WEBVTT

1
00:02.670 --> 00:04.560
So the next thing we wanna look at

2
00:04.560 --> 00:09.560
is actually running a dynamic routing protocol with AWS.

3
00:09.810 --> 00:13.080
Now, the only dynamic routing protocol currently supported

4
00:13.080 --> 00:15.270
is BGP.

5
00:15.270 --> 00:18.030
Also, there's no current way

6
00:18.030 --> 00:23.030
to switch directly from static routing to dynamic routing

7
00:23.160 --> 00:25.500
in our VPN settings.

8
00:25.500 --> 00:28.140
We can change a lot of things about our tunnels,

9
00:28.140 --> 00:31.740
but at least currently, switching from static
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:28.140 --> 00:31.740
but at least currently, switching from static

10
00:31.740 --> 00:34.230
to dynamic is not a choice.

11
00:34.230 --> 00:38.160
So that said, we will have to delete our current VPN,

12
00:38.160 --> 00:42.000
create a new site to site VPN with dynamic routing,

13
00:42.000 --> 00:46.890
and then reconfigure our IOS XE device to match up with that

14
00:46.890 --> 00:48.783
and bring up our BGP neighborship.

15
00:49.680 --> 00:52.440
So that said, let's go ahead and jump in and get started.

16
00:52.440 --> 00:54.390
We'll start on AWS

17
00:54.390 --> 00:57.423
by deleting our existing site to site VPN.

18
00:59.820 --> 01:03.270
So starting off here on the VPC dashboard,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.820 --> 01:03.270
So starting off here on the VPC dashboard,

19
01:03.270 --> 01:05.760
the first thing we're gonna wanna do is scroll down

20
01:05.760 --> 01:08.190
to the VPN section.

21
01:08.190 --> 01:11.850
We'll go to our site to site VPN connections.

22
01:11.850 --> 01:14.820
We'll highlight our current VPN.

23
01:14.820 --> 01:16.860
We'll go to actions.

24
01:16.860 --> 01:19.770
We'll say delete VPN connection.

25
01:19.770 --> 01:23.970
It will make us verify and we'll hit delete.

26
01:23.970 --> 01:27.960
Now, we'll keep this state here as a while as deleted.

27
01:27.960 --> 01:31.350
If you want in your environment, you can move on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:27.960 --> 01:31.350
If you want in your environment, you can move on.

28
01:31.350 --> 01:35.280
However, to save confusion, I will pause the video here

29
01:35.280 --> 01:38.850
and we will come back once this has fully deleted

30
01:38.850 --> 01:41.460
from the VPC environment.

31
01:41.460 --> 01:46.460
So it's been a while and now our old VPN connection is gone.

32
01:46.680 --> 01:50.850
So the next thing we wanna do is create a VPN connection.

33
01:50.850 --> 01:55.850
We'll call this the same as we did before, just VPN_1.

34
01:55.890 --> 01:58.080
We're gonna select our virtual private gateway

35
01:58.080 --> 02:00.180
that we already have created.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.080 --> 02:00.180
that we already have created.

36
02:00.180 --> 02:03.240
And we'll select our existing customer gateway.

37
02:03.240 --> 02:05.430
We scroll down, we can see that it is

38
02:05.430 --> 02:08.220
going to default to dynamic,

39
02:08.220 --> 02:10.710
and it says that it requires BGP.

40
02:10.710 --> 02:11.543
And that's fine,

41
02:11.543 --> 02:13.680
that's exactly what we're here to configure.

42
02:13.680 --> 02:16.980
So this time we can leave the routing options alone.

43
02:16.980 --> 02:19.590
If we scroll down a little further to our tunnel options,

44
02:19.590 --> 02:21.390
we'll open tunnel one

45
02:21.390 --> 02:23.550
and we'll begin to put in the information

46
02:23.550 --> 02:27.120
that we said we were gonna use to create this tunnel.

47
02:27.120 --> 02:29.700
So the first thing we wanna do is give it the IP address

48
02:29.700 --> 02:31.530
for tunnel one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:29.700 --> 02:31.530
for tunnel one.

49
02:31.530 --> 02:33.120
We'll just copy and paste these

50
02:33.120 --> 02:35.640
from our proposed configuration.

