WEBVTT

1
00:00.000 --> 00:01.610 align:middle line:84%


2
00:01.610 --> 00:02.160 align:middle line:84%
All right.

3
00:02.160 --> 00:03.360 align:middle line:84%
It is time to configure.

4
00:03.360 --> 00:05.152 align:middle line:90%
We're going to start
our configuration over

5
00:05.152 --> 00:07.722 align:middle line:90%
on R1, which is on the
left-hand side of our topology.

6
00:07.722 --> 00:10.055 align:middle line:90%
And then we'll finish it up
with configuring the FlexVPN

7
00:10.055 --> 00:13.340 align:middle line:90%
and IKEv2 information
over on R2.

8
00:13.340 --> 00:14.630 align:middle line:84%
Let's get to work.

9
00:14.630 --> 00:16.295 align:middle line:90%
Here on R1 I'm going
to go ahead and do

10
00:16.295 --> 00:17.420 align:middle line:84%
just a little housekeeping.

11
00:17.420 --> 00:20.488 align:middle line:90%
I'm adding a loopback address
of 1.1.1.1 for reachability

12
00:20.488 --> 00:22.280 align:middle line:90%
after we have our
routing protocol running.

13
00:22.280 --> 00:24.590 align:middle line:90%
And I'm also setting
the width of the console

14
00:24.590 --> 00:27.980 align:middle line:90%
to 100, because that way if I'm
typing in a fairly long command

15
00:27.980 --> 00:29.160 align:middle line:84%
it won't truncate it.

16
00:29.160 --> 00:30.452 align:middle line:84%
So you can see the whole thing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.160 --> 00:30.452 align:middle line:84%
So you can see the whole thing.

17
00:30.452 --> 00:32.689 align:middle line:90%
We can scroll left and right
to go ahead and see it.

18
00:32.689 --> 00:36.170 align:middle line:90%
Now, we mentioned that we want
to use the default policy.

19
00:36.170 --> 00:39.380 align:middle line:90%
So for IKEv2, let's take a
look at what that policy is.

20
00:39.380 --> 00:43.890 align:middle line:90%
It says, match any front door
VRF, match any local address,

21
00:43.890 --> 00:47.510 align:middle line:90%
and use the IKEv2 proposal
called default. Super.

22
00:47.510 --> 00:49.340 align:middle line:90%
We agree we're going
to leave all that is.

23
00:49.340 --> 00:53.060 align:middle line:90%
And let's also take a
look at the IKEv2 proposal

24
00:53.060 --> 00:55.130 align:middle line:84%
just to confirm what's there.

25
00:55.130 --> 00:58.370 align:middle line:90%
And here is the
proposal for IKEv2.

26
00:58.370 --> 01:01.470 align:middle line:90%
It says, for the IKEv2
security association here's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.370 --> 01:01.470 align:middle line:90%
It says, for the IKEv2
security association here's

27
01:01.470 --> 01:04.220 align:middle line:90%
what I want you to do for
encryption or data integrity.

28
01:04.220 --> 01:06.592 align:middle line:90%
Here's a pseudo random
thing it does as well.

29
01:06.592 --> 01:08.300 align:middle line:90%
And then here's the
Diffie-Hellman group.

30
01:08.300 --> 01:10.640 align:middle line:90%
And we do want to
modify that so that we

31
01:10.640 --> 01:14.340 align:middle line:90%
can include group 16, because
both my routers support it.

32
01:14.340 --> 01:15.530 align:middle line:84%
So let's do that now.

33
01:15.530 --> 01:19.138 align:middle line:90%
We'll go ahead and type in
crypto ikev2 proposal default.

34
01:19.138 --> 01:20.930 align:middle line:90%
It gives me a warning,
saying, whoa, you're

35
01:20.930 --> 01:23.773 align:middle line:90%
about to tweak the default.
And we say, yeah, we know.

36
01:23.773 --> 01:24.690 align:middle line:84%
That's why we're here.

37
01:24.690 --> 01:25.910 align:middle line:84%
So we'll say group.

38
01:25.910 --> 01:29.180 align:middle line:90%
And I think we support--
yeah, let's do group 16.

