WEBVTT

1
00:02.700 --> 00:05.914
Next we need to configure some additional components

2
00:05.914 --> 00:09.480
for our IKE version 2 configuration.

3
00:09.480 --> 00:13.740
What I like to refer to as the three Ps, we first have

4
00:13.740 --> 00:16.797
to make a proposal, then we have to create a policy

5
00:16.797 --> 00:19.837
and we have to create a profile.

6
00:19.837 --> 00:23.157
These are different components that make up a framework

7
00:23.157 --> 00:24.960
for us to be able to configure

8
00:24.960 --> 00:27.420
our IKE version 2 configuration.

9
00:27.420 --> 00:30.510
These different components will all be tied together
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.420 --> 00:30.510
These different components will all be tied together

10
00:30.510 --> 00:32.940
to create the complete configuration.

11
00:32.940 --> 00:35.490
So let's just go ahead and jump into the command line

12
00:35.490 --> 00:37.736
and we'll look at each of these in more detail

13
00:37.736 --> 00:39.160
as we go through.

14
00:39.160 --> 00:41.193
Let's go ahead and get started.

15
00:42.840 --> 00:45.630
So let's start with making our proposal.

16
00:45.630 --> 00:47.896
So of course we go into configuration mode.

17
00:47.896 --> 00:49.718
We'll go into crypto.

18
00:49.718 --> 00:52.579
This is again for version 2,

19
00:52.579 --> 00:56.019
and here we need to create our proposal.

20
00:56.019 --> 00:59.820
For the proposal, we need to start off just giving it

21
00:59.820 --> 01:01.050
a name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.820 --> 01:01.050
a name.

22
01:01.050 --> 01:06.050
So let's call it IKE v2 proposal for AWS.

23
01:06.339 --> 01:09.493
Now, what do we actually configure in the proposal?

24
01:09.493 --> 01:12.157
Well, we can actually see right away

25
01:12.157 --> 01:14.099
that it gives us this message

26
01:14.099 --> 01:17.912
that the proposal must either have a set

27
01:17.912 --> 01:22.760
of an encryption algorithm other than AES GCM,

28
01:22.760 --> 01:27.450
an integrity algorithm, and a Diffie-Hellman group

29
01:27.450 --> 01:31.379
configured or an encryption algorithm
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:27.450 --> 01:31.379
configured or an encryption algorithm

30
01:31.379 --> 01:36.019
that is AES GCM a PRF algorithm

31
01:36.019 --> 01:38.820
and a Diffie-Hellman group.

32
01:38.820 --> 01:41.477
Well, for AWS, we're actually gonna be using

33
01:41.477 --> 01:43.740
the PRF algorithm,

34
01:43.740 --> 01:46.797
so we're gonna be using the second option here.

35
01:46.797 --> 01:49.656
So let's start off with our encryption.

36
01:49.656 --> 01:54.296
And as it says, this has to be a GCM algorithm.

37
01:54.296 --> 01:56.700
Well, we already said that that's what this supports

38
01:56.700 --> 02:00.819
anyway, so we'll say AES GCM.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:56.700 --> 02:00.819
anyway, so we'll say AES GCM.

39
02:00.819 --> 02:04.157
And if you remember, we ended up in AWS

40
02:04.157 --> 02:08.040
with only supporting 256.

41
02:08.040 --> 02:10.440
That was the only option we left on

42
02:10.440 --> 02:12.720
so that's what we're going to use here.

43
02:12.720 --> 02:15.894
Then we have to configure the PRF algorithm.

44
02:15.894 --> 02:19.260
For this, we'll be using SHA512.

45
02:19.260 --> 02:21.330
Once again, it is the only one

46
02:21.330 --> 02:23.790
that we left enabled in our environment.

47
02:23.790 --> 02:27.090
So from that perspective, we don't have any choice.

48
02:27.090 --> 02:29.610
We could have of course, left ourselves a choice,

49
02:29.610 --> 02:30.952
but we chose not to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:29.610 --> 02:30.952
but we chose not to.

