WEBVTT

1
00:02.670 --> 00:05.040
So for some final verification,

2
00:05.040 --> 00:07.530
let's jump into AWS

3
00:07.530 --> 00:11.520
and we'll deploy a Windows 2022 server

4
00:11.520 --> 00:15.660
into Subnet 10 in our VPC.

5
00:15.660 --> 00:18.750
We'll use that to verify connectivity

6
00:18.750 --> 00:20.700
between workstation one,

7
00:20.700 --> 00:23.820
that we already have set up at our headquarters site,

8
00:23.820 --> 00:25.890
and of course this new server

9
00:25.890 --> 00:27.600
that we're going to be building.

10
00:27.600 --> 00:30.060
Now be aware as we go through this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.600 --> 00:30.060
Now be aware as we go through this,

11
00:30.060 --> 00:34.650
some of the steps in this task will take quite a few minutes

12
00:34.650 --> 00:37.380
and we'll be cutting that out of the video.

13
00:37.380 --> 00:39.930
So rather than saying it every time,

14
00:39.930 --> 00:43.050
just be aware that if you are following along

15
00:43.050 --> 00:46.020
and your steps are taking a little bit longer,

16
00:46.020 --> 00:47.130
that's okay.

17
00:47.130 --> 00:50.010
We're just gonna be cutting out some of the dead space

18
00:50.010 --> 00:51.390
here in the video.

19
00:51.390 --> 00:53.670
So let's go ahead and jump into AWS

20
00:53.670 --> 00:56.853
and get that Windows server deploying in our environment.

21
00:58.650 --> 01:00.420
So here in AWS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.650 --> 01:00.420
So here in AWS,

22
01:00.420 --> 01:03.600
there's actually two quick things we need to do first

23
01:03.600 --> 01:07.620
just so we can RDP or Remote Desktop Protocol

24
01:07.620 --> 01:10.620
into our server once we get it built.

25
01:10.620 --> 01:11.940
The first thing we're gonna need

26
01:11.940 --> 01:15.270
is an internet gateway for our VPC.

27
01:15.270 --> 01:17.700
So this is a very quick, easy process.

28
01:17.700 --> 01:20.640
We simply click on internet gateways,

29
01:20.640 --> 01:22.680
we of course don't have one,

30
01:22.680 --> 01:25.470
so we'll say create internet gateway.

31
01:25.470 --> 01:28.500
For the name, we'll just call it IG1,

32
01:28.500 --> 01:31.950
and we simply hit create internet gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.500 --> 01:31.950
and we simply hit create internet gateway.

33
01:31.950 --> 01:35.910
Once it's created, notice that it currently says detached,

34
01:35.910 --> 01:37.830
but in the green bar at the top

35
01:37.830 --> 01:39.810
telling us that we just created it,

36
01:39.810 --> 01:43.290
it gives us an option to attach it to a VPC.

37
01:43.290 --> 01:46.650
We could of course do this under the actions menu as well,

38
01:46.650 --> 01:49.230
but since it gave us this very convenient button,

39
01:49.230 --> 01:51.840
let's just click on attach to a VPC,

40
01:51.840 --> 01:56.220
and of course we'll simply choose our one and only VPC.

41
01:56.220 --> 01:58.254
We'll attach the internet gateway,

42
01:58.254 --> 02:02.640
and now our VPC has a way out to the internet,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:58.254 --> 02:02.640
and now our VPC has a way out to the internet,

43
02:02.640 --> 02:04.440
however it needs to know that.

44
02:04.440 --> 02:08.970
So we also need to add a default route to our routing table.

45
02:08.970 --> 02:11.460
So let's go over to our routing table.

46
02:11.460 --> 02:14.160
So let's go ahead and click on our routing table,

47
02:14.160 --> 02:15.900
we'll click on routes.

48
02:15.900 --> 02:17.580
Two things to note here,

49
02:17.580 --> 02:22.170
we have our 10.10.0.0/16

50
02:22.170 --> 02:24.960
currently going to our virtual gateway.

51
02:24.960 --> 02:28.770
And of course we have the 10.20.0.0/16

52
02:28.770 --> 02:30.570
being routed locally.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:28.770 --> 02:30.570
being routed locally.

53
02:30.570 --> 02:32.490
We need a default route

54
02:32.490 --> 02:35.430
pointing to the internet gateway we just created.

