WEBVTT

1
00:00.000 --> 00:01.015 align:middle line:84%


2
00:01.015 --> 00:03.390 align:middle line:90%
In this video, I'd like to
sit down with you for a moment

3
00:03.390 --> 00:05.460 align:middle line:90%
and let's do some
planning on the details

4
00:05.460 --> 00:07.890 align:middle line:90%
that we'll use for a
site-to-site VPN using

5
00:07.890 --> 00:09.485 align:middle line:84%
FlexVPN and IPsec.

6
00:09.485 --> 00:10.860 align:middle line:90%
And then in the
next video, we'll

7
00:10.860 --> 00:12.850 align:middle line:84%
actually implement our plan.

8
00:12.850 --> 00:14.730 align:middle line:90%
So, here's what I
recommend we do.

9
00:14.730 --> 00:18.240 align:middle line:90%
Based on the previous video
the IKEv2 policy, which

10
00:18.240 --> 00:21.388 align:middle line:90%
is wide open, the
default policy,

11
00:21.388 --> 00:23.430 align:middle line:90%
that'll work for our
purposes, so let's use that.

12
00:23.430 --> 00:24.950 align:middle line:84%
It basically says the--

13
00:24.950 --> 00:26.790 align:middle line:84%
D-E-A-F-U, L, T, there we go--

14
00:26.790 --> 00:29.050 align:middle line:90%
the default IKE
version 2 policy says,

15
00:29.050 --> 00:31.830 align:middle line:90%
you know what I'm willing to
use from any front door VRF that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.050 --> 00:31.830 align:middle line:90%
you know what I'm willing to
use from any front door VRF that

16
00:31.830 --> 00:33.830 align:middle line:90%
will work, any IP
address, and I'm

17
00:33.830 --> 00:35.590 align:middle line:84%
going use the default proposal.

18
00:35.590 --> 00:39.750 align:middle line:90%
OK, great so we'll just use
that default IKEv2 policy,

19
00:39.750 --> 00:41.350 align:middle line:90%
we don't have to
modify it at all.

20
00:41.350 --> 00:44.310 align:middle line:90%
Now, that default policy
is pointing and using

21
00:44.310 --> 00:45.480 align:middle line:84%
the default proposal.

22
00:45.480 --> 00:48.750 align:middle line:90%
Which, what I'd like to do
is let's use that default

23
00:48.750 --> 00:50.610 align:middle line:84%
proposal, but let's tweak it.

24
00:50.610 --> 00:52.860 align:middle line:90%
Let's modify that
default proposal

25
00:52.860 --> 00:57.450 align:middle line:90%
and let's use Diffie-Hellman
group 16 because that currently

26
00:57.450 --> 00:59.310 align:middle line:84%
is not in the set of proposals.

27
00:59.310 --> 01:03.180 align:middle line:90%
I'd like it to be, so let's
modify the default proposal
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.310 --> 01:03.180 align:middle line:90%
I'd like it to be, so let's
modify the default proposal

28
01:03.180 --> 01:06.240 align:middle line:90%
and we'll tell it to include
Diffie-Hellman group 16.

29
01:06.240 --> 01:10.380 align:middle line:90%
For the profile on these
routers, router 1 and router 2,

30
01:10.380 --> 01:12.570 align:middle line:84%
let's specify a few basics.

31
01:12.570 --> 01:14.798 align:middle line:90%
Let's say that we're
going to do some matching

32
01:14.798 --> 01:16.590 align:middle line:90%
and let's match on each
other's IP address.

33
01:16.590 --> 01:23.250 align:middle line:90%
So let's match on 25.2.2.2
and R2 will match on 15.1.1.1.

34
01:23.250 --> 01:25.320 align:middle line:90%
and if that's a
match, let's also

35
01:25.320 --> 01:27.700 align:middle line:90%
specify that for
authentication we're

36
01:27.700 --> 01:29.670 align:middle line:84%
going to use pre-shared keys.

37
01:29.670 --> 01:32.100 align:middle line:90%
And as part of that
configuration for the profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.670 --> 01:32.100 align:middle line:90%
And as part of that
configuration for the profile

38
01:32.100 --> 01:33.990 align:middle line:84%
we will specify a keyring.

39
01:33.990 --> 01:37.110 align:middle line:90%
Now, the keyring, which is
going to be called upon,

40
01:37.110 --> 01:38.610 align:middle line:84%
we need to create that too.

41
01:38.610 --> 01:44.100 align:middle line:90%
So, let's create a keyring and
we can just call it IOS-Keys.

42
01:44.100 --> 01:46.950 align:middle line:90%
And inside that keyring we'll
specify the pre-shared key

43
01:46.950 --> 01:48.563 align:middle line:90%
we want them to use
with each other.

44
01:48.563 --> 01:50.980 align:middle line:90%
And the keys, you can also
specify a local and remote key,

45
01:50.980 --> 01:53.400 align:middle line:90%
so you can have R1 use
one key for authenticating

46
01:53.400 --> 01:56.790 align:middle line:90%
R2 and R2 can use a different
key for authenticating R1.

47
01:56.790 --> 01:59.290 align:middle line:90%
They could be symmetrical and
that's what we're going to do,

48
01:59.290 --> 02:00.373 align:middle line:84%
but they don't have to be.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.290 --> 02:00.373 align:middle line:84%
but they don't have to be.

