WEBVTT

1
00:02.715 --> 00:06.060
So now that we have our VPN connections built,

2
00:06.060 --> 00:10.200
we now have to set up our routing and our security groups

3
00:10.200 --> 00:12.750
so that we can actually use the VPNs

4
00:12.750 --> 00:16.290
to forward traffic between our headquarter site

5
00:16.290 --> 00:19.050
and the AWS VPC.

6
00:19.050 --> 00:21.510
So that's exactly what we're gonna do in this video.

7
00:21.510 --> 00:23.100
Let's go ahead and jump in.

8
00:23.100 --> 00:27.750
Now keep in mind, there is already a default route table

9
00:27.750 --> 00:29.760
and a default security group

10
00:29.760 --> 00:32.700
and we could modify and use those,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.760 --> 00:32.700
and we could modify and use those,

11
00:32.700 --> 00:35.160
but we're just gonna go ahead and create our own.

12
00:35.160 --> 00:36.933
So let's go ahead and get started.

13
00:38.850 --> 00:41.550
So the first thing to note here on the dashboard

14
00:41.550 --> 00:44.700
is under our site-to-site VPN connections,

15
00:44.700 --> 00:47.910
we now have one, which of course is what we created

16
00:47.910 --> 00:49.950
in the previous video

17
00:49.950 --> 00:52.530
and remember that we already have

18
00:52.530 --> 00:55.290
this one default routing table

19
00:55.290 --> 00:58.500
and this one default security group.

20
00:58.500 --> 01:01.350
Now, we are going to be changing that of course
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.500 --> 01:01.350
Now, we are going to be changing that of course

21
01:01.350 --> 01:03.120
in this video.

22
01:03.120 --> 01:06.120
So let's start with our routing table.

23
01:06.120 --> 01:09.480
We'll start off here by simply going to route tables.

24
01:09.480 --> 01:12.180
We'll choose create route table

25
01:12.180 --> 01:14.610
and we'll begin our configuration.

26
01:14.610 --> 01:18.510
For the name, we'll simply call it RT_1

27
01:18.510 --> 01:22.140
and of course, we have to choose our VPC.

28
01:22.140 --> 01:25.980
So we'll select that and then we'll hit create route table.

29
01:25.980 --> 01:28.110
Now that we've created the route table,

30
01:28.110 --> 01:31.680
the next thing we wanna do is under actions,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:28.110 --> 01:31.680
the next thing we wanna do is under actions,

31
01:31.680 --> 01:35.670
we'll go ahead and set this to be the main routing table.

32
01:35.670 --> 01:37.560
So we'll select that.

33
01:37.560 --> 01:40.710
To verify this we actually have to type set in the box

34
01:40.710 --> 01:42.600
and then hit OK.

35
01:42.600 --> 01:47.160
So now this is the main routing table for our VPC.

36
01:47.160 --> 01:50.940
The next thing we wanna do is associate our subnet

37
01:50.940 --> 01:53.190
with this routing table.

38
01:53.190 --> 01:56.550
So now we'll click on subnet associations,

39
01:56.550 --> 01:58.920
we'll scroll down here just a bit

40
01:58.920 --> 02:02.430
and we can actually edit either one of these fields,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:58.920 --> 02:02.430
and we can actually edit either one of these fields,

41
02:02.430 --> 02:07.430
but either way, we have to select edit subnet associations.

42
02:07.680 --> 02:11.130
So we'll choose the one here at the bottom.

43
02:11.130 --> 02:13.620
We'll choose our Subnet_10

44
02:13.620 --> 02:16.650
and we'll choose save associations.

45
02:16.650 --> 02:19.890
If we click on subnet associations again,

46
02:19.890 --> 02:22.140
notice that our Subnet_10

47
02:22.140 --> 02:26.220
is now under the explicit subnet associations.

48
02:26.220 --> 02:31.220
So now our subnet is associated with this routing table.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:26.220 --> 02:31.220
So now our subnet is associated with this routing table.

49
02:31.590 --> 02:35.430
Next thing we wanna do is enable route propagation.

50
02:35.430 --> 02:38.550
So now we'll go over to the route propagation tab.

51
02:38.550 --> 02:40.740
Notice that by default,

52
02:40.740 --> 02:45.570
these routes are not being propagated to our VPG.

53
02:45.570 --> 02:49.500
So what we wanna do is edit the route propagation,

54
02:49.500 --> 02:51.600
so we'll choose this option.

55
02:51.600 --> 02:55.680
We simply have to choose enable and we hit save.

56
02:55.680 --> 02:57.900
If we go back to route propagation,

57
02:57.900 --> 03:01.380
we see that propagation is now set to yes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:57.900 --> 03:01.380
we see that propagation is now set to yes.

58
03:01.380 --> 03:04.020
So now that we have our own route table,

59
03:04.020 --> 03:06.930
let's go back to our route tables,

60
03:06.930 --> 03:11.370
select our default route table and under actions,

61
03:11.370 --> 03:14.250
we'll simply choose to delete the route table.

62
03:14.250 --> 03:16.230
We have to verify.