55
02:35.430 --> 02:37.710
So let's click on edit routes.

56
02:37.710 --> 02:39.630
We're gonna add a route,

57
02:39.630 --> 02:41.460
default route,

58
02:41.460 --> 02:43.050
and for the target,

59
02:43.050 --> 02:45.960
we're going to choose internet gateway,

60
02:45.960 --> 02:50.430
and then we'll hit search and choose our internet gateway.

61
02:50.430 --> 02:52.530
We'll hit save changes

62
02:52.530 --> 02:54.510
and now under the routing table

63
02:54.510 --> 02:58.350
we have a default route pointing to our internet gateway.

64
02:58.350 --> 02:59.670
With all of this configured,

65
02:59.670 --> 03:02.910
we should now be ready to deploy our server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:59.670 --> 03:02.910
we should now be ready to deploy our server.

66
03:02.910 --> 03:06.930
So for this, we need to go to the EC2 section of AWS.

67
03:06.930 --> 03:09.030
There's a couple ways to get there.

68
03:09.030 --> 03:12.960
We could actually just go to the VPC dashboard if we want.

69
03:12.960 --> 03:14.490
And right up here at the top,

70
03:14.490 --> 03:18.240
there's actually a choice to launch an EC2 instance.

71
03:18.240 --> 03:20.243
Let's just go ahead and click on it here.

72
03:25.650 --> 03:27.750
So for launching our instance,

73
03:27.750 --> 03:29.790
the first thing we wanna do is give it a name.

74
03:29.790 --> 03:32.312
We said that this is gonna be SRV1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:29.790 --> 03:32.312
We said that this is gonna be SRV1.

75
03:32.312 --> 03:33.720
If we scroll down,

76
03:33.720 --> 03:35.747
we then have to choose our operating system.

77
03:35.747 --> 03:37.170
For this first one,

78
03:37.170 --> 03:39.330
we're just gonna do Windows.

79
03:39.330 --> 03:43.800
Again, it will default to Windows Server 2022 base,

80
03:43.800 --> 03:45.750
that's perfectly fine.

81
03:45.750 --> 03:47.725
Let's scroll down a little further.

82
03:47.725 --> 03:49.780
We can see that it's gonna default

83
03:51.857 --> 03:53.123
to the instance type T2 micro,

84
03:54.333 --> 03:55.166
that's also fine for what we're doing.

85
03:55.166 --> 03:57.660
And then we need to choose a key pair.

86
03:57.660 --> 03:59.610
If you don't already have one,

87
03:59.610 --> 04:02.100
click right here to create a new key pair.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:59.610 --> 04:02.100
click right here to create a new key pair.

88
04:02.100 --> 04:03.990
I do have one created already,

89
04:03.990 --> 04:07.380
so I'll just choose my AWS key.

90
04:07.380 --> 04:10.080
Next, we wanna scroll down here to network settings

91
04:10.080 --> 04:12.480
and there's a few things we need to change.

92
04:12.480 --> 04:15.780
First, notice that it's defaulting to subnet 20

93
04:15.780 --> 04:17.520
so we need to change that.

94
04:17.520 --> 04:19.980
So the first thing we wanna do is click edit.

95
04:19.980 --> 04:24.180
We're gonna change our subnet from 20 to 10.

96
04:24.180 --> 04:26.910
We also want to give this a public address.

97
04:26.910 --> 04:30.309
That way we can RDP to it very easily,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:26.910 --> 04:30.309
That way we can RDP to it very easily,

98
04:30.309 --> 04:31.170
so we'll enable that.

99
04:31.170 --> 04:32.820
And we could, if we wanted to,

100
04:32.820 --> 04:35.910
create a new security group here on the firewall,

101
04:35.910 --> 04:37.950
but we've already created one.

102
04:37.950 --> 04:40.800
So we'll say select existing security group

103
04:40.800 --> 04:44.610
And we'll select our security group one.

104
04:44.610 --> 04:47.790
That should be all we need to configure about this instance,

105
04:47.790 --> 04:52.290
so now we'll just go over here and click Launch Instance.

106
04:52.290 --> 04:55.110
Now this will take of course a few minutes

107
04:55.110 --> 04:57.300
to deploy this instance.

