WEBVTT

1
00:02.820 --> 00:04.770
So now it's time to jump in

2
00:04.770 --> 00:08.880
and actually configure our site-to-site VPN connection

3
00:08.880 --> 00:11.250
in the AWS console.

4
00:11.250 --> 00:13.770
So this is where we're gonna get to choose things

5
00:13.770 --> 00:16.680
such as what type of encryption we're gonna be using

6
00:16.680 --> 00:18.360
for the IPSec tunnel,

7
00:18.360 --> 00:21.090
what type of authentication we're gonna be doing,

8
00:21.090 --> 00:23.670
all the different parameters, that of course

9
00:23.670 --> 00:28.670
we're then going to have to match on our IOS XE device.

10
00:29.250 --> 00:31.350
Now we'll see as we go through here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.250 --> 00:31.350
Now we'll see as we go through here

11
00:31.350 --> 00:33.240
that we can actually configure this

12
00:33.240 --> 00:36.780
to accept several different options at the same time

13
00:36.780 --> 00:38.550
if we choose to do so.

14
00:38.550 --> 00:40.710
So let's go ahead and jump in and get started

15
00:40.710 --> 00:43.473
configuring those site to site VPN connections.

16
00:44.910 --> 00:48.660
So starting off here again on our VPC dashboard,

17
00:48.660 --> 00:52.260
notice that we now have two additional items here,

18
00:52.260 --> 00:56.370
our customer gateway and our virtual private gateway.

19
00:56.370 --> 01:00.030
These both have a one now based on the two gateways
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:56.370 --> 01:00.030
These both have a one now based on the two gateways

20
01:00.030 --> 01:02.790
that we created in our previous video.

21
01:02.790 --> 01:07.230
But now it's time to make our site to site VPN connections.

22
01:07.230 --> 01:11.640
So for this, we'll again scroll down on our navigation menu.

23
01:11.640 --> 01:13.530
Here under virtual private network

24
01:13.530 --> 01:16.953
we'll now choose the site to site VPN connection.

25
01:18.900 --> 01:22.110
Here, as we've done before, in the upper right hand corner,

26
01:22.110 --> 01:25.380
we'll simply click on the Create VPN Connection

27
01:25.380 --> 01:28.020
and we'll begin to configure the details.

28
01:28.020 --> 01:29.880
So we'll start with the name.

29
01:29.880 --> 01:32.820
We'll simply call this VPN_1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:29.880 --> 01:32.820
We'll simply call this VPN_1.

30
01:32.820 --> 01:34.890
This is going to be a gateway type

31
01:34.890 --> 01:38.730
of virtual private gateway, so we'll leave that default

32
01:38.730 --> 01:41.640
and we will choose our virtual private gateway.

33
01:41.640 --> 01:43.620
Again, we've only created one

34
01:43.620 --> 01:45.210
so there's only one choice here.

35
01:45.210 --> 01:47.220
We'll go ahead and choose that.

36
01:47.220 --> 01:49.620
Then we have to choose the customer gateway.

37
01:49.620 --> 01:51.930
Now note, if we hadn't already done that,

38
01:51.930 --> 01:54.510
we could of course create a new one here.

39
01:54.510 --> 01:56.940
But we have already created that customer gateway,

40
01:56.940 --> 01:59.040
so we'll go ahead and select it.

41
01:59.040 --> 02:02.100
Again, we only have one so we'll go ahead and choose it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:59.040 --> 02:02.100
Again, we only have one so we'll go ahead and choose it.

42
02:02.100 --> 02:04.260
Let's go ahead and scroll down

43
02:04.260 --> 02:07.080
and we'll pick up with our routing options.

44
02:07.080 --> 02:11.370
Now notice the default here is dynamic using BGP.

45
02:11.370 --> 02:14.130
We're going to be starting with just configuring static

46
02:14.130 --> 02:16.350
so let's go ahead and click on that.

47
02:16.350 --> 02:20.040
And now it wants to know the static IP prefixes.

