WEBVTT

1
00:00.000 --> 00:06.960
So now we're coming up on the last few steps of our configuration.

2
00:06.960 --> 00:12.520
We need to configure the IPsec components, which are the transform set and the

3
00:12.520 --> 00:13.040
IPsec

4
00:13.040 --> 00:14.040
profile.

5
00:14.040 --> 00:20.180
Then we need to configure our tunnel into something called a VTI or a virtual

6
00:20.180 --> 00:20.880
tunnel

7
00:20.880 --> 00:28.160
interface where we apply the protection of the IPsec profile to that tunnel.

8
00:28.160 --> 00:31.080
So this is actually a fairly short configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:28.160 --> 00:31.080
So this is actually a fairly short configuration.

9
00:31.080 --> 00:32.720
Let's jump in and take a look.

10
00:32.720 --> 00:37.510
Once again, we'll be configuring router one and then just pasting the necessary

11
00:37.510 --> 00:38.480
configuration

12
00:38.480 --> 00:40.160
onto router four.

13
00:40.160 --> 00:43.960
Let's go ahead and jump in.

14
00:43.960 --> 00:48.920
So the first thing we're going to configure is the IPsec transform set.

15
00:48.920 --> 00:54.480
So this is going to start crypto IPsec transform set.

16
00:54.480 --> 00:57.080
And once again, it's going to want to name.

17
00:57.080 --> 00:59.680
So you can of course name these whatever you like.

18
00:59.680 --> 01:05.350
I see a lot of companies naming them TS underscore and then the encryption that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.680 --> 01:05.350
I see a lot of companies naming them TS underscore and then the encryption that

19
01:05.350 --> 01:06.360
they're going

20
01:06.360 --> 01:07.680
to be using.

21
01:07.680 --> 01:13.520
So for example, ESP underscore 256.

22
01:13.520 --> 01:18.140
If we look at the different encryption options, of course, we have quite a few,

23
01:18.140 --> 01:18.600
but we're

24
01:18.600 --> 01:22.800
going to be going with ESP GCM.

25
01:22.800 --> 01:27.880
So we'll say ECM GCM and then we can specify the number of bits.

26
01:27.880 --> 01:31.550
Once again, we'll go for the maximum number, which sort of matches up to what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:27.880 --> 01:31.550
Once again, we'll go for the maximum number, which sort of matches up to what

27
01:31.550 --> 01:32.020
we named

28
01:32.020 --> 01:33.640
our transform set.

29
01:33.640 --> 01:36.240
We'll make it 256.

30
01:36.240 --> 01:39.840
Here then is where we get to choose the mode.

31
01:39.840 --> 01:42.040
Now remember we discussed this earlier.

32
01:42.040 --> 01:46.200
This can run in either transport or tunnel mode.

33
01:46.200 --> 01:51.960
Here the biggest difference is the tunnel mode also encrypts the original IP

34
01:51.960 --> 01:52.800
header where

35
01:52.800 --> 01:55.360
transport mode doesn't.

36
01:55.360 --> 02:00.080
So since we're doing a site to site VPN, it's generally best to run it in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:55.360 --> 02:00.080
So since we're doing a site to site VPN, it's generally best to run it in

37
02:00.080 --> 02:01.160
tunnel mode.

38
02:01.160 --> 02:06.690
Now the next piece we're going to need is we need our IPsec profile, which is

39
02:06.690 --> 02:07.360
really

40
02:07.360 --> 02:10.080
what ties all of this together.

41
02:10.080 --> 02:13.680
So it's crypto IPsec profile.

42
02:13.680 --> 02:18.640
And it wants a name, what was called it IPsec profile, since we've been so

43
02:18.640 --> 02:19.520
creative with

44
02:19.520 --> 02:21.680
our naming so far.

45
02:21.680 --> 02:25.400
And then let's take a look at the things we need to do.

46
02:25.400 --> 02:29.880
It doesn't really look like we have a lot of choices here, except most of them

47
02:29.880 --> 02:30.320
start
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.880 --> 02:30.320
start

48
02:30.320 --> 02:31.800
with set.