39
01:29.180 --> 01:31.250 align:middle line:90%
Let's make sure we
do it on both sides.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.180 --> 01:31.250 align:middle line:90%
Let's make sure we
do it on both sides.

40
01:31.250 --> 01:34.340 align:middle line:90%
And then if we type in exit and
hit the up arrow a few times

41
01:34.340 --> 01:37.880 align:middle line:90%
to do a show crypto
ikev2 proposal,

42
01:37.880 --> 01:39.650 align:middle line:90%
now I've just
replaced the default

43
01:39.650 --> 01:41.850 align:middle line:90%
with that
Diffie-Hellman group 16.

44
01:41.850 --> 01:42.350 align:middle line:84%
OK.

45
01:42.350 --> 01:43.070 align:middle line:84%
Fantastic.

46
01:43.070 --> 01:46.040 align:middle line:90%
Now, as far as the keys
go, we need a key ring

47
01:46.040 --> 01:48.560 align:middle line:90%
that can support the pre-shared
key authentication we

48
01:48.560 --> 01:49.800 align:middle line:84%
are going to do.

49
01:49.800 --> 01:53.090 align:middle line:90%
And so to do that, the syntax
is crypto ikev2 keyring.

50
01:53.090 --> 01:56.270 align:middle line:90%
You name it, and then you say
who the peer's going to be.

51
01:56.270 --> 01:59.390 align:middle line:90%
You specify the address
of who that peer is.

52
01:59.390 --> 02:00.903 align:middle line:84%
And then you specify the key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.390 --> 02:00.903 align:middle line:84%
And then you specify the key.

53
02:00.903 --> 02:02.570 align:middle line:90%
Now, there's also
options for specifying

54
02:02.570 --> 02:05.240 align:middle line:90%
a local key and a remote
key if those keys happen

55
02:05.240 --> 02:06.170 align:middle line:84%
to be different.

56
02:06.170 --> 02:09.180 align:middle line:90%
But in my case, it's going to
be the same key for both sides.

57
02:09.180 --> 02:11.650 align:middle line:90%
So I'm just using one
line to get it done.

58
02:11.650 --> 02:14.630 align:middle line:90%
And there is our
keyring called IOS-Keys.

59
02:14.630 --> 02:16.980 align:middle line:90%
So we'll exit out of
keyring configuration mode.

60
02:16.980 --> 02:20.210 align:middle line:90%
Next, let's create
our IKEv2 profile.

61
02:20.210 --> 02:23.430 align:middle line:90%
And we'll name this
Our-v2-Profile.

62
02:23.430 --> 02:25.340 align:middle line:90%
So here is the
syntax right here.

63
02:25.340 --> 02:27.367 align:middle line:90%
Crypto ikev2
profile, I named it.

64
02:27.367 --> 02:29.700 align:middle line:90%
And then it's specifying,
hey, you need a couple things.

65
02:29.700 --> 02:30.783 align:middle line:84%
So yeah, give me a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.700 --> 02:30.783 align:middle line:84%
So yeah, give me a moment.

66
02:30.783 --> 02:31.560 align:middle line:84%
Here we go.

67
02:31.560 --> 02:33.230 align:middle line:84%
So here's my match identity.

68
02:33.230 --> 02:35.660 align:middle line:90%
So I'm matching
on 25.2.2.2, which

69
02:35.660 --> 02:38.350 align:middle line:90%
is the reachable address
on R2 that I'm going

70
02:38.350 --> 02:39.810 align:middle line:84%
to be using for the identity.

71
02:39.810 --> 02:42.110 align:middle line:90%
Then I'm specifying that
for the authentication

72
02:42.110 --> 02:44.500 align:middle line:90%
for the remote side
using the pre-shared key,

73
02:44.500 --> 02:46.582 align:middle line:90%
and authentication
local pre-shared key.

74
02:46.582 --> 02:48.290 align:middle line:90%
And I'm using the same
key on both sides.

75
02:48.290 --> 02:49.798 align:middle line:90%
So as far as the
keyring, I didn't

76
02:49.798 --> 02:52.340 align:middle line:90%
need to specify a different key
for local and a different key

77
02:52.340 --> 02:53.180 align:middle line:84%
for remote.