50
02:30.952 --> 02:33.630
And then of course, we have to configure

51
02:33.630 --> 02:35.580
the Diffie-Hellman Group.

52
02:35.580 --> 02:39.813
And for that we only left Diffie-Hellman Group 20 enabled

53
02:39.813 --> 02:42.540
so once again, we don't really have a choice here,

54
02:42.540 --> 02:45.176
although of course realistically we do,

55
02:45.176 --> 02:47.790
but we only left this one option on

56
02:47.790 --> 02:50.152
so we'll set this to group 20.

57
02:50.152 --> 02:52.054
So that takes care of the proposal.

58
02:52.054 --> 02:54.536
Now let's create the policy.

59
02:54.536 --> 02:57.420
So we can actually use our command history here a bit

60
02:57.420 --> 02:59.792
because we're gonna keep this pretty similar.

61
02:59.792 --> 03:04.056
So instead of proposal, this will be policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:59.792 --> 03:04.056
So instead of proposal, this will be policy.

62
03:04.056 --> 03:06.536
So we'll simply change those two things.

63
03:06.536 --> 03:10.410
And notice for this one, it gives us yet another message,

64
03:10.410 --> 03:12.840
that a policy must have at least

65
03:12.840 --> 03:15.112
one complete proposal attached.

66
03:15.112 --> 03:19.373
Well, we have a proposal, so we can specify our proposal.

67
03:19.373 --> 03:24.373
And again, this is IKE version 2 proposal for AWS.

68
03:26.093 --> 03:29.390
So we simply put our proposal name in here

69
03:29.390 --> 03:32.970
and it also of course needs to know which tunnels
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:29.390 --> 03:32.970
and it also of course needs to know which tunnels

70
03:32.970 --> 03:34.470
to use this for.

71
03:34.470 --> 03:37.451
So we're going to specify a match here,

72
03:37.451 --> 03:40.813
and we're gonna match an IP address.

73
03:40.813 --> 03:44.970
We'll use a local address, and we're gonna be

74
03:44.970 --> 03:48.136
using our outside interface for this, which is

75
03:48.136 --> 03:48.969
204.186

76
03:50.965 --> 03:52.800
.19.10

77
03:52.800 --> 03:55.830
This is the outside interface on this router.

78
03:55.830 --> 03:59.235
We can verify this if we do a show IP interface brief.

79
03:59.235 --> 04:02.490
We see here that our gigabit one interface has
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.235 --> 04:02.490
We see here that our gigabit one interface has

80
04:02.490 --> 04:04.020
that address on it.

81
04:04.020 --> 04:05.250
That's what we're gonna be using

82
04:05.250 --> 04:07.133
for the outside interface here.

83
04:07.133 --> 04:11.070
Or ultimately you could say for the tunnel source.

84
04:11.070 --> 04:13.816
So that's actually all we need in the policy.

85
04:13.816 --> 04:17.853
We're tying the proposal to the local address

86
04:17.853 --> 04:20.173
that's going to be the source of the tunnel.

87
04:20.173 --> 04:23.731
So the next thing we have to create is the profile.

88
04:23.731 --> 04:26.520
So we'll go ahead and exit out here.

89
04:26.520 --> 04:29.315
And once again, we can make a few changes on our history.

90
04:29.315 --> 04:31.773
Simply change this to profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:29.315 --> 04:31.773
Simply change this to profile.

91
04:31.773 --> 04:36.390
And once again, it's telling us the minimum of what needs

92
04:36.390 --> 04:37.530
to be in here.

93
04:37.530 --> 04:40.950
It has to have a local and a remote authentication method,

94
04:40.950 --> 04:44.013
which in our case is simply going to be pre-shared key.

95
04:44.013 --> 04:46.555
That's gonna tell it that it's gonna use a key chain.

96
04:46.555 --> 04:50.160
We of course then have to tell it the key chain as well,

97
04:50.160 --> 04:52.740
but we have to tell it here that it's using pre-shared key

98
04:52.740 --> 04:54.856
so it knows to even look for a key chain.