49
02:00.373 --> 02:03.180 align:middle line:90%
You can actually specify a
local and remote password

50
02:03.180 --> 02:05.580 align:middle line:90%
that you're going to use
as part of the keyring.

51
02:05.580 --> 02:08.490 align:middle line:90%
And then for the IPsec
profile down here,

52
02:08.490 --> 02:11.850 align:middle line:90%
let's create a transform set
so we're not using the default.

53
02:11.850 --> 02:15.390 align:middle line:90%
And for encryption
let's use AES-256

54
02:15.390 --> 02:19.710 align:middle line:90%
and for data integrity let's use
HMAC, which is hashed message

55
02:19.710 --> 02:23.550 align:middle line:90%
authentication code, we'll
use SHA-512 because all

56
02:23.550 --> 02:25.260 align:middle line:84%
my routers will support those.

57
02:25.260 --> 02:27.060 align:middle line:90%
In the proposals
for IKEv2 it's also

58
02:27.060 --> 02:30.490 align:middle line:90%
going to have information about
encryption and data integrity.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:27.060 --> 02:30.490 align:middle line:90%
going to have information about
encryption and data integrity.

59
02:30.490 --> 02:34.350 align:middle line:90%
So, I want to point out that
even though this is IKEv2,

60
02:34.350 --> 02:38.420 align:middle line:90%
the proposals up here are for
the IKEv2 security association

61
02:38.420 --> 02:42.150 align:middle line:90%
and the proposals down here are
for the actual IPsec security

62
02:42.150 --> 02:42.988 align:middle line:84%
association.

63
02:42.988 --> 02:45.030 align:middle line:90%
So, it's a lot like if
you whisper and don't tell

64
02:45.030 --> 02:47.040 align:middle line:90%
too many people, it's a
lot like the IKE phase

65
02:47.040 --> 02:49.650 align:middle line:90%
one elements for encryption
and IKE phase two,

66
02:49.650 --> 02:52.350 align:middle line:90%
but because it's IKE
version 2, we now just

67
02:52.350 --> 02:55.260 align:middle line:90%
call it the IKE version 2
security association and then

68
02:55.260 --> 02:57.540 align:middle line:84%
the IPsec security association.

69
02:57.540 --> 02:59.340 align:middle line:90%
But we could have
different encryptions

70
02:59.340 --> 03:02.130 align:middle line:90%
and different hashing
for each of those sets.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:59.340 --> 03:02.130 align:middle line:90%
and different hashing
for each of those sets.

71
03:02.130 --> 03:04.470 align:middle line:90%
And then as part of
our IPsec profile

72
03:04.470 --> 03:08.100 align:middle line:90%
we'll specify that we want
to include, or specify

73
03:08.100 --> 03:11.010 align:middle line:90%
this profile which says who are
matching with who the keys will

74
03:11.010 --> 03:12.990 align:middle line:90%
be, and that way we
can actually build

75
03:12.990 --> 03:14.800 align:middle line:84%
the IPsec tunnel between them.

76
03:14.800 --> 03:17.340 align:middle line:90%
Also, one other element
that we want to plan on,

77
03:17.340 --> 03:20.680 align:middle line:90%
we could use VTIs,
virtual tunnel interfaces,

78
03:20.680 --> 03:22.355 align:middle line:90%
which is just making
a tunnel interface.

79
03:22.355 --> 03:23.730 align:middle line:90%
And then on that
tunnel interface

80
03:23.730 --> 03:25.890 align:middle line:90%
the default
encapsulation is GRE,

81
03:25.890 --> 03:29.040 align:middle line:90%
but if we use the
tunnel mode IPsec,

82
03:29.040 --> 03:34.020 align:middle line:90%
space IPv4, then instead of
using GRE it'll just use IPsec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:29.040 --> 03:34.020 align:middle line:90%
space IPv4, then instead of
using GRE it'll just use IPsec.

83
03:34.020 --> 03:36.100 align:middle line:90%
So, as a plan let's
do that as well.

84
03:36.100 --> 03:38.220 align:middle line:90%
So, as we specify that
tunnel motive IPsec

85
03:38.220 --> 03:40.747 align:middle line:90%
we'll also apply
the IPsec profile

86
03:40.747 --> 03:42.330 align:middle line:90%
to that tunnel
interface so it'll know

87
03:42.330 --> 03:43.990 align:middle line:84%
how to protect the traffic.

88
03:43.990 --> 03:45.570 align:middle line:90%
So, with that plan
in mind, I'd like

89
03:45.570 --> 03:47.280 align:middle line:90%
to walk you through
in the next video

90
03:47.280 --> 03:51.330 align:middle line:90%
step by step the implementation
of those components

91
03:51.330 --> 03:53.010 align:middle line:84%
as part of FlexVPN.

92
03:53.010 --> 03:55.900 align:middle line:90%
So, I look forward to seeing
you there in just a moment.

93
03:55.900 --> 03:58.260 align:middle line:90%
Meanwhile, I hope this has
been informative for you

94
03:58.260 --> 04:01.520 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:58.260 --> 04:01.520 align:middle line:90%
and I'd like to thank
you for viewing.