WEBVTT

1
00:00.000 --> 00:07.800
So now it's time to jump into the command line and configure the components for

2
00:07.800 --> 00:08.640
Ike version

3
00:08.640 --> 00:13.560
two with pre shared key on iOS XE.

4
00:13.560 --> 00:18.200
Now for this video, we're going to be focusing just on the router one

5
00:18.200 --> 00:19.620
configuration.

6
00:19.620 --> 00:24.290
We will do that in our next video as well when we configure the IPsec

7
00:24.290 --> 00:25.480
components and

8
00:25.480 --> 00:27.400
configure the tunnel.

9
00:27.400 --> 00:32.330
For both of these sections, the configuration for router four is going to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.400 --> 00:32.330
For both of these sections, the configuration for router four is going to be

10
00:32.330 --> 00:33.120
listed at the

11
00:33.120 --> 00:36.000
bottom of the section for your reference.

12
00:36.000 --> 00:39.920
And we're just going to copy and paste that into router four.

13
00:39.920 --> 00:44.640
There's really not a lot of value in looking at the exact same configuration

14
00:44.640 --> 00:45.160
twice when

15
00:45.160 --> 00:49.820
the configuration for router four is really just going to be a mirror of the

16
00:49.820 --> 00:50.520
router one

17
00:50.520 --> 00:52.000
configuration.

18
00:52.000 --> 00:56.750
So that said, let's go ahead and jump into the command line on router one and

19
00:56.750 --> 00:57.240
configure

20
00:57.240 --> 01:04.440
the components for Ike version two with a pre shared key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.240 --> 01:04.440
the components for Ike version two with a pre shared key.

21
01:04.440 --> 01:09.690
So the first component that we need to configure is the Ike version two

22
01:09.690 --> 01:10.760
proposal.

23
01:10.760 --> 01:16.760
So we'll start off with crypto, Ike V two proposal.

24
01:16.760 --> 01:20.240
Now all I really want at this point is a name.

25
01:20.240 --> 01:22.560
So we'll just make it real simple.

26
01:22.560 --> 01:26.920
What does call it Ike V two proposal?

27
01:26.920 --> 01:31.640
And then let's take a look at the components that have to be in this proposal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:26.920 --> 01:31.640
And then let's take a look at the components that have to be in this proposal.

28
01:31.640 --> 01:36.910
The first thing it tells us here is it has to have either a set of encryption

29
01:36.910 --> 01:37.880
algorithms

30
01:37.880 --> 01:46.160
other than a GCM and an integrity algorithm and a Diffie-Hellman group or an

31
01:46.160 --> 01:47.600
encryption

32
01:47.600 --> 01:55.690
algorithm that is a GCM in which case we need a PRF algorithm and a Diffie-Hell

33
01:55.690 --> 01:57.280
man group.

34
01:57.280 --> 02:01.370
So if we started off by saying encryption and look at the options, we can see
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:57.280 --> 02:01.370
So if we started off by saying encryption and look at the options, we can see

35
02:01.370 --> 02:02.240
the different

36
02:02.240 --> 02:06.000
encryption options that this particular platform supports.

37
02:06.000 --> 02:11.070
Now of course, this will vary from platform to platform, but this is on the

38
02:11.070 --> 02:13.720
catalyst 8000v.

39
02:13.720 --> 02:18.600
Now the AES GCM are generally the preferred modes.

40
02:18.600 --> 02:26.920
So if we say AES GCM, we'll go ahead and turn this on for 256 bit keys.

41
02:26.920 --> 02:33.680
And notice the only choice we have is to also allow 128 bit keys.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
02:26.920 --> 02:33.680
And notice the only choice we have is to also allow 128 bit keys.

42
02:33.680 --> 02:37.820
Now of course, this could be useful if our neighboring device only supported

43
02:37.820 --> 02:38.680
128 bit

44
02:38.680 --> 02:39.680
keys.

45
02:39.680 --> 02:46.170
The same thing I'm trying to point out is we cannot combine the CBC algorithms

46
02:46.170 --> 02:46.800
with the

47
02:46.800 --> 02:49.320
GCM algorithms.

48
02:49.320 --> 02:51.880
So that said, we'll just hit enter.

49
02:51.880 --> 02:57.590
And since we chose the option that's using a GCM algorithm, that means that we

50
02:57.590 --> 02:58.280
need a

51
02:58.280 --> 02:59.880
PRF.