78
02:53.180 --> 02:55.310 align:middle line:90%
And then because I said
use a pre-shared key

79
02:55.310 --> 02:58.070 align:middle line:90%
for authentication, I also
referred to the keyring

80
02:58.070 --> 03:02.060 align:middle line:90%
we created just a few moments
ago, keyring local IOS-Keys.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.070 --> 03:02.060 align:middle line:90%
we created just a few moments
ago, keyring local IOS-Keys.

81
03:02.060 --> 03:04.110 align:middle line:84%
That's this keyring right here.

82
03:04.110 --> 03:05.360 align:middle line:84%
So we'll press Enter.

83
03:05.360 --> 03:09.110 align:middle line:90%
And then we'll type exit to
exit out of IKEv2 profile

84
03:09.110 --> 03:10.613 align:middle line:84%
configuration mode.

85
03:10.613 --> 03:12.030 align:middle line:90%
So let's go through
our checklist.

86
03:12.030 --> 03:13.430 align:middle line:84%
We are using the default policy.

87
03:13.430 --> 03:16.190 align:middle line:90%
We tweaked the proposal to
include Diffie-Hellman group

88
03:16.190 --> 03:17.270 align:middle line:84%
16.

89
03:17.270 --> 03:18.770 align:middle line:84%
We just created the profile.

90
03:18.770 --> 03:20.240 align:middle line:84%
We created the keyring.

91
03:20.240 --> 03:21.330 align:middle line:84%
That all looks good.

92
03:21.330 --> 03:23.450 align:middle line:90%
Let's go down to
the IPsec profile.

93
03:23.450 --> 03:25.160 align:middle line:90%
And for the transform
set, unless we

94
03:25.160 --> 03:27.660 align:middle line:90%
want to use the default,
which is not part of our plan,

95
03:27.660 --> 03:30.300 align:middle line:90%
we need to create the
IPsec transform set,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:27.660 --> 03:30.300 align:middle line:90%
we need to create the
IPsec transform set,

96
03:30.300 --> 03:32.540 align:middle line:90%
and then include it
inside the IPsec profile,

97
03:32.540 --> 03:36.600 align:middle line:90%
along with the IKEv2 profile
that we want to associate

98
03:36.600 --> 03:38.160 align:middle line:84%
in this IPsec profile.

99
03:38.160 --> 03:40.010 align:middle line:90%
So to create the
transform, set the syntax

100
03:40.010 --> 03:42.230 align:middle line:84%
is crypto ipsec transform-set.

101
03:42.230 --> 03:44.510 align:middle line:90%
And then I'm going
to name this Our-Set

102
03:44.510 --> 03:49.910 align:middle line:90%
and use AES 256 and SHA 512 HMAC
for hash message authentication

103
03:49.910 --> 03:50.680 align:middle line:84%
code.

104
03:50.680 --> 03:54.170 align:middle line:90%
And I'm also going to set
the mode to be tunnel.

105
03:54.170 --> 03:54.800 align:middle line:84%
And then exit.

106
03:54.800 --> 03:57.920 align:middle line:90%
So there's our transform set,
just like it was previously

107
03:57.920 --> 03:59.710 align:middle line:84%
before IKEv2.

108
03:59.710 --> 04:03.050 align:middle line:90%
And now what we'll do is we'll
create an IPsec profile that'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
03:59.710 --> 04:03.050 align:middle line:90%
And now what we'll do is we'll
create an IPsec profile that'll

109
04:03.050 --> 04:04.650 align:middle line:84%
include that transform set.

110
04:04.650 --> 04:07.100 align:middle line:90%
And it'll also include
the IKEv2 profile we

111
04:07.100 --> 04:08.820 align:middle line:84%
created just a few moments ago.

112
04:08.820 --> 04:11.690 align:middle line:90%
So to do that, we'll type
in crypto ipsec profile

113
04:11.690 --> 04:14.250 align:middle line:84%
Our-IPsec-Profile.

114
04:14.250 --> 04:16.640 align:middle line:90%
We're creating a brand
new IPsec profile.