108
04:57.300 --> 04:58.680
While we're waiting,

109
04:58.680 --> 05:00.180
first thing we'll want to do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:58.680 --> 05:00.180
first thing we'll want to do

110
05:00.180 --> 05:03.390
is click on Connect to instance here

111
05:03.390 --> 05:05.790
and there's two things we want to do.

112
05:05.790 --> 05:09.120
First is go to the RDP client

113
05:09.120 --> 05:13.170
and we'll choose to download the remote desktop file.

114
05:13.170 --> 05:14.730
This will of course download it

115
05:14.730 --> 05:17.310
to our default download directory.

116
05:17.310 --> 05:19.110
The other thing we're gonna need to do

117
05:19.110 --> 05:20.400
is scrolling down here,

118
05:20.400 --> 05:23.490
we need to get the password for Windows.

119
05:23.490 --> 05:25.890
It's going to be administrator as we can see here,

120
05:25.890 --> 05:27.424
but we need the password.

121
05:27.424 --> 05:28.257
If we click password,

122
05:28.257 --> 05:32.880
it's telling us that we're trying to do this too soon.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
05:28.257 --> 05:32.880
it's telling us that we're trying to do this too soon.

123
05:32.880 --> 05:34.110
So for right now,

124
05:34.110 --> 05:36.249
let's just go back to instances

125
05:36.249 --> 05:39.180
and we'll wait for this to fully deploy

126
05:39.180 --> 05:42.780
and for our status checks to show okay.

127
05:42.780 --> 05:44.500
This will take a few moments

128
05:45.428 --> 05:46.261
so this is one of those sections

129
05:46.261 --> 05:48.330
where we will skip ahead.

130
05:48.330 --> 05:50.100
So now that it's been a few minutes,

131
05:50.100 --> 05:52.920
we see that our status checks are now passed.

132
05:52.920 --> 05:55.800
So now if we highlight our server,

133
05:55.800 --> 05:58.020
we should be able to hit connect,

134
05:58.020 --> 06:00.240
it's gonna take us back to this page.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:58.020 --> 06:00.240
it's gonna take us back to this page.

135
06:00.240 --> 06:02.610
We go back to the RDP client

136
06:02.610 --> 06:05.520
and now we should be able to get the password.

137
06:05.520 --> 06:09.180
In order to do this, we need to upload our private key file.

138
06:09.180 --> 06:12.120
So let me go ahead and upload my file.

139
06:12.120 --> 06:14.040
Once the file's uploaded,

140
06:14.040 --> 06:16.199
we can hit decrypt password

141
06:16.199 --> 06:19.020
and then we simply copy this password

142
06:19.020 --> 06:21.030
so that we have it handy.

143
06:21.030 --> 06:25.020
Now we're ready to launch into RDP on our new server.

144
06:25.020 --> 06:27.510
So let's go ahead and launch the RDP file

145
06:27.510 --> 06:29.610
that we downloaded earlier.

146
06:29.610 --> 06:31.470
It'll come up and ask for our credentials.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
06:29.610 --> 06:31.470
It'll come up and ask for our credentials.

147
06:31.470 --> 06:35.490
Just go ahead and paste in the password that we just copied.

148
06:35.490 --> 06:36.990
So after a few moments,

149
06:36.990 --> 06:39.840
we should end up here on the Windows desktop.

150
06:39.840 --> 06:42.660
Let's go ahead and launch a command prompt

151
06:42.660 --> 06:45.510
and let's see if we can reach our workstation.

152
06:45.510 --> 06:48.390
We'll do a ping to 10.10.10.10,

153
06:48.390 --> 06:50.790
which is the workstation's address.

154
06:50.790 --> 06:52.530
We'll hit enter.

155
06:52.530 --> 06:55.860
And as we can see, this is timing out.

156
06:55.860 --> 06:58.080
But if we think about this for a moment,

157
06:58.080 --> 06:59.970
it makes sense.

158
06:59.970 --> 07:03.900
We took care of all the routing on AWS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
06:59.970 --> 07:03.900
We took care of all the routing on AWS,

159
07:03.900 --> 07:06.630
but if we switch over to our router one,

160
07:06.630 --> 07:09.483
so our on-prem iOS XE device,

161
07:10.936 --> 07:13.426
if I do a show IP route here,

162
07:13.426 --> 07:17.283
Router one has no idea how to get

163
07:17.283 --> 07:21.390
to the 10.20.0 0 subnet.