52
02:59.880 --> 03:07.580
The choices for the PRF are MD5, Show1, or various bit lengths of Shaw version
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:59.880 --> 03:07.580
The choices for the PRF are MD5, Show1, or various bit lengths of Shaw version

53
03:07.580 --> 03:08.280
2.

54
03:08.280 --> 03:13.400
Again, we're just going to go with the best choice here, Shaw 512.

55
03:13.400 --> 03:19.640
Once again, you can add more to this line if you want to support other options.

56
03:19.640 --> 03:23.910
And this again is part of what that security association is for to negotiate

57
03:23.910 --> 03:24.640
which sets

58
03:24.640 --> 03:28.560
of options are available on the neighboring devices.

59
03:28.560 --> 03:32.240
Since we're configuring both sides, we can configure them to be identical.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
03:28.560 --> 03:32.240
Since we're configuring both sides, we can configure them to be identical.

60
03:32.240 --> 03:34.640
So we only need this one choice.

61
03:34.640 --> 03:37.680
And of course, it told us we needed our Diffie-Hellman group.

62
03:37.680 --> 03:40.840
We can pretty much use any of these choices we want.

63
03:40.840 --> 03:45.840
So for example, we can just use Diffie-Hellman group 20 as an example.

64
03:45.840 --> 03:50.120
The next piece we're going to need is the Ike version 2 policy.

65
03:50.120 --> 03:52.840
Once again, it's crypto Ike v2 policy.

66
03:52.840 --> 03:56.120
If we hit the question mark, it just wants a name.

67
03:56.120 --> 03:59.440
We'll follow the same basic naming convention here.

68
03:59.440 --> 04:03.960
Now one thing this is telling us is that it has to have one complete proposal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:59.440 --> 04:03.960
Now one thing this is telling us is that it has to have one complete proposal.

69
04:03.960 --> 04:08.640
So at the bare minimum, we're going to have to tell it to use our proposal.

70
04:08.640 --> 04:12.520
So we'll say proposal and then of course, we put in the name.

71
04:12.520 --> 04:18.030
The other thing we could do here is specify for which local address we want to

72
04:18.030 --> 04:18.760
use this

73
04:18.760 --> 04:20.720
particular policy.

74
04:20.720 --> 04:21.720
Now we don't have to do this.

75
04:21.720 --> 04:27.770
We could do a match all or again, we could say something like match address

76
04:27.770 --> 04:28.680
local.

77
04:28.680 --> 04:32.240
And of course, the advantage of this is it's just making it more specific.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
04:28.680 --> 04:32.240
And of course, the advantage of this is it's just making it more specific.

78
04:32.240 --> 04:37.280
So if we're building a tunnel from our loop back, this is going to tie it to

79
04:37.280 --> 04:38.440
this policy.

80
04:38.440 --> 04:42.880
The next piece we're going to need is the actual profile.

81
04:42.880 --> 04:46.520
Once again, it simply wants a name and this is sort of what's going to tie

82
04:46.520 --> 04:47.240
everything

83
04:47.240 --> 04:48.240
together.

84
04:48.240 --> 04:54.540
Notice, it has to have at least a local and remote authentication method and

85
04:54.540 --> 04:55.200
some form

86
04:55.200 --> 05:00.960
of a match identity, match certificate or a match any statement.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:55.200 --> 05:00.960
of a match identity, match certificate or a match any statement.

87
05:00.960 --> 05:03.440
So let's take a look at what we're going to configure.

88
05:03.440 --> 05:06.520
Let's start with that match identity.

89
05:06.520 --> 05:11.760
So we'll do a match identity and we'll match on the remote address.

90
05:11.760 --> 05:15.040
We know that we're building this tunnel to router four.

91
05:15.040 --> 05:20.400
So it'll be 10 dot 100 dot one dot four for that remote address.

92
05:20.400 --> 05:26.560
If we want, we can also set an identity for the address that's local.

93
05:26.560 --> 05:30.290
And this of course would be our loopback address, which is the 10, not 100 dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
05:26.560 --> 05:30.290
And this of course would be our loopback address, which is the 10, not 100 dot

94
05:30.290 --> 05:32.000
one not one.