99
04:54.856 --> 04:58.530
And of course it has to have a match identity

100
04:58.530 --> 05:02.755
or match certificate or match any statement so it knows when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:58.530 --> 05:02.755
or match certificate or match any statement so it knows when

101
05:02.755 --> 05:04.989
to use this profile.

102
05:04.989 --> 05:09.613
So let's start with matching both the local address

103
05:09.613 --> 05:11.037
and the remote.

104
05:11.037 --> 05:14.717
So let's start off with a match address.

105
05:14.717 --> 05:18.390
Once again, it'll be local and we'll put in

106
05:18.390 --> 05:19.530
our local address,

107
05:19.530 --> 05:22.595
which is the 204.186.19.10.

108
05:22.595 --> 05:26.932
Just a quick note on this, in case it's not obvious,

109
05:26.932 --> 05:29.513
this is the actual address

110
05:29.513 --> 05:33.373
or the interface address on this router.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
05:29.513 --> 05:33.373
or the interface address on this router.

111
05:33.373 --> 05:38.010
This is not the nat outside address like we used

112
05:38.010 --> 05:40.290
in the AWS configuration.

113
05:40.290 --> 05:42.651
So this is sort of the inside

114
05:42.651 --> 05:46.315
but external interface on this router.

115
05:46.315 --> 05:49.851
The address that's going to be the source for our tunnels.

116
05:49.851 --> 05:52.980
Next, we wanna do a match identity.

117
05:52.980 --> 05:54.953
And then on this we're gonna say remote.

118
05:54.953 --> 05:57.254
And we're gonna specify an address.

119
05:57.254 --> 06:01.470
Now for this, we're going to need the tunnel destination
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:57.254 --> 06:01.470
Now for this, we're going to need the tunnel destination

120
06:01.470 --> 06:02.614
address again.

121
06:02.614 --> 06:06.534
So let's switch back over to our notepad plus plus.

122
06:06.534 --> 06:10.374
And here we'll grab the destination address for tunnel one,

123
06:10.374 --> 06:13.510
switch back, paste it in,

124
06:13.510 --> 06:16.971
and then we're gonna do another remote identity

125
06:16.971 --> 06:19.413
for the other address.

126
06:26.760 --> 06:29.070
Next, we'll configure an identity.

127
06:29.070 --> 06:32.460
This one will do for the local address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:29.070 --> 06:32.460
This one will do for the local address.

128
06:32.460 --> 06:35.094
And again, this is gonna be our local address.

129
06:35.094 --> 06:38.811
So this is the 204.186.19.10

130
06:38.811 --> 06:42.840
Now remember it also said that we have to configure a local

131
06:42.840 --> 06:45.360
and remote authentication method.

132
06:45.360 --> 06:49.470
So let's say authentication, we'll start with local

133
06:49.470 --> 06:51.780
and we can see here there's a few different choices.

134
06:51.780 --> 06:54.930
But again, we are using pre-shared key.

135
06:54.930 --> 06:57.090
So we'll just say pre-share,

136
06:57.090 --> 06:59.048
and then authentication remote.

137
06:59.048 --> 07:02.700
Once again, pre-share.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
06:59.048 --> 07:02.700
Once again, pre-share.

138
07:02.700 --> 07:05.580
Now since we're doing pre-share key, we of course have

139
07:05.580 --> 07:07.680
to tell it the key ring to use.

140
07:07.680 --> 07:09.589
So this is a local key ring

141
07:09.589 --> 07:13.311
and we called it AWS keys.

142
07:13.311 --> 07:17.173
One last thing here we want to configure is the DPD,

143
07:17.173 --> 07:21.750
which is IKE liveliness check for peers.

144
07:21.750 --> 07:24.549
So if we say DPD and we hit question mark,

145
07:24.549 --> 07:27.420
we see here where we can configure an interval,

146
07:27.420 --> 07:28.869
we'll just put in 10.

147
07:28.869 --> 07:33.330
Then after how many retries do we declare the neighbor dead?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
07:28.869 --> 07:33.330
Then after how many retries do we declare the neighbor dead?