49
02:31.800 --> 02:36.240
And then we have a lot of different choices of what we can configure after set.

50
02:36.240 --> 02:40.230
Well, the first thing we want to do is call to the transform set that we just

51
02:40.230 --> 02:40.920
created.

52
02:40.920 --> 02:48.040
So again, we named this TS underscore ESP underscore 256.

53
02:48.040 --> 02:51.920
So that ties the transform set to the profile.

54
02:51.920 --> 02:55.320
The next thing we have to do is configure the PFS.

55
02:55.320 --> 02:58.200
This again is going to be a Diffie-Hellman group.

56
02:58.200 --> 03:00.840
We'll just use group 20 again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:58.200 --> 03:00.840
We'll just use group 20 again.

57
03:00.840 --> 03:05.400
And finally, we need to set the Ike version to profile.

58
03:05.400 --> 03:11.950
Again, we used the incredibly clever name Ike V2 profile to make this very

59
03:11.950 --> 03:13.000
simple.

60
03:13.000 --> 03:17.600
So that's all we have to configure for the IPsec components.

61
03:17.600 --> 03:22.440
The last thing we need to do is go into interface tunnel one.

62
03:22.440 --> 03:24.640
Now there's a couple of things we should do here.

63
03:24.640 --> 03:26.400
They are technically optional.

64
03:26.400 --> 03:32.930
However, as soon as we do IPsec, we are going to be decreasing the MTU size on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:26.400 --> 03:32.930
However, as soon as we do IPsec, we are going to be decreasing the MTU size on

65
03:32.930 --> 03:34.240
the tunnel.

66
03:34.240 --> 03:39.700
Now just a quick note on this, there are ways you can use the ping statement to

67
03:39.700 --> 03:40.280
find out

68
03:40.280 --> 03:43.480
the actual MTU on a circuit.

69
03:43.480 --> 03:48.230
So in the real world, if I were setting up this tunnel, what I would probably

70
03:48.230 --> 03:48.920
do is configure

71
03:48.920 --> 03:55.790
the tunnel, then do a ping sweep using size range, find out what the actual MTU

72
03:55.790 --> 03:56.280
is on

73
03:56.280 --> 04:00.200
this interface and configure this appropriately.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:56.280 --> 04:00.200
this interface and configure this appropriately.

74
04:00.200 --> 04:03.980
Given that this is just a lab, we'll just put in something low that we know is

75
04:03.980 --> 04:04.200
going

76
04:04.200 --> 04:05.200
to be small enough.

77
04:05.200 --> 04:07.760
We'll just use 1400.

78
04:07.760 --> 04:11.200
So we'll just say IP MTU 1400.

79
04:11.200 --> 04:17.930
It's also a good idea to set the TCP maximum segment size if you adjust the MTU

80
04:17.930 --> 04:17.960
.

81
04:17.960 --> 04:24.460
So we'll also say IP TCP, adjust maximum segment size, and this should be set

82
04:24.460 --> 04:25.360
to 40

83
04:25.360 --> 04:28.520
bytes smaller than the MTU.

84
04:28.520 --> 04:31.920
So in this case, that would be 1360.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:28.520 --> 04:31.920
So in this case, that would be 1360.

85
04:31.920 --> 04:35.800
The other thing we have to do that's sort of important here to turn this into

86
04:35.800 --> 04:36.440
an actual

87
04:36.440 --> 04:40.720
VTI is we have to change the tunnel mode.

88
04:40.720 --> 04:45.120
It defaults to a GRE tunnel as we've already seen previously.

89
04:45.120 --> 04:49.920
What we want to do is turn this into an IPsec tunnel.

90
04:49.920 --> 04:54.960
So we say IPsec, and then you have the choice of doing either IPv4, where you

91
04:54.960 --> 04:55.840
're running

92
04:55.840 --> 04:57.440
IPv4 over IPv4.

