WEBVTT

1
00:02.610 --> 00:04.590
So our next step is going to be

2
00:04.590 --> 00:07.500
to configure the IPsec components.

3
00:07.500 --> 00:09.540
Now this is far simpler.

4
00:09.540 --> 00:11.670
First, we only have two pieces.

5
00:11.670 --> 00:13.560
We have our transform set,

6
00:13.560 --> 00:15.960
which is what says how the data itself

7
00:15.960 --> 00:18.720
will actually be encrypted in transit.

8
00:18.720 --> 00:20.610
And then we have the profile

9
00:20.610 --> 00:23.280
which ties together a few different pieces.

10
00:23.280 --> 00:27.120
The transform set, our IKE version two profile,

11
00:27.120 --> 00:28.920
these things are gonna be brought together

12
00:28.920 --> 00:31.380
into our IPsec profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.920 --> 00:31.380
into our IPsec profile.

13
00:31.380 --> 00:34.050
So this is gonna be a fairly easy configuration.

14
00:34.050 --> 00:35.070
Let's just go ahead and jump

15
00:35.070 --> 00:36.270
into the command line,

16
00:36.270 --> 00:38.973
and get this configuration on router one.

17
00:41.070 --> 00:42.600
So let's jump in with configuring

18
00:42.600 --> 00:44.550
our transform set.

19
00:44.550 --> 00:46.920
So this is gonna start with crypto,

20
00:46.920 --> 00:49.170
It's ipsec this time,

21
00:49.170 --> 00:52.530
and we're going to set, transform-set.

22
00:52.530 --> 00:54.900
First thing it's going to want is a name.

23
00:54.900 --> 00:56.613
So we'll just call this TS_AWS,

24
00:57.900 --> 01:00.480
So, transform-set for AWS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.900 --> 01:00.480
So, transform-set for AWS,

25
01:00.480 --> 01:02.220
and then we have to specify

26
01:02.220 --> 01:04.440
the encryption that we want to use.

27
01:04.440 --> 01:07.950
Now remember, we only left ourself one choice

28
01:07.950 --> 01:11.070
when we configured our AWS side.

29
01:11.070 --> 01:16.070
So this has to be an esp-gcm option.

30
01:16.440 --> 01:20.010
So, esp-gcm,

31
01:20.010 --> 01:22.710
and we can choose the number of bits.

32
01:22.710 --> 01:24.720
Once again, the only option that we

33
01:24.720 --> 01:28.080
left available was 256.

34
01:28.080 --> 01:28.913
We have to, of course,

35
01:28.913 --> 01:32.580
match what AWS is going to allow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.913 --> 01:32.580
match what AWS is going to allow.

36
01:32.580 --> 01:34.440
This is what's going to control

37
01:34.440 --> 01:37.590
how the traffic actually gets encrypted.

38
01:37.590 --> 01:39.180
Also, we're gonna want to set this

39
01:39.180 --> 01:40.950
to mode tunnel.

40
01:40.950 --> 01:44.550
That is the default on some platforms.

41
01:44.550 --> 01:46.950
I've seen a large variety of platforms

42
01:46.950 --> 01:50.160
that default to mode tunnel and those that don't.

43
01:50.160 --> 01:51.810
So, me personally,

44
01:51.810 --> 01:54.630
if I want this to operate as a tunnel,

45
01:54.630 --> 01:55.590
I'm just going to go ahead

46
01:55.590 --> 01:58.350
and configure it as mode tunnel.

47
01:58.350 --> 01:59.670
Next thing we're going to need

48
01:59.670 --> 02:02.430
is our IPsec profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.670 --> 02:02.430
is our IPsec profile.

49
02:02.430 --> 02:05.070
So, crypto ipsec profile,

50
02:05.070 --> 02:06.840
once again, it needs a name,

51
02:06.840 --> 02:08.733
so we'll call this IPSEC_PROFILE_AWS.

