WEBVTT

1
00:02.790 --> 00:04.650
So for our first step here,

2
00:04.650 --> 00:08.820
we're gonna jump in and create the IKE version two key chain

3
00:08.820 --> 00:12.510
that we're going to use for our phase one negotiations.

4
00:12.510 --> 00:15.210
Now, this is a fairly easy process,

5
00:15.210 --> 00:17.490
but we are going to need that information

6
00:17.490 --> 00:20.520
that we collected in the previous skill

7
00:20.520 --> 00:24.750
where we downloaded the configuration from AWS.

8
00:24.750 --> 00:27.180
So if you don't have that, again,

9
00:27.180 --> 00:30.030
I would encourage you to go back and review that skill
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.180 --> 00:30.030
I would encourage you to go back and review that skill

10
00:30.030 --> 00:32.160
and see how to collect that information

11
00:32.160 --> 00:34.740
from your AWS environment.

12
00:34.740 --> 00:37.710
I, however, have that text document saved.

13
00:37.710 --> 00:40.620
So we're just gonna use the document that we created earlier

14
00:40.620 --> 00:43.500
to fill in the blanks in our scrub configuration

15
00:43.500 --> 00:45.810
down below here and we're gonna use that

16
00:45.810 --> 00:49.830
to configure the key chain on our iOS XE router.

17
00:49.830 --> 00:52.803
So let's go ahead and jump into router one and get started.

18
00:54.420 --> 00:55.950
So, of course, the first thing we have to do

19
00:55.950 --> 00:58.080
is go into configuration mode

20
00:58.080 --> 01:00.330
and then we're gonna start this off
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.080 --> 01:00.330
and then we're gonna start this off

21
01:00.330 --> 01:05.330
with crypto IKE version two and we wanna make a keyring.

22
01:05.940 --> 01:08.250
Here, we just have to give it a name.

23
01:08.250 --> 01:12.390
So we'll call it something like AWS keys.

24
01:12.390 --> 01:15.720
This will drop us into keyring configuration.

25
01:15.720 --> 01:17.610
Under keyring configuration,

26
01:17.610 --> 01:20.190
the first thing that's gonna want is a peer.

27
01:20.190 --> 01:22.620
So we'll type the word peer and after this,

28
01:22.620 --> 01:25.080
it's simply once again a name.

29
01:25.080 --> 01:29.970
So we'll call this something like AWS tunnel one.

30
01:29.970 --> 01:31.590
This is the key that's going to be used
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:29.970 --> 01:31.590
This is the key that's going to be used

31
01:31.590 --> 01:34.200
specifically for tunnel one.

32
01:34.200 --> 01:37.920
This will then drop us into peer configuration mode.

33
01:37.920 --> 01:39.540
Things that it's gonna want here,

34
01:39.540 --> 01:43.080
well, first it's going to want an address.

35
01:43.080 --> 01:46.050
What IP address is going to be associated

36
01:46.050 --> 01:49.260
with this particular key that we're going to put in

37
01:49.260 --> 01:51.727
and here's where it's going to want an IPV4

38
01:51.727 --> 01:53.940
or IPV6 address.

39
01:53.940 --> 01:56.280
Now, of course, we're just setting this up

40
01:56.280 --> 01:58.050
over the IPV4 internet.

41
01:58.050 --> 02:00.870
So we're gonna be using an IPV4 address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.050 --> 02:00.870
So we're gonna be using an IPV4 address.

42
02:00.870 --> 02:03.570
We need this from our text document.

43
02:03.570 --> 02:07.290
So let's switch over to Notepad++.

44
02:07.290 --> 02:09.360
Again, this is for tunnel one,

45
02:09.360 --> 02:11.550
and what we're looking for at this moment

46
02:11.550 --> 02:14.340
is the address of the pier.

47
02:14.340 --> 02:17.790
So that would actually be this number right here.

48
02:17.790 --> 02:22.355
So the 34.198.23. 55.

49
02:22.355 --> 02:25.080
We'll just hit control C, copy that

50
02:25.080 --> 02:27.870
and then we can switch back over to router one.