93
04:57.440 --> 05:03.680
IPv6, where you're doing, of course, over IPv6 or dual overlay, where we can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
04:57.440 --> 05:03.680
IPv6, where you're doing, of course, over IPv6 or dual overlay, where we can

94
05:03.680 --> 05:04.280
actually

95
05:04.280 --> 05:10.600
do both four and six over an IPv4 underlay.

96
05:10.600 --> 05:13.760
In our case, we only really need to support IPv4.

97
05:13.760 --> 05:16.120
So that's what we'll put in.

98
05:16.120 --> 05:20.450
And finally, if it's going to be tunnel mode, IPsec, it of course needs to know

99
05:20.450 --> 05:21.360
which profile

100
05:21.360 --> 05:22.840
to use.

101
05:22.840 --> 05:25.200
So this is applied with tunnel protection.

102
05:25.200 --> 05:29.120
We then tell it, of course, we're using IPsec.

103
05:29.120 --> 05:35.880
Then we call it our profile, which again, we named IPsec_profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:29.120 --> 05:35.880
Then we call it our profile, which again, we named IPsec_profile.

104
05:35.880 --> 05:39.800
So now that we have this configured, let's do some verification.

105
05:39.800 --> 05:45.640
So we'll do a show crypto, IPsec, transform set.

106
05:45.640 --> 05:52.080
We see that like a lot of the iCv2 components, there is a default here as well.

107
05:52.080 --> 05:56.920
But more importantly, we see the transform set that we created.

108
05:56.920 --> 06:00.520
We can also do a show crypto IPsec profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
05:56.920 --> 06:00.520
We can also do a show crypto IPsec profile.

109
06:00.520 --> 06:03.040
Here we see the profile that we created.

110
06:03.040 --> 06:05.360
There was also a default here as well.

111
06:05.360 --> 06:10.120
But notice on our profile, where it's tying everything together, it's calling

112
06:10.120 --> 06:11.640
to the iCv2

113
06:11.640 --> 06:14.120
profile, as it should.

114
06:14.120 --> 06:16.480
We see that it's using PFS.

115
06:16.480 --> 06:21.650
It's using Diffie-Hellman Group 20, and it's calling to our transform set that

116
06:21.650 --> 06:22.880
we configured,

117
06:22.880 --> 06:30.480
and it even shows us here that that transform set is using ESPGCM 256-bit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
06:22.880 --> 06:30.480
and it even shows us here that that transform set is using ESPGCM 256-bit.

118
06:30.480 --> 06:33.360
We can also do some other verification.

119
06:33.360 --> 06:35.680
We can do a show IP interface brief.

120
06:35.680 --> 06:39.760
We see that tunnel one is still listed as up up.

121
06:39.760 --> 06:45.250
And if we do a show IPEGRP neighbor, we see that our neighbor over tunnel one

122
06:45.250 --> 06:46.000
is now up

123
06:46.000 --> 06:47.680
to router four.

124
06:47.680 --> 06:52.840
And notice it's listing the uptime as two minutes and 53 seconds, which means

125
06:52.840 --> 06:53.220
it pretty

126
06:53.220 --> 06:57.520
much just came up after we configured IPsec.

127
06:57.520 --> 07:01.960
So now that router one is configured, let's jump over to router four and paste
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:57.520 --> 07:01.960
So now that router one is configured, let's jump over to router four and paste

128
07:01.960 --> 07:02.480
this same

129
07:02.480 --> 07:06.320
configuration there.

130
07:06.320 --> 07:11.830
So now we have IPsec configured properly on the tunnel between router one and

131
07:11.830 --> 07:12.280
four.

132
07:12.280 --> 07:16.550
We will, of course, jump in in the next section and do a little bit more

133
07:16.550 --> 07:17.720
verification.

134
07:17.720 --> 07:22.200
And of course, do that ever-important look at our packet capture to see if we

135
07:22.200 --> 07:22.800
can still

136
07:22.800 --> 07:25.840
see the contents of the traffic in the tunnel.

137
07:25.840 --> 07:35.840
[BLANK_AUDIO]