WEBVTT

1
00:02.670 --> 00:04.260
So here we go.

2
00:04.260 --> 00:07.050
It is finally time to configure

3
00:07.050 --> 00:11.970
the IPsec tunnel interfaces on IOS XE.

4
00:11.970 --> 00:14.610
So of course we'll be calling into play our tunnel

5
00:14.610 --> 00:17.820
protection with our IPsec profile.

6
00:17.820 --> 00:19.260
We'll be configuring our source

7
00:19.260 --> 00:21.960
and destination addresses for the tunnels,

8
00:21.960 --> 00:26.250
and if we're successful by the end of this task,

9
00:26.250 --> 00:29.700
we should have both tunnel interfaces up

10
00:29.700 --> 00:34.680
and running properly and showing that way on both sides
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.700 --> 00:34.680
and running properly and showing that way on both sides

11
00:34.680 --> 00:38.040
with our AWS VPN service.

12
00:38.040 --> 00:39.780
So let's go ahead and jump in

13
00:39.780 --> 00:43.383
and get those tunnel interfaces configured on router one.

14
00:46.260 --> 00:47.880
So the first thing we want to do

15
00:47.880 --> 00:50.400
is create a tunnel interface.

16
00:50.400 --> 00:53.400
So we'll just make interface tunnel one.

17
00:53.400 --> 00:55.920
We should probably give it something like a description,

18
00:55.920 --> 01:00.920
we'll call it like TO_AWS1 since it's gonna be tunnel one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:55.920 --> 01:00.920
we'll call it like TO_AWS1 since it's gonna be tunnel one.

19
01:01.290 --> 01:03.570
The next thing we'll want to do is of course,

20
01:03.570 --> 01:05.730
configure its IP address.

21
01:05.730 --> 01:08.370
The IP address that we're gonna use here needs

22
01:08.370 --> 01:12.990
to come from AWS since we allowed AWS to assign the

23
01:12.990 --> 01:14.910
addresses for the tunnel.

24
01:14.910 --> 01:18.369
So once again, let's switch over to notepad++

25
01:18.369 --> 01:22.470
and grab this IP address for the tunnel.

26
01:22.470 --> 01:27.470
We'll copy that, switch back over and paste it in.

27
01:27.780 --> 01:30.300
So that takes care of the IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:27.780 --> 01:30.300
So that takes care of the IP address.

28
01:30.300 --> 01:33.930
The next thing we wanna do is assign our tunnel protection.

29
01:33.930 --> 01:38.460
So tunnel protection, of course, it's IPsec.

30
01:38.460 --> 01:40.950
And we need to assign our profile.

31
01:40.950 --> 01:43.500
So we just put in the name of the profile,

32
01:43.500 --> 01:45.000
and then we have to start configuring

33
01:45.000 --> 01:47.070
other tunnel parameters.

34
01:47.070 --> 01:49.110
Let's do the tunnel source next.

35
01:49.110 --> 01:52.470
This is gonna be of course, our local outside interface,

36
01:52.470 --> 01:57.120
which is the 204.186.19.10.

37
01:57.120 --> 01:59.370
We'll set the tunnel mode.

38
01:59.370 --> 02:03.270
This is gonna be an IPsec IPv4 tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:59.370 --> 02:03.270
This is gonna be an IPsec IPv4 tunnel.

39
02:03.270 --> 02:05.670
We're gonna need our tunnel destination.

40
02:05.670 --> 02:08.643
This again, we can take from our text document.

41
02:08.643 --> 02:11.790
So this is gonna be the tunnel destination.

42
02:11.790 --> 02:13.470
And for a little bit of tweaking,

43
02:13.470 --> 02:16.200
we should probably set the MTU.

44
02:16.200 --> 02:18.270
We could figure out exactly what this needs to

45
02:18.270 --> 02:20.520
be based on the encryption we're using,

46
02:20.520 --> 02:24.060
or we could just set it to something like 1400 bytes.

47
02:24.060 --> 02:28.980
And then we should probably also adjust the TCP MSS

48
02:28.980 --> 02:31.470
or the maximum segment size.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:28.980 --> 02:31.470
or the maximum segment size.

49
02:31.470 --> 02:36.470
And this should be 40 bytes below the MTU, so 1360.

50
02:36.720 --> 02:39.780
Next, we'll configure interface tunnel two.

51
02:39.780 --> 02:42.390
This of course is going to get a lot of the same things.

52
02:42.390 --> 02:45.540
So we can just use our command history here a bit.