63
03:16.230 --> 03:17.850
And hit delete.

64
03:17.850 --> 03:22.200
So now we have just the route table that we've created.

65
03:22.200 --> 03:24.990
So now that we have our new route table created,

66
03:24.990 --> 03:27.420
let's make a new security group.

67
03:27.420 --> 03:29.430
So this is down here under security.

68
03:29.430 --> 03:31.620
We'll simply go to security groups.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:29.430 --> 03:31.620
We'll simply go to security groups.

69
03:31.620 --> 03:33.510
Once again, we see the default.

70
03:33.510 --> 03:36.390
We'll go ahead and create a security group.

71
03:36.390 --> 03:39.360
For the name, we'll just call it SG_1.

72
03:39.360 --> 03:42.120
Now, for this one, the description is required,

73
03:42.120 --> 03:45.780
so we'll just call this, CorporateTraffic.

74
03:45.780 --> 03:50.700
Of course, for the VPC, we will choose our VPC

75
03:50.700 --> 03:53.130
and then we'll create some inbound rules.

76
03:53.130 --> 03:55.770
So let's start by adding a rule.

77
03:55.770 --> 03:57.600
The first one we'll create will simply be

78
03:57.600 --> 04:00.750
to allow ICMP, so pings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:57.600 --> 04:00.750
to allow ICMP, so pings.

79
04:00.750 --> 04:04.230
So we'll say all ICMP version 4.

80
04:04.230 --> 04:05.490
Since we chose that,

81
04:05.490 --> 04:08.490
it automatically put in the protocol ICMP,

82
04:08.490 --> 04:10.530
the port range of all.

83
04:10.530 --> 04:15.000
For the source, we'll allow this from anywhere.

84
04:15.000 --> 04:16.980
We'll scroll down a little bit here

85
04:16.980 --> 04:19.650
and we'll make another new rule.

86
04:19.650 --> 04:24.540
This one will be for remote desktop protocol or RDP traffic.

87
04:24.540 --> 04:29.340
So on our dropdown, there actually is an entry for RDP.

88
04:29.340 --> 04:31.530
We can simply choose that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:29.340 --> 04:31.530
We can simply choose that.

89
04:31.530 --> 04:34.530
And again, it'll automatically fill in the TCP

90
04:34.530 --> 04:37.800
and the port 3489.

91
04:37.800 --> 04:40.800
Once again, we'll allow this from anywhere.

92
04:40.800 --> 04:42.210
You could of course restrict this

93
04:42.210 --> 04:44.550
just to your own IP addresses,

94
04:44.550 --> 04:46.950
but for the sake of simplicity for now,

95
04:46.950 --> 04:49.980
we're just going to allow it to come in from anywhere.

96
04:49.980 --> 04:52.500
Now, if we scroll down a little bit further,

97
04:52.500 --> 04:55.410
we'll notice that there is a default outbound rule

98
04:55.410 --> 04:58.680
that simply allows all traffic to everywhere.

99
04:58.680 --> 05:02.460
And for our purposes, that will work perfectly fine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:58.680 --> 05:02.460
And for our purposes, that will work perfectly fine.

100
05:02.460 --> 05:03.930
So everything here looks correct.

101
05:03.930 --> 05:05.730
If we continue scrolling down,

102
05:05.730 --> 05:09.000
we have the option to create this security group.

103
05:09.000 --> 05:11.380
So here we have our security group created

104
05:12.750 --> 05:14.640
and if we look down here at the bottom,

105
05:14.640 --> 05:18.870
we can see our inbound rules being listed here on this page.

106
05:18.870 --> 05:21.750
Now, unlike our routing table,

107
05:21.750 --> 05:24.300
if we go back to security groups

108
05:24.300 --> 05:26.490
and we select our default security group,

109
05:26.490 --> 05:28.740
which is already selected here,

110
05:28.740 --> 05:33.060
we choose actions, delete security groups,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:28.740 --> 05:33.060
we choose actions, delete security groups,

111
05:33.060 --> 05:34.710
we're gonna get an error message

112
05:34.710 --> 05:37.050
telling us that it cannot be deleted

113
05:37.050 --> 05:39.900
because it's the default security group.

114
05:39.900 --> 05:43.260
The default security group cannot be deleted,

115
05:43.260 --> 05:45.540
so we'll simply cancel,

116
05:45.540 --> 05:49.680
but our security group is in effect along with the default.

117
05:49.680 --> 05:50.880
So this should still function

118
05:50.880 --> 05:53.220
the way that we want it to function.

119
05:53.220 --> 05:56.580
So now that we have our new routing table set up

120
05:56.580 --> 05:58.980
and our security group set up,

121
05:58.980 --> 06:01.290
our last thing we really need to do here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:58.980 --> 06:01.290
our last thing we really need to do here

122
06:01.290 --> 06:03.960
is export this configuration

123
06:03.960 --> 06:06.690
so that we can get the pieces that we need out of it

124
06:06.690 --> 06:09.780
for our IOS XE configuration,

125
06:09.780 --> 06:12.783
and that's exactly what we're gonna do in the next video.