51
02:27.870 --> 02:31.860
We'll simply paste this in and we'll hit enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:27.870 --> 02:31.860
We'll simply paste this in and we'll hit enter.

52
02:31.860 --> 02:33.450
The next thing, of course, we need to configure,

53
02:33.450 --> 02:37.590
we can see it right here, is the pre-shared key.

54
02:37.590 --> 02:39.270
For the pre-shared key,

55
02:39.270 --> 02:41.430
it wants to know things like if we're going to enter

56
02:41.430 --> 02:44.370
an encrypted or an unencrypted password

57
02:44.370 --> 02:48.630
or just put in the line for the clear text user password

58
02:48.630 --> 02:52.950
or we can specify hex or local or remote.

59
02:52.950 --> 02:54.270
Well, we actually need to specify

60
02:54.270 --> 02:57.090
both the local and the remote key.

61
02:57.090 --> 02:59.340
So we'll start off with local.

62
02:59.340 --> 03:02.670
And after this, it simply wants the key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:59.340 --> 03:02.670
And after this, it simply wants the key.

63
03:02.670 --> 03:06.060
So we're putting it in in an unencrypted format

64
03:06.060 --> 03:08.370
so we can just simply paste it in.

65
03:08.370 --> 03:10.320
Let's go back over to Notepad++

66
03:10.320 --> 03:12.960
and grab the key for tunnel one.

67
03:12.960 --> 03:15.990
So, of course, this part is the key.

68
03:15.990 --> 03:20.990
We'll copy that, go back over to the router and paste it in.

69
03:21.750 --> 03:24.360
Now we also need to set up the remote key.

70
03:24.360 --> 03:26.730
So we'll say pre-share remote.

71
03:26.730 --> 03:29.490
However, we're using the same key for both.

72
03:29.490 --> 03:31.770
This is gonna be the locally used key
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:29.490 --> 03:31.770
This is gonna be the locally used key

73
03:31.770 --> 03:35.010
and the key we're talking to the remote system width,

74
03:35.010 --> 03:38.880
so we'll just go ahead and paste that in and hit enter.

75
03:38.880 --> 03:41.250
So that takes care of our first key,

76
03:41.250 --> 03:43.500
so we can exit out of this pier

77
03:43.500 --> 03:46.620
and then we'll create another pier,

78
03:46.620 --> 03:50.010
this time we'll make it AWS tunnel two.

79
03:50.010 --> 03:53.730
Once again, we need the address, that will, of course,

80
03:53.730 --> 03:57.060
be this address that we got from AWS

81
03:57.060 --> 04:00.300
and again, we need the pre-shared key
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:57.060 --> 04:00.300
and again, we need the pre-shared key

82
04:00.300 --> 04:02.520
for local and remote.

83
04:02.520 --> 04:05.460
It's the same key so we just have to copy that

84
04:05.460 --> 04:09.480
and we paste it in for local and remote.

85
04:09.480 --> 04:12.210
So let's go ahead and exit outta configuration.

86
04:12.210 --> 04:14.490
Just as a verification, we can do a show run,

87
04:14.490 --> 04:18.570
we'll do section crypto and we can see here

88
04:18.570 --> 04:22.110
that we have our key ring called AWS keys

89
04:22.110 --> 04:25.110
and then we have our two peers, one for tunnel one

90
04:25.110 --> 04:29.010
with the appropriate IP address and local and remote keys,

91
04:29.010 --> 04:34.010
as well as the one for tunnel two with its peer address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:29.010 --> 04:34.010
as well as the one for tunnel two with its peer address

92
04:34.050 --> 04:36.510
and its local and remote keys.

93
04:36.510 --> 04:37.800
So that's actually all there is

94
04:37.800 --> 04:40.593
to configuring the IKE version two key chain.

95
04:41.460 --> 04:43.260
So this is actually just the first part

96
04:43.260 --> 04:45.750
of our IKE version two configuration.

97
04:45.750 --> 04:48.510
We also have to configure things like the profile

98
04:48.510 --> 04:50.640
and the policy and so on.

99
04:50.640 --> 04:53.853
So let's go ahead and jump into that in the next video.