53
02:45.540 --> 02:47.370
We'll start with the description.

54
02:47.370 --> 02:49.443
We'll call this TO_AWS2.

55
02:50.550 --> 02:52.320
Now we need the IP address,

56
02:52.320 --> 02:53.880
but again, we know that this is coming out

57
02:53.880 --> 02:55.800
of our text document.

58
02:55.800 --> 02:58.620
So since we actually have the whole IP address command here,

59
02:58.620 --> 03:03.000
we can just take the whole thing and simply paste it in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:58.620 --> 03:03.000
we can just take the whole thing and simply paste it in.

60
03:03.000 --> 03:06.330
Tunnel protection is going to be exactly the same.

61
03:06.330 --> 03:09.030
The tunnel source is going to be the same.

62
03:09.030 --> 03:11.760
The tunnel mode is going to be the same.

63
03:11.760 --> 03:15.390
The tunnel destination, of course, is going to be different.

64
03:15.390 --> 03:17.310
So we'll switch back over to our text document

65
03:17.310 --> 03:19.260
and get the other address.

66
03:19.260 --> 03:21.690
It's gonna be going to this address, so we'll copy

67
03:21.690 --> 03:24.690
that and paste it in.

68
03:24.690 --> 03:29.690
We'll again, set the MTU and the TCP maximum segment size.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:30.750 --> 03:32.800
Let's go ahead and exact a configuration.

70
03:34.560 --> 03:36.810
And of course, here's the fun part.

71
03:36.810 --> 03:39.930
Let's see if our tunnels actually came up.

72
03:39.930 --> 03:42.780
So let's just do a show IP interface brief.

73
03:42.780 --> 03:44.760
And here we see that tunnel one

74
03:44.760 --> 03:49.350
and tunnel two are both showing as up up.

75
03:49.350 --> 03:52.770
That's good. Let's do some further verification.

76
03:52.770 --> 03:57.330
First, let's verify our IKEv2 security associations.

77
03:57.330 --> 04:00.810
We'll do a show crypto IKEv2 SA,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:57.330 --> 04:00.810
We'll do a show crypto IKEv2 SA,

78
04:00.810 --> 04:04.200
and there's a few things here that we want to take note of.

79
04:04.200 --> 04:09.200
First, notice that these are running over Port 4,500.

80
04:09.506 --> 04:13.140
Specifically, although not shown on this output,

81
04:13.140 --> 04:16.320
it is UDP Port 4,500.

82
04:16.320 --> 04:20.430
This is because we're doing Nat-T or Nat traversal.

83
04:20.430 --> 04:23.850
This runs over UDP Port 4,500.

84
04:23.850 --> 04:25.740
Notice that it automatically switched to

85
04:25.740 --> 04:29.640
that when it realized that there was a PAT device

86
04:29.640 --> 04:32.730
between the two endpoints of the tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:29.640 --> 04:32.730
between the two endpoints of the tunnel.

87
04:32.730 --> 04:36.120
Other things to note here, of course, is for the encryption,

88
04:36.120 --> 04:40.500
it is using the AES-GCM 256.

89
04:40.500 --> 04:43.710
For the PRF, it is SHA512.

90
04:43.710 --> 04:46.980
For the Diffie-Hellman group, it is group 20,

91
04:46.980 --> 04:51.090
and for our authentication, it's doing pre-shared key.

92
04:51.090 --> 04:53.310
So everything here looks good.

93
04:53.310 --> 04:56.070
Both of these have a status of ready.

94
04:56.070 --> 04:58.650
Another good command is instead of essay

95
04:58.650 --> 05:03.090
for security associations, we can do session.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:58.650 --> 05:03.090
for security associations, we can do session.

96
05:03.090 --> 05:06.270
Now, as you can see, this output is very similar.

97
05:06.270 --> 05:08.610
It gives us a lot of the same information.

98
05:08.610 --> 05:11.970
However, there is a little bit more detail here as far

99
05:11.970 --> 05:14.460
as the different child essays and so on.

100
05:14.460 --> 05:17.040
So if you need to dig into this a little bit more,

101
05:17.040 --> 05:20.670
this command gives a little bit more of an output.

102
05:20.670 --> 05:23.400
So that's some good information about phase one.

103
05:23.400 --> 05:28.400
For phase two, we can do a show crypto IPsec SA.

104
05:29.640 --> 05:32.880
Here we can see things like the local address it's using,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
05:29.640 --> 05:32.880
Here we can see things like the local address it's using,

105
05:32.880 --> 05:35.880
who the current peer is, of course, the number

106
05:35.880 --> 05:39.030
of packets being encrypted and decrypted,

107
05:39.030 --> 05:42.810
and a lot of other information about IPsec.