95
05:32.000 --> 05:35.500
Now remember, not only do we have to identify the peers that are going to be

96
05:35.500 --> 05:36.080
using this

97
05:36.080 --> 05:42.480
particular profile, but we should also specify an authentication type.

98
05:42.480 --> 05:46.960
After authentication, we have to specify local or remote.

99
05:46.960 --> 05:49.840
So we'll start off with local.

100
05:49.840 --> 05:52.200
Notice that we have several different choices here.

101
05:52.200 --> 05:57.040
But as we mentioned, we are going to be focusing on pre shared keys.

102
05:57.040 --> 05:59.080
Then we have one more choice.

103
05:59.080 --> 06:03.920
We can either hit enter, in which case we'll be using a key ring or we can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:59.080 --> 06:03.920
We can either hit enter, in which case we'll be using a key ring or we can

104
06:03.920 --> 06:04.880
specify the

105
06:04.880 --> 06:06.280
key right here.

106
06:06.280 --> 06:10.720
So I could say key and then specify the actual key.

107
06:10.720 --> 06:16.290
However, using a key ring does provide a little bit more flexibility when it

108
06:16.290 --> 06:17.800
comes to configuring

109
06:17.800 --> 06:19.240
IP sec.

110
06:19.240 --> 06:24.450
So personally, I would leave the key off of there and I would specify a key

111
06:24.450 --> 06:24.760
ring.

112
06:24.760 --> 06:27.240
So we'll go ahead and leave this as it is.

113
06:27.240 --> 06:30.540
Then we'll just change our local to remote, because we're going to do the same
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
06:27.240 --> 06:30.540
Then we'll just change our local to remote, because we're going to do the same

114
06:30.540 --> 06:31.360
authentication

115
06:31.360 --> 06:33.200
for the remote peer.

116
06:33.200 --> 06:38.400
But of course, if we're going to use a key ring, we have to specify the key

117
06:38.400 --> 06:38.680
ring.

118
06:38.680 --> 06:41.240
So this is an interesting little dilemma.

119
06:41.240 --> 06:46.560
If we say key ring, of course, we're going to be using a local key ring.

120
06:46.560 --> 06:49.360
We then have to specify the name of the key ring.

121
06:49.360 --> 06:53.340
Okay, let's call it VPN keys.

122
06:53.340 --> 06:55.320
And here's the dilemma.

123
06:55.320 --> 07:00.120
I've not created a key ring called VPN keys.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
06:55.320 --> 07:00.120
I've not created a key ring called VPN keys.

124
07:00.120 --> 07:03.120
So I can't configure this right now.

125
07:03.120 --> 07:05.600
So what I'm going to have to do is exit out of here and I'm going to have to

126
07:05.600 --> 07:06.040
create my

127
07:06.040 --> 07:07.560
key ring.

128
07:07.560 --> 07:11.700
So we do crypto IP to key ring, then the name of the key ring, which we sort of

129
07:11.700 --> 07:12.240
already

130
07:12.240 --> 07:16.040
said, we're going to do VPN keys.

131
07:16.040 --> 07:19.200
The only choice we have here is to create a peer.

132
07:19.200 --> 07:20.760
And for this, we just need to give it a name.

133
07:20.760 --> 07:23.800
So we'll just call it something like tunnel one.

134
07:23.800 --> 07:27.640
We could call it router four, something along those lines, but you have to give

135
07:27.640 --> 07:27.960
it some

136
07:27.960 --> 07:32.040
sort of a peer name, give it the address of the peer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
07:27.960 --> 07:32.040
sort of a peer name, give it the address of the peer.

137
07:32.040 --> 07:35.080
So this is who we should use this key for.

138
07:35.080 --> 07:38.360
So this would be the 10 dot 100 dot one dot four.

139
07:38.360 --> 07:43.000
And then we actually specify those pre shared keys.

140
07:43.000 --> 07:48.520
So for the local key, we'll make this Cisco 123.

141
07:48.520 --> 07:51.680
And we'll simply do the same thing for the remote key.

142
07:51.680 --> 07:54.960
We can now go back into our profile.

143
07:54.960 --> 07:57.800
Now we should be able to specify the key ring.

144
07:57.800 --> 08:01.720
So we'll just go back to the same command we tried to put in previously.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
07:57.800 --> 08:01.720
So we'll just go back to the same command we tried to put in previously.

145
08:01.720 --> 08:04.200
And now it accepts it.