51
02:35.640 --> 02:39.090
We'll also put in the pre-shared key for tunnel one.

52
02:39.090 --> 02:42.180
And we'll set our encryption the same way as we did before,

53
02:42.180 --> 02:46.083
just leaving on the options that we selected earlier.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
03:00.330 --> 03:02.530
We'll then do the same thing for tunnel two.

55
03:21.780 --> 03:23.520
Once everything's configured the way we want,

56
03:23.520 --> 03:25.530
we'll simply scroll all the way to the bottom

57
03:25.530 --> 03:28.170
and say create VPN connection.

58
03:28.170 --> 03:30.663
We can see here it's currently pending.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
03:28.170 --> 03:30.663
We can see here it's currently pending.

59
03:30.663 --> 03:34.680
Now that our VPN has changed to available,

60
03:34.680 --> 03:38.070
if you need to, I would download the configuration here.

61
03:38.070 --> 03:40.830
Once again, I have already done that

62
03:40.830 --> 03:43.260
and pulled the pieces out of that configuration

63
03:43.260 --> 03:46.980
that we're going to need, specifically the IP addresses

64
03:46.980 --> 03:49.140
for the tunnel destinations

65
03:49.140 --> 03:52.800
and the BGP configuration, which is included

66
03:52.800 --> 03:55.200
in that downloaded configuration.

67
03:55.200 --> 03:57.840
We'll be seeing that in just a moment.

68
03:57.840 --> 04:00.090
So now let's switch back over to router one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:57.840 --> 04:00.090
So now let's switch back over to router one

69
04:00.090 --> 04:04.653
and configure that to bring these new tunnels up with BGP.

70
04:06.630 --> 04:08.490
So the first thing we're gonna wanna do,

71
04:08.490 --> 04:11.880
if we do a show run section route,

72
04:11.880 --> 04:13.740
we still have these static routes

73
04:13.740 --> 04:16.230
that are directing the traffic down our tunnels,

74
04:16.230 --> 04:18.630
but again, we're gonna be switching to BGP

75
04:18.630 --> 04:20.550
so we're going to want to get rid of these.

76
04:20.550 --> 04:22.560
So we're going into configuration mode,

77
04:22.560 --> 04:26.490
we'll say no, put in our two commands,

78
04:26.490 --> 04:28.650
and we'll simply negate both of them.

79
04:28.650 --> 04:30.870
So now those routes are gone.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
04:28.650 --> 04:30.870
So now those routes are gone.

80
04:30.870 --> 04:34.320
The next thing we need to do is remove the old identities

81
04:34.320 --> 04:37.260
from the IKE version two profile.

82
04:37.260 --> 04:39.870
So once again, if we do a show run,

83
04:39.870 --> 04:44.280
this time we'll ask for the section crypto.

84
04:44.280 --> 04:47.430
Scroll down here a little bit, and we see we have

85
04:47.430 --> 04:50.970
these old match identity remote addresses.

86
04:50.970 --> 04:53.730
These are for the old tunnel addresses.

87
04:53.730 --> 04:54.900
So the first thing we want to do

88
04:54.900 --> 04:58.320
is go into the crypto profile.

89
04:58.320 --> 05:03.320
Then we'll again negate our two match identity statements.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:58.320 --> 05:03.320
Then we'll again negate our two match identity statements.

90
05:03.360 --> 05:06.750
And now we're ready to put in our new configuration.

91
05:06.750 --> 05:10.770
So here in Notepad++, I've put in the configuration

92
05:10.770 --> 05:13.200
that we're going to need for the changes

93
05:13.200 --> 05:15.120
to our existing tunnels.

94
05:15.120 --> 05:17.010
So the main things, of course,

95
05:17.010 --> 05:19.470
this tunnel address on line four

96
05:19.470 --> 05:23.130
is going to have to be changed as well as line seven.

97
05:23.130 --> 05:27.090
These are the new tunnel addresses we got from AWS.

98
05:27.090 --> 05:30.570
We also had to update that IKE version two profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:27.090 --> 05:30.570
We also had to update that IKE version two profile

99
05:30.570 --> 05:32.280
with these new addresses,

100
05:32.280 --> 05:35.340
so again, for tunnel one and for tunnel two.

101
05:35.340 --> 05:38.910
And finally, the tunnels themselves, we're going to