48
02:20.040 --> 02:22.560
These are the routes to the on-prem network,

49
02:22.560 --> 02:25.230
so in our case, our headquarters.

50
02:25.230 --> 02:30.230
So if we click on this, that's gonna be 10.10.0.0/16.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:25.230 --> 02:30.230
So if we click on this, that's gonna be 10.10.0.0/16.

51
02:31.770 --> 02:34.500
The local IPv4 network CIDR

52
02:34.500 --> 02:38.850
and the remote IPv4 network CIDR are both optional.

53
02:38.850 --> 02:41.850
We could use these to actually limit which networks

54
02:41.850 --> 02:45.090
can traverse the tunnel, but we don't need to do that.

55
02:45.090 --> 02:46.650
What we do wanna take a look at, though,

56
02:46.650 --> 02:48.750
are the tunnel options.

57
02:48.750 --> 02:53.490
So let's open tunnel options one and let's scroll down.

58
02:53.490 --> 02:55.380
So let's take a look at some of the things

59
02:55.380 --> 02:56.940
that we could configure.

60
02:56.940 --> 03:01.770
So first we could specify the IP subnet to use
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:56.940 --> 03:01.770
So first we could specify the IP subnet to use

61
03:01.770 --> 03:03.510
inside of the tunnel.

62
03:03.510 --> 03:06.270
The default is generated by Amazon,

63
03:06.270 --> 03:10.830
and it's gonna actually use the 169.254 range,

64
03:10.830 --> 03:15.360
which is generally reserved for internal private addressing.

65
03:15.360 --> 03:17.820
This is fine since we're never going to be routing

66
03:17.820 --> 03:19.500
to the tunnel itself.

67
03:19.500 --> 03:20.940
So generally speaking,

68
03:20.940 --> 03:23.790
we probably wanna leave this on generated by Amazon,

69
03:23.790 --> 03:26.220
but of course we could change it.

70
03:26.220 --> 03:30.660
You could also specify the pre-shared key for the tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:26.220 --> 03:30.660
You could also specify the pre-shared key for the tunnel.

71
03:30.660 --> 03:34.320
Now, if we had configured, say, IOS XE first

72
03:34.320 --> 03:36.300
and already generated a key,

73
03:36.300 --> 03:39.660
then we would probably wanna specify here to use the key

74
03:39.660 --> 03:41.400
that we had already generated.

75
03:41.400 --> 03:44.220
But since we're doing AWS first,

76
03:44.220 --> 03:47.820
we can let Amazon generate the pre-shared key.

77
03:47.820 --> 03:50.820
And then what we'll do in our last section here

78
03:50.820 --> 03:53.880
of this skill is we'll collect that information

79
03:53.880 --> 03:58.880
for use on IOS XE when we configure the router.

80
03:58.950 --> 04:01.770
The next thing is to configure the advanced options
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:58.950 --> 04:01.770
The next thing is to configure the advanced options

81
04:01.770 --> 04:03.360
for tunnel one.

82
04:03.360 --> 04:05.760
And this we are, in fact, going to do.

83
04:05.760 --> 04:09.210
So let's go ahead and turn on the edit tunnel one options.

84
04:09.210 --> 04:12.089
We'll scroll down to get more of this on our screen.

85
04:12.089 --> 04:15.480
And here's where we can configure which algorithms

86
04:15.480 --> 04:18.660
we're going to use for the different phases.

87
04:18.660 --> 04:22.110
So first, we have the phase one encryption algorithms.

88
04:22.110 --> 04:24.990
And if we want, for example, we could come up here

89
04:24.990 --> 04:29.467
and we could take off AES-128 and AES-256.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:31.200 --> 04:35.160
IOS XE does not support those two options anyway.

91
04:35.160 --> 04:38.310
It supports just the GCM options.

92
04:38.310 --> 04:43.310
So we'll keep the AES128-GCM-16 and the AES256-GCM-16.

