04:06.800 --> 04:09.830 align:middle line:90%
that we just went over, we
also have our IPsec profiles.

108
04:09.830 --> 04:12.140 align:middle line:90%
Now, IPsec profiles are
very similar to what

109
04:12.140 --> 04:14.130 align:middle line:84%
we had with IKE version 1.

110
04:14.130 --> 04:17.279 align:middle line:90%
So we have a transform
set or we use the default.

111
04:17.279 --> 04:21.620 align:middle line:90%
We can also refer in an IPsec
profile, which IKE version 2

112
04:21.620 --> 04:23.430 align:middle line:84%
profile we want to use.

113
04:23.430 --> 04:25.280 align:middle line:90%
So that way, if we
apply an IPsec profile

114
04:25.280 --> 04:27.830 align:middle line:90%
to let's say a tunnel interface,
tunnel interface 0 right

115
04:27.830 --> 04:31.340 align:middle line:90%
here, when it's out negotiating
and talking with other devices,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:27.830 --> 04:31.340 align:middle line:90%
here, when it's out negotiating
and talking with other devices,

116
04:31.340 --> 04:34.340 align:middle line:90%
it knows the IPsec
profile it should use,

117
04:34.340 --> 04:36.480 align:middle line:90%
which includes who it's
going to match with.

118
04:36.480 --> 04:38.408 align:middle line:90%
And based on that,
what keyrings it's

119
04:38.408 --> 04:40.700 align:middle line:90%
expecting to use for that
authentication if we're doing

120
04:40.700 --> 04:42.680 align:middle line:90%
pre-shared keys,
or for using RSA

121
04:42.680 --> 04:44.360 align:middle line:90%
signatures and
digital certificates

122
04:44.360 --> 04:45.980 align:middle line:90%
the profile can
have those details

123
04:45.980 --> 04:48.710 align:middle line:90%
as well regarding matching any
authentication with a given

124
04:48.710 --> 04:49.310 align:middle line:84%
peer.

125
04:49.310 --> 04:51.380 align:middle line:90%
Now, if you're thinking,
wow, Keith, that's

126
04:51.380 --> 04:52.865 align:middle line:84%
a lot of pieces and parts.

127
04:52.865 --> 04:53.990 align:middle line:84%
You're right, you're right.

128
04:53.990 --> 04:55.370 align:middle line:90%
It makes a good
business case for

129
04:55.370 --> 04:56.625 align:middle line:84%
Software-Defined networking.

130
04:56.625 --> 04:59.000 align:middle line:90%
In any event, what we're going
to do in the next video is

131
04:59.000 --> 05:01.340 align:middle line:90%
I'd like to walk you
through the design phase
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:59.000 --> 05:01.340 align:middle line:90%
I'd like to walk you
through the design phase

132
05:01.340 --> 05:03.980 align:middle line:90%
for a site the site
tunnel using FlexVPNs.

133
05:03.980 --> 05:07.040 align:middle line:90%
And then, you and I can follow
that up, that design session,

134
05:07.040 --> 05:09.230 align:middle line:90%
with the implementation
to help reinforce

135
05:09.230 --> 05:11.753 align:middle line:90%
the concepts that we're
learning in this set of videos.

136
05:11.753 --> 05:13.920 align:middle line:90%
So I'll see you in that
next video in just a moment.

137
05:13.920 --> 05:16.370 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

138
05:16.370 --> 05:19.690 align:middle line:90%
And I'd like to thank
you for viewing.