164
07:21.390 --> 07:23.250
We're doing static routing,

165
07:23.250 --> 07:24.660
however, we never configured

166
07:24.660 --> 07:27.450
any static routing on router one.

167
07:27.450 --> 07:29.730
So let's go into configuration mode

168
07:29.730 --> 07:34.730
and we'll simply say IP route for 10.20.0.0
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
07:29.730 --> 07:34.730
and we'll simply say IP route for 10.20.0.0

169
07:34.860 --> 07:36.758
It's a slash 16,

170
07:36.758 --> 07:40.290
and we'll simply point it out the tunnel one interface.

171
07:40.290 --> 07:42.240
Now we wanna be able to use both tunnels,

172
07:42.240 --> 07:45.690
so we'll simply add another route for tunnel two.

173
07:45.690 --> 07:46.950
When we exit configuration

174
07:46.950 --> 07:49.440
and we do show IP route again,

175
07:49.440 --> 07:51.030
we see that we now have a route

176
07:51.030 --> 07:56.030
for 10 point 20.0 0.0 slash 16 going out each tunnel.

177
07:56.580 --> 07:59.452
So now let's go back over to our server

178
07:59.452 --> 08:01.863
and let's simply try our ping again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
07:59.452 --> 08:01.863
and let's simply try our ping again.

179
08:04.980 --> 08:07.290
Notice that now it's working

180
08:07.290 --> 08:10.020
and this is exactly the goal we were looking for

181
08:10.020 --> 08:11.790
in this skill.

182
08:11.790 --> 08:14.220
Just for one final verification,

183
08:14.220 --> 08:16.830
let's go back over to router one

184
08:16.830 --> 08:21.450
and let's do a show Crypto IPSec SA.

185
08:21.450 --> 08:23.130
And notice we see here

186
08:23.130 --> 08:27.480
that numerous packets have gone through this tunnel mount.

187
08:27.480 --> 08:29.220
By the way, notice the encapsulation

188
08:29.220 --> 08:32.700
and de capsulation numbers don't match?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
08:29.220 --> 08:32.700
and de capsulation numbers don't match?

189
08:32.700 --> 08:34.830
This could very well be because the traffic

190
08:34.830 --> 08:37.860
is not flowing symmetrically across the tunnels.

191
08:37.860 --> 08:39.570
If we go look at tunnel two,

192
08:39.570 --> 08:41.910
it might look the opposite of this.

193
08:41.910 --> 08:45.180
Notice the tunnel two has more packets coming in

194
08:45.180 --> 08:46.830
on the other side.

195
08:46.830 --> 08:49.590
So we're seeing asynchronous traffic flow,

196
08:49.590 --> 08:51.120
but that's perfectly fine,

197
08:51.120 --> 08:53.163
it's using both tunnels.

198
08:54.330 --> 08:56.160
So now that is working,

199
08:56.160 --> 09:00.330
we have fully achieved two IPSec tunnels
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
08:56.160 --> 09:00.330
we have fully achieved two IPSec tunnels

200
09:00.330 --> 09:03.720
running between iOS XE on-prem,

201
09:03.720 --> 09:05.280
which is router one,

202
09:05.280 --> 09:09.000
to the native AWS VPN service,

203
09:09.000 --> 09:13.020
running on our VPC on AWS.

204
09:13.020 --> 09:14.700
And we have throughput

205
09:14.700 --> 09:17.940
all the way from a workstation to a server

206
09:17.940 --> 09:20.190
running up in that cloud.

207
09:20.190 --> 09:21.810
Now, just one quick note,

208
09:21.810 --> 09:24.780
we did not verify the traffic the other direction,

209
09:24.780 --> 09:26.730
and the only reason for that is

210
09:26.730 --> 09:29.070
since we used a Windows machine,

211
09:29.070 --> 09:29.970
we would have to go in

212
09:29.970 --> 09:32.430
and disable the Windows firewall and such
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

212
09:29.970 --> 09:32.430
and disable the Windows firewall and such

213
09:32.430 --> 09:35.760
to be able to like ping and trace to that server.

214
09:35.760 --> 09:37.800
However, the way we left it

215
09:37.800 --> 09:40.500
does prove that the traffic is going both ways

216
09:40.500 --> 09:42.933
since we sent a ping and got a reply.