WEBVTT

1
00:02.850 --> 00:05.520
So let's begin this journey by jumping in

2
00:05.520 --> 00:07.890
and putting together a game plan of

3
00:07.890 --> 00:10.530
what we're actually trying to accomplish.

4
00:10.530 --> 00:13.260
Specifically, we wanna look at a diagram of

5
00:13.260 --> 00:15.480
how things are laid out in the environment,

6
00:15.480 --> 00:17.130
so we know where we're headed

7
00:17.130 --> 00:18.990
and what we're working with as far

8
00:18.990 --> 00:21.180
as our underlay topology.

9
00:21.180 --> 00:24.180
Overall, of course, our goal here is to build

10
00:24.180 --> 00:28.260
that IPSec tunnel from our iOS XE device

11
00:28.260 --> 00:31.530
into an AWS VPC.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.260 --> 00:31.530
into an AWS VPC.

12
00:31.530 --> 00:33.540
So let's go ahead and take a look at that diagram

13
00:33.540 --> 00:35.610
and see where we're started as far as

14
00:35.610 --> 00:38.060
what we're gonna be building in this environment.

15
00:40.350 --> 00:41.760
So for this skill

16
00:41.760 --> 00:43.380
and the next skill,

17
00:43.380 --> 00:47.220
we will be using AWS Topology 1,

18
00:47.220 --> 00:50.580
which is actually a fairly simple topology.

19
00:50.580 --> 00:54.120
First, we have a workstation here, workstation one,

20
00:54.120 --> 00:56.490
which is simply on VAN 10

21
00:56.490 --> 01:00.360
or subnet 10 in our environment, which as you can see here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:56.490 --> 01:00.360
or subnet 10 in our environment, which as you can see here,

22
01:00.360 --> 01:05.360
is represented by 10.10.10.0/24.

23
01:05.940 --> 01:07.590
Basically, this is going

24
01:07.590 --> 01:09.993
to act like our headquarters up here,

25
01:12.210 --> 01:14.790
meaning our on-premises equipment.

26
01:14.790 --> 01:17.580
This is actually gonna use a total subnet

27
01:17.580 --> 01:19.973
of 10.10.0.0/16,

28
01:23.280 --> 01:25.230
and then of course, also on that subnet

29
01:25.230 --> 01:26.880
and acting as the default gateway.

30
01:26.880 --> 01:31.230
Here at .one, we have router one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:26.880 --> 01:31.230
Here at .one, we have router one.

31
01:31.230 --> 01:34.800
Router one is a C8000V,

32
01:34.800 --> 01:38.040
otherwise known as the Catalyst 8000V.

33
01:38.040 --> 01:42.870
This is our device that's running iOS XE.

34
01:42.870 --> 01:46.860
So this of course is going to be the on-premises router

35
01:46.860 --> 01:49.470
that's going to run our IPSec tunnel.

36
01:49.470 --> 01:51.960
Now, one other thing we do need to be aware

37
01:51.960 --> 01:55.080
of in this particular topology,

38
01:55.080 --> 01:58.710
we have this device over here that's connecting out

39
01:58.710 --> 02:02.160
to the internet that's performing pat
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:58.710 --> 02:02.160
to the internet that's performing pat

40
02:02.160 --> 02:04.740
or port address translation.

41
02:04.740 --> 02:07.710
Just a more specific version of saying

42
02:07.710 --> 02:12.660
that it's running Nat, specifically, this is our on site

43
02:12.660 --> 02:15.330
or on-premises firewall.

44
02:15.330 --> 02:18.120
Now, this of course could be any piece of equipment

45
02:18.120 --> 02:21.450
that's doing layer three firewall security.

46
02:21.450 --> 02:25.230
The important thing here is when we're configuring this,

47
02:25.230 --> 02:27.720
we're going to have to be concerned about this

48
02:27.720 --> 02:30.319
outside address on the firewall,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:27.720 --> 02:30.319
outside address on the firewall,

49
02:30.319 --> 02:33.900
on this interface facing the internet.

50
02:33.900 --> 02:36.240
That's going to come into play.

51
02:36.240 --> 02:38.070
We're not going to have to configure anything

52
02:38.070 --> 02:40.110
on that firewall because

53
02:40.110 --> 02:42.690
what we're specifically gonna be doing in order

54
02:42.690 --> 02:47.310
to support this is something called Nat-T,

55
02:47.310 --> 02:49.680
which is Nat Traversal.

56
02:49.680 --> 02:53.250
So it's going to be IPSec with Nat Traversal,

57
02:53.250 --> 02:55.530
and we'll see how that plays into port numbers

58
02:55.530 --> 02:58.200
and such as we go.

59
02:58.200 --> 03:01.770
Now, of course, as mentioned in this skill,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:58.200 --> 03:01.770
Now, of course, as mentioned in this skill,

60
03:01.770 --> 03:05.070
we're going to be building our tunnel directly

61
03:05.070 --> 03:09.750
to the AWS Native VPN service.

62
03:09.750 --> 03:13.290
So effectively at the end of the day, our tunnel is going

63
03:13.290 --> 03:16.860
to be built from this interface on router one

64
03:16.860 --> 03:21.123
down to the outside facing interfaces on AWS,

65
03:22.560 --> 03:24.900
and therefore our tunnel is going

66
03:24.900 --> 03:27.240
to look something along these lines.

67
03:27.240 --> 03:30.000
This should then give us, of course, direct access
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:30.000 --> 03:32.640
to our AWS VPC.

69
03:32.640 --> 03:37.603
Its total subnet is 10.20.0.0/16.

70
03:40.620 --> 03:42.480
You can see here on the diagram,

71
03:42.480 --> 03:45.390
we're really just looking at subnet 10,

72
03:45.390 --> 03:48.180
and we're going to have this device SRV1,

73
03:48.180 --> 03:50.280
which we're going to be actually deploying

74
03:50.280 --> 03:52.440
in the AWS environment,

75
03:52.440 --> 03:56.520
and that device is going to be on subnet 10.

76
03:56.520 --> 03:57.630
Just be aware, however,

77
03:57.630 --> 04:00.810
that this entire address space is going to be assigned
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:57.630 --> 04:00.810
that this entire address space is going to be assigned

78
04:00.810 --> 04:02.460
to the VPC,

79
04:02.460 --> 04:06.690
so we could make new subnets if we needed to.

80
04:06.690 --> 04:09.750
Say for example, maybe in a challenge.

81
04:09.750 --> 04:12.300
So as you can see, there's quite a bit here

82
04:12.300 --> 04:14.280
that needs to be configured.

83
04:14.280 --> 04:15.900
In this particular skill,

84
04:15.900 --> 04:19.710
we're gonna be focusing on configuring the AWS portion

85
04:19.710 --> 04:21.750
of this environment.

86
04:21.750 --> 04:23.670
In the second skill,

87
04:23.670 --> 04:25.860
we're then going to take a look at configuring

88
04:25.860 --> 04:29.670
the iOS XE device up here, router one.

89
04:29.670 --> 04:33.750
So let's go ahead and jump in to the AWS console
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:29.670 --> 04:33.750
So let's go ahead and jump in to the AWS console

90
04:33.750 --> 04:35.883
and get started with our configuration.