108
05:42.810 --> 05:45.630
If we scroll down, we can see this information

109
05:45.630 --> 05:47.820
for tunnel two as well.

110
05:47.820 --> 05:51.540
But both of these are showing zero packets being encrypted

111
05:51.540 --> 05:55.080
or decrypted, which of course would be expected right now

112
05:55.080 --> 05:56.880
because there's no traffic.

113
05:56.880 --> 06:00.480
So let's verify that we actually have throughput.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:56.880 --> 06:00.480
So let's verify that we actually have throughput.

114
06:00.480 --> 06:03.300
So once again, let's do a show IP interface brief.

115
06:03.300 --> 06:07.290
And we're doing this just to get the tunnel addresses.

116
06:07.290 --> 06:10.650
Let's do a ping and we'll start with tunnel one.

117
06:10.650 --> 06:15.650
Let's do the 169.254.85.185.

118
06:18.420 --> 06:21.420
If we let AWS choose the subnets

119
06:21.420 --> 06:23.460
or the addresses for the tunnel,

120
06:23.460 --> 06:26.670
it will always do A-30,

121
06:26.670 --> 06:29.310
and it will always configure its address

122
06:29.310 --> 06:31.020
to be the lower address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
06:29.310 --> 06:31.020
to be the lower address

123
06:31.020 --> 06:35.040
and the address it gives to us to be one number higher.

124
06:35.040 --> 06:37.950
So if we want to ping the far end of the tunnel,

125
06:37.950 --> 06:41.940
we can simply go one number lower than our address.

126
06:41.940 --> 06:43.740
So let's go ahead and give it a try.

127
06:44.880 --> 06:46.800
We can see that that's successful.

128
06:46.800 --> 06:49.350
And then let's try to ping the other tunnel.

129
06:49.350 --> 06:51.570
So that should be 209,

130
06:51.570 --> 06:54.000
and we see that's successful as well.

131
06:54.000 --> 06:58.650
So now if we look back at our IPsec SA again, notice here

132
06:58.650 --> 07:02.850
for tunnel one, we are now showing five packets being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:58.650 --> 07:02.850
for tunnel one, we are now showing five packets being

133
07:02.850 --> 07:05.190
encrypted and decrypted.

134
07:05.190 --> 07:07.260
That would be of course, our five pings.

135
07:07.260 --> 07:11.040
And if we go down to tunnel two here on tunnel two,

136
07:11.040 --> 07:13.590
we also see those five packets being

137
07:13.590 --> 07:15.240
encrypted and decrypted.

138
07:15.240 --> 07:18.240
So this means that our pings not only went over the tunnel,

139
07:18.240 --> 07:22.050
but they were properly encrypted by IPsec.

140
07:22.050 --> 07:25.980
So now, let's jump over to the AWS console

141
07:25.980 --> 07:30.450
and verify these tunnels from the AWS side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
07:25.980 --> 07:30.450
and verify these tunnels from the AWS side.

142
07:30.450 --> 07:34.620
So here on AWS, starting on the VPC dashboard,

143
07:34.620 --> 07:37.500
let's scroll down in our navigation pane

144
07:37.500 --> 07:40.350
down to the site-to-site VPNs.

145
07:40.350 --> 07:43.530
So we'll go to site-to-site VPN connections.

146
07:43.530 --> 07:46.920
It's defaulting to our VPN highlighted.

147
07:46.920 --> 07:49.650
So let's click on tunnel details.

148
07:49.650 --> 07:51.720
What we see here is that both

149
07:51.720 --> 07:55.770
of our tunnels are now showing a status of up.

150
07:55.770 --> 07:58.320
So this means that we've now successfully

151
07:58.320 --> 08:03.037
configured our tunnels on both IOS XE and AWS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
07:58.320 --> 08:03.037
configured our tunnels on both IOS XE and AWS.

152
08:05.160 --> 08:06.810
Now that both of our tunnels appear

153
08:06.810 --> 08:08.760
to be functioning properly.

154
08:08.760 --> 08:11.970
Now let's test connectivity end to end

155
08:11.970 --> 08:13.410
through our environment.

156
08:13.410 --> 08:16.663
And we'll do that by bringing up our server in the

157
08:16.663 --> 08:18.300
AWS environment.

158
08:18.300 --> 08:20.883
So let's go ahead and do that in the next video.