52
02:11.970 --> 02:12.810
In the profile,

53
02:12.810 --> 02:14.790
one of the first things we're gonna wanna do

54
02:14.790 --> 02:17.070
is set the transform set.

55
02:17.070 --> 02:19.740
So this gonna bring in the TS_AWS

56
02:19.740 --> 02:22.740
transform set that we just created above.

57
02:22.740 --> 02:24.810
This, of course, is telling it how

58
02:24.810 --> 02:26.670
to handle the traffic.

59
02:26.670 --> 02:30.000
Then we wanna tell it how to do authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:30.000 --> 02:32.910
So we're gonna say, set pfs,

61
02:32.910 --> 02:35.460
and for this we're gonna do, group20.

62
02:35.460 --> 02:37.350
The last thing we want to do is

63
02:37.350 --> 02:40.650
tie in our IKE version two profile.

64
02:40.650 --> 02:44.580
So we say, set ikev2-profile

65
02:44.580 --> 02:46.830
and we simply put in the name.

66
02:46.830 --> 02:51.830
So this is IKEV2_PROFILE_AWS.

67
02:52.470 --> 02:54.330
Let's exit out of configuration,

68
02:54.330 --> 02:56.610
and do some verification.

69
02:56.610 --> 03:01.610
First, we'll do a sh crypto ipsec transform-set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:56.610 --> 03:01.610
First, we'll do a sh crypto ipsec transform-set.

70
03:02.070 --> 03:03.720
Two things to note here.

71
03:03.720 --> 03:05.910
First, notice that much like

72
03:05.910 --> 03:08.310
our IKE version two components,

73
03:08.310 --> 03:10.500
we have some defaults here.

74
03:10.500 --> 03:13.470
So there is a transform set default.

75
03:13.470 --> 03:15.150
But, of course, what we're really

76
03:15.150 --> 03:18.030
looking for is the one that we created,

77
03:18.030 --> 03:19.080
and we can see

78
03:19.080 --> 03:23.610
that it is in fact using esp-gcm 256,

79
03:23.610 --> 03:26.700
and is trying to negotiate tunnel mode

80
03:26.700 --> 03:28.650
for this connection.

81
03:28.650 --> 03:30.930
We can also take off transform set
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:28.650 --> 03:30.930
We can also take off transform set

82
03:30.930 --> 03:33.180
and put on profile.

83
03:33.180 --> 03:35.760
Once again, we see at the bottom here,

84
03:35.760 --> 03:38.580
that there's a default profile as well.

85
03:38.580 --> 03:40.560
However, what we're mostly interested

86
03:40.560 --> 03:42.870
in is the one we created, of course.

87
03:42.870 --> 03:46.380
We can see that we have our IPSEC profile,

88
03:46.380 --> 03:48.840
our IKE version two profile has been

89
03:48.840 --> 03:50.970
successfully tied to it.

90
03:50.970 --> 03:53.670
We can see that it is doing pfs,

91
03:53.670 --> 03:57.090
and it's using Diffie-Hellman group 20.

92
03:57.090 --> 03:59.100
And finally we see that it's using

93
03:59.100 --> 04:02.520
the Transform set, TS_AWS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:59.100 --> 04:02.520
the Transform set, TS_AWS,

94
04:02.520 --> 04:04.260
which as we already know,

95
04:04.260 --> 04:07.533
is using esp-gcm 256.

96
04:09.480 --> 04:11.550
So that takes care of all the components

97
04:11.550 --> 04:14.010
that we need for IPsec.

98
04:14.010 --> 04:16.350
Now that we have all of our components

99
04:16.350 --> 04:19.650
for both phase one and phase two,

100
04:19.650 --> 04:21.000
now we're finally ready

101
04:21.000 --> 04:24.030
to configure our actual tunnel interfaces.

102
04:24.030 --> 04:26.643
And that's exactly what we're gonna do next.