93
04:45.480 --> 04:48.960
And just a note, if you accidentally delete one of these,

94
04:48.960 --> 04:50.910
so let's say we take this one off our list

95
04:50.910 --> 04:55.080
and we didn't mean to, we can simply click on the dropdown

96
04:55.080 --> 04:58.380
and add it right back onto our list by hitting the checkbox.

97
04:58.380 --> 05:00.360
And then when we click off of this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:58.380 --> 05:00.360
And then when we click off of this,

98
05:00.360 --> 05:03.000
it'll simply put it back on our list again.

99
05:03.000 --> 05:05.670
So we can edit this two different ways.

100
05:05.670 --> 05:07.740
Again, we could click on the dropdown

101
05:07.740 --> 05:10.770
and uncheck the ones we don't want.

102
05:10.770 --> 05:14.850
Of course, it's just as easy to, on the list down below,

103
05:14.850 --> 05:17.460
hit the X and take them off the list.

104
05:17.460 --> 05:21.630
But whichever method is easier for you, they're both equal.

105
05:21.630 --> 05:24.660
Moving on to our integrity algorithms.

106
05:24.660 --> 05:25.680
Let's go ahead and,

107
05:25.680 --> 05:28.590
just for the sake of modifying this a little bit for now,

108
05:28.590 --> 05:30.600
let's just remove SHA1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
05:28.590 --> 05:30.600
let's just remove SHA1.

109
05:30.600 --> 05:35.600
We'll leave the SHA2-256, the SHA2-384, and the SHA2-512.

110
05:37.530 --> 05:40.560
So we'll take SHA1 off of both the phase one

111
05:40.560 --> 05:44.040
and the phase two integrity algorithms.

112
05:44.040 --> 05:45.420
Now let's go ahead and scroll down

113
05:45.420 --> 05:47.730
just to get more of this on our screen.

114
05:47.730 --> 05:50.550
And next we have the Diffie-Hellman groups.

115
05:50.550 --> 05:53.700
We can, again, support as many of these as we like,

116
05:53.700 --> 05:57.690
or we could, for example, maybe take off everything

117
05:57.690 --> 06:01.080
except groups 19 and 20.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
05:57.690 --> 06:01.080
except groups 19 and 20.

118
06:01.080 --> 06:05.040
So maybe we just leave those two groups on the list.

119
06:05.040 --> 06:07.500
And we'll do the same for both of these.

120
06:07.500 --> 06:09.780
Once again, just like all the other lists,

121
06:09.780 --> 06:13.320
we could of course click on the dropdown and either re-add

122
06:13.320 --> 06:17.100
or modify the list here if we wanted to as well.

123
06:17.100 --> 06:21.090
Next up is the IKE version that we're going to support.

124
06:21.090 --> 06:23.580
So for Internet Key Exchange version,

125
06:23.580 --> 06:26.013
we're only going to do IKE version two.

126
06:27.150 --> 06:28.440
So since we already know that,

127
06:28.440 --> 06:31.680
we could just take IKE version one off the list
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:28.440 --> 06:31.680
we could just take IKE version one off the list

128
06:31.680 --> 06:33.963
and just leave IKE version two.

129
06:35.250 --> 06:38.040
Scrolling down a little more, we could of course

130
06:38.040 --> 06:41.700
change things like the phase one lifetimes,

131
06:41.700 --> 06:45.360
the rekey margin times, rekey fuzz percentage,

132
06:45.360 --> 06:47.280
the replay window size.

133
06:47.280 --> 06:48.810
There's a lot of different parameters here

134
06:48.810 --> 06:51.030
that we could adjust if we need to.

135
06:51.030 --> 06:54.510
But for now, we'll just leave these as their default.

136
06:54.510 --> 06:57.480
Actually scrolling down, we can leave all of the rest

137
06:57.480 --> 06:58.959
of these as their default.

138
06:58.959 --> 07:00.810
So now we'll just move on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:58.959 --> 07:00.810
So now we'll just move on

139
07:00.810 --> 07:03.180
to changing the tunnel two options.

140
07:03.180 --> 07:05.250
We'll go ahead and expand this.