146
08:04.200 --> 08:10.840
Another very popular thing to do in our profile is to turn on DPD, which are

147
08:10.840 --> 08:11.880
like liveliness

148
08:11.880 --> 08:13.480
checks.

149
08:13.480 --> 08:16.200
And we'll just go ahead and turn those on.

150
08:16.200 --> 08:21.280
We'll set the timers to 10 and two and we'll run this on demand.

151
08:21.280 --> 08:25.720
The last thing we generally want to configure, although again, technically

152
08:25.720 --> 08:26.000
optional, but the

153
08:26.000 --> 08:30.760
crypto, IKEV to fragmentation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
08:26.000 --> 08:30.760
crypto, IKEV to fragmentation.

154
08:30.760 --> 08:32.680
And we'll set the MTU to something small.

155
08:32.680 --> 08:35.680
We know will fit like 1200.

156
08:35.680 --> 08:39.960
So that should take care of the configuration for like version two.

157
08:39.960 --> 08:42.760
We can do a little bit of verification here.

158
08:42.760 --> 08:47.360
We'll do a show crypto, IKEV to proposal.

159
08:47.360 --> 08:50.920
We can see that our proposal we created is here.

160
08:50.920 --> 08:54.550
Also notice by the way that there are defaults for a lot of these things we're

161
08:54.550 --> 08:55.000
going to be

162
08:55.000 --> 08:56.320
looking at.

163
08:56.320 --> 09:01.770
So if this IKEV to proposal default met your needs, in other words, if that was
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
08:56.320 --> 09:01.770
So if this IKEV to proposal default met your needs, in other words, if that was

164
09:01.770 --> 09:03.120
the encryption,

165
09:03.120 --> 09:08.510
integrity protocol, PRF and Diffie-Hellman group that you wanted to use, then

166
09:08.510 --> 09:09.160
you could

167
09:09.160 --> 09:11.280
go ahead and use the default.

168
09:11.280 --> 09:12.280
That's fine.

169
09:12.280 --> 09:14.360
You don't have to make your own.

170
09:14.360 --> 09:19.730
But generally speaking, we want the control of configuring our own encryption,

171
09:19.730 --> 09:20.560
integrity,

172
09:20.560 --> 09:27.280
PRF and Diffie-Hellman groups so that we have control over our IKEV to sessions

173
09:27.280 --> 09:27.320
.

174
09:27.320 --> 09:30.960
We can also do a show crypto, IKEV to policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
09:27.320 --> 09:30.960
We can also do a show crypto, IKEV to policy.

175
09:30.960 --> 09:35.840
We'll see that this is very similar in that we have the policy that we created.

176
09:35.840 --> 09:38.360
And again, there is a default.

177
09:38.360 --> 09:45.160
The default here would simply be to match any address and to use the default

178
09:45.160 --> 09:45.280
proposal,

179
09:45.280 --> 09:48.960
where of course ours is calling to the proposal that we created.

180
09:48.960 --> 09:52.320
Finally, we can look at the profile.

181
09:52.320 --> 09:57.060
Again this gives us a lot of information, but the main pieces we want to look

182
09:57.060 --> 09:57.520
for is

183
09:57.520 --> 10:03.170
we see where it has the remote identity, we see where it has the local identity
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
09:57.520 --> 10:03.170
we see where it has the remote identity, we see where it has the local identity

184
10:03.170 --> 10:03.800
, the

185
10:03.800 --> 10:08.810
local authentication and the remote authentication methods are both set to pre-

186
10:08.810 --> 10:10.160
share and it's

187
10:10.160 --> 10:16.480
using that key ring VPN underscore keys that we created and told it to use.

188
10:16.480 --> 10:18.520
So now the router one is configured.

189
10:18.520 --> 10:25.160
We'll go ahead and just paste the provided configuration on router four.

190
10:25.160 --> 10:30.370
So that takes care of configuring the IKE version two components on both router
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
10:25.160 --> 10:30.370
So that takes care of configuring the IKE version two components on both router

191
10:30.370 --> 10:31.200
one and router

192
10:31.200 --> 10:32.200
four.

193
10:32.200 --> 10:37.140
So our next step is going to be to jump in and configure the IPsec components

194
10:37.140 --> 10:37.880
and then

195
10:37.880 --> 10:41.640
configure our tunnel to actually use the tunnel protection.