148
07:33.330 --> 07:34.620
We'll say two.

149
07:34.620 --> 07:36.191
So we'll use the shortest timers

150
07:36.191 --> 07:38.700
and then we can choose whether we're gonna do this either

151
07:38.700 --> 07:40.954
periodically or on-demand.

152
07:40.954 --> 07:44.437
on-demand would simply mean when we need to send traffic.

153
07:44.437 --> 07:47.311
So we'll just simply say on-demand.

154
07:47.311 --> 07:50.100
So that should take care of configuring all

155
07:50.100 --> 07:51.631
of our necessary components.

156
07:51.631 --> 07:54.780
Let's go ahead and exit out of configuration

157
07:54.780 --> 07:57.690
and verify this with a few show commands.

158
07:57.690 --> 08:02.690
So let's start with a show Crypto IKE version 2 proposal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:57.690 --> 08:02.690
So let's start with a show Crypto IKE version 2 proposal.

159
08:04.250 --> 08:08.170
So the first thing to note is right here is

160
08:08.170 --> 08:11.187
our Ike v2 proposal for AWS,

161
08:11.187 --> 08:15.167
it's using AES GCM 256

162
08:15.167 --> 08:19.080
with the PRF SHA512

163
08:19.080 --> 08:22.170
and the Diffie-Hellman Group, Group 20.

164
08:22.170 --> 08:23.746
Notice also, however,

165
08:23.746 --> 08:27.948
that there is built in, a default proposal.

166
08:27.948 --> 08:30.648
I don't see a lot of people do it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
08:27.948 --> 08:30.648
I don't see a lot of people do it.

167
08:30.648 --> 08:34.680
However, be aware that there is a default for each

168
08:34.680 --> 08:37.791
of these components that could potentially be modified

169
08:37.791 --> 08:40.920
and made to work in this situation.

170
08:40.920 --> 08:42.970
Again, I don't generally see it done

171
08:42.970 --> 08:45.050
we usually make our own components.

172
08:45.050 --> 08:47.807
However, there are defaults in here

173
08:47.807 --> 08:49.825
that we could potentially use.

174
08:49.825 --> 08:54.549
We can just hit up here and take a look at the policy.

175
08:54.549 --> 08:57.930
Notice there's a default policy as well,

176
08:57.930 --> 09:00.970
but more importantly, we see that the policy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:57.930 --> 09:00.970
but more importantly, we see that the policy

177
09:00.970 --> 09:04.287
that we configured is also in place.

178
09:04.287 --> 09:06.911
And finally, we can look at the profile.

179
09:06.911 --> 09:10.410
So here we see our profile that we configured

180
09:10.410 --> 09:14.149
and we see where it's matching up the local address

181
09:14.149 --> 09:16.969
to the remote address identifiers.

182
09:16.969 --> 09:19.189
We look a little further down.

183
09:19.189 --> 09:22.890
We see that it's in fact using pre-share key.

184
09:22.890 --> 09:25.170
We see that it's tied to our key ring

185
09:25.170 --> 09:28.407
and we see that our DPD interval is set to 10

186
09:28.407 --> 09:32.511
with a retry interval of two, and it's set to on-demand.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

186
09:28.407 --> 09:32.511
with a retry interval of two, and it's set to on-demand.

187
09:32.511 --> 09:37.007
Now notice that the profile doesn't have a default.

188
09:37.007 --> 09:40.527
So in any case, we have to make the profile,

189
09:40.527 --> 09:44.410
but it could use the default proposal and policy.

190
09:44.410 --> 09:48.510
So this takes care of all the components that we need

191
09:48.510 --> 09:50.400
for IKE version 2.

192
09:50.400 --> 09:53.400
So up next, let's go in and create the components

193
09:53.400 --> 09:55.650
that we need for IP sec.

194
09:55.650 --> 09:57.960
That's actually going to be much shorter,

195
09:57.960 --> 09:59.567
much easier config.

196
09:59.567 --> 10:02.043
Let's check it out in the next video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
09:59.567 --> 10:02.043
Let's check it out in the next video.