141
07:05.250 --> 07:07.920
Once again, we'll leave everything as the defaults

142
07:07.920 --> 07:10.710
except for the advanced options.

143
07:10.710 --> 07:12.780
And we'll make the same changes.

144
07:12.780 --> 07:14.780
We'll take our two encryption types off.

145
07:15.840 --> 07:19.740
We'll take off SHA1 for the integrity check.

146
07:19.740 --> 07:21.330
And we'll take off all

147
07:21.330 --> 07:24.603
of the Diffie-Hellman groups except 19 and 20.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
07:33.540 --> 07:36.750
Once again, we'll take off IKE version one.

149
07:36.750 --> 07:38.670
We'll scroll down.

150
07:38.670 --> 07:41.160
All of the other defaults are fine.

151
07:41.160 --> 07:45.570
So now we can just hit create VPN connection.

152
07:45.570 --> 07:49.530
So we'll choose that, it'll create our VPN.

153
07:49.530 --> 07:51.600
The state is currently pending.

154
07:51.600 --> 07:55.230
We'll give this just a few moments, then we'll refresh.

155
07:55.230 --> 07:58.080
So after about two minutes, we'll hit refresh.

156
07:58.080 --> 08:02.160
And we see that now this state has changed to available.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
07:58.080 --> 08:02.160
And we see that now this state has changed to available.

157
08:02.160 --> 08:05.940
Let's go ahead and highlight our VPN to get more detail.

158
08:05.940 --> 08:07.560
We'll adjust our window here at the bottom

159
08:07.560 --> 08:09.960
so we can see a little bit more information.

160
08:09.960 --> 08:13.260
And we see a lot of detailed information here.

161
08:13.260 --> 08:15.510
Of course, we see the VPN ID.

162
08:15.510 --> 08:17.400
The state is available.

163
08:17.400 --> 08:19.590
We see the virtual private gateway

164
08:19.590 --> 08:22.320
and the customer gateway that it's using.

165
08:22.320 --> 08:25.140
We also see the customer gateway address,

166
08:25.140 --> 08:28.590
which again, is the public outside address.

167
08:28.590 --> 08:31.110
We see various other settings here as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
08:28.590 --> 08:31.110
We see various other settings here as well.

168
08:31.110 --> 08:35.160
But the main thing we want to see is the tunnel details.

169
08:35.160 --> 08:37.950
So now let's go ahead and click on tunnel details.

170
08:37.950 --> 08:39.441
And the main thing to see here

171
08:39.441 --> 08:44.010
is that we have two tunnels created automatically

172
08:44.010 --> 08:48.000
by AWS for this VPN.

173
08:48.000 --> 08:50.940
We see the two different outside addresses.

174
08:50.940 --> 08:52.200
These are the addresses that,

175
08:52.200 --> 08:56.010
of course, we're gonna be connecting to on AWS.

176
08:56.010 --> 08:59.730
We see the inside IPv4 CIDR addresses

177
08:59.730 --> 09:02.790
that are gonna be used on the tunnel itself.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
08:59.730 --> 09:02.790
that are gonna be used on the tunnel itself.

178
09:02.790 --> 09:07.790
And notice the status on both of these is of course down,

179
09:08.310 --> 09:10.980
which makes perfect sense since we of course

180
09:10.980 --> 09:15.153
have not configured the IOS XE side of these tunnels.

181
09:17.340 --> 09:21.090
But the fact that they're here and they're down

182
09:21.090 --> 09:23.250
does indicate that they are configured

183
09:23.250 --> 09:27.060
and ready for IOS XE to connect.

184
09:27.060 --> 09:29.760
Now, we're unfortunately not gonna be able to do much

185
09:29.760 --> 09:34.200
with these tunnels until we have routes to use them
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
09:29.760 --> 09:34.200
with these tunnels until we have routes to use them

186
09:34.200 --> 09:37.710
as well as permission to send traffic.

187
09:37.710 --> 09:40.680
So next we're gonna take a look at our routing table

188
09:40.680 --> 09:42.423
and our security groups.