115
04:16.640 --> 04:19.670 align:middle line:90%
And then we're including in
that profile the transform set

116
04:19.670 --> 04:22.910 align:middle line:90%
that we just made, and also
the IKEv2 profile that we

117
04:22.910 --> 04:24.883 align:middle line:84%
made previously right up here.

118
04:24.883 --> 04:26.300 align:middle line:90%
So our next step
on this router is

119
04:26.300 --> 04:28.910 align:middle line:90%
to create a tunnel interface,
interface tunnel 0.

120
04:28.910 --> 04:30.870 align:middle line:84%
And we'll specify an IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:28.910 --> 04:30.870 align:middle line:84%
And we'll specify an IP address.

121
04:30.870 --> 04:35.180 align:middle line:90%
Let's use 10.12.12.1 with a
24-bit mask, and over on R2

122
04:35.180 --> 04:38.487 align:middle line:90%
we'll do 10.12.12.2
with the 24-bit mask.

123
04:38.487 --> 04:40.820 align:middle line:90%
We'll specify the tunnel
source, the tunnel destination.

124
04:40.820 --> 04:42.737 align:middle line:90%
We've done this before
with tunnel interfaces.

125
04:42.737 --> 04:45.530 align:middle line:90%
And what we'll also do is
we'll specify the mode.

126
04:45.530 --> 04:50.000 align:middle line:90%
Instead of GRE, we'll say
tunnel mode IPsec for IPv4.

127
04:50.000 --> 04:52.790 align:middle line:90%
And we'll also apply that
tunnel protection profile,

128
04:52.790 --> 04:55.040 align:middle line:90%
the IPsec profile,
for the encryption

129
04:55.040 --> 04:58.220 align:middle line:90%
to actually kick in and take
place on the tunnel interface.

130
04:58.220 --> 05:01.120 align:middle line:90%
And here's the config
for exactly that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
04:58.220 --> 05:01.120 align:middle line:90%
And here's the config
for exactly that.

131
05:01.120 --> 05:04.570 align:middle line:90%
So we have the IP address
on the tunnel, the source,

132
05:04.570 --> 05:09.660 align:middle line:90%
the destination, and tunnel mode
ipsec ipv4 as opposed to GRE.

133
05:09.660 --> 05:11.550 align:middle line:90%
And then the tunnel
protection profile

134
05:11.550 --> 05:15.030 align:middle line:90%
called Our-IPsec-Profile that
we just made a few moments

135
05:15.030 --> 05:16.980 align:middle line:84%
ago right here.

136
05:16.980 --> 05:19.890 align:middle line:90%
So half of a tunnel
is done, the R1 side.

137
05:19.890 --> 05:22.680 align:middle line:90%
And we're going to do the
equivalent configuration over

138
05:22.680 --> 05:23.790 align:middle line:84%
on R2.

139
05:23.790 --> 05:26.040 align:middle line:90%
So the flip side of that
would be virtually identical,

140
05:26.040 --> 05:27.623 align:middle line:90%
everything except
for the IP addresses

141
05:27.623 --> 05:29.430 align:middle line:90%
and the peers
involved, as far as who

142
05:29.430 --> 05:31.000 align:middle line:84%
is the peer on the other side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.430 --> 05:31.000 align:middle line:84%
is the peer on the other side.

143
05:31.000 --> 05:34.110 align:middle line:90%
So what I'll do is I'll put in
that configuration over on R2,

144
05:34.110 --> 05:37.350 align:middle line:90%
and then in the next
video, once that's applied,

145
05:37.350 --> 05:38.970 align:middle line:90%
let's walk through
some basic steps

146
05:38.970 --> 05:43.230 align:middle line:90%
just to make sure that our
IPsec is working here with IKEv2

147
05:43.230 --> 05:45.298 align:middle line:84%
implemented as part of FlexVPN.

148
05:45.298 --> 05:47.340 align:middle line:90%
So I look forward to seeing
you in the next video

149
05:47.340 --> 05:49.800 align:middle line:90%
as we verify the
IPsec tunnel together.

150
05:49.800 --> 05:51.160 align:middle line:84%
See you there in just a moment.

151
05:51.160 --> 05:53.580 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

152
05:53.580 --> 05:56.840 align:middle line:90%
And I'd like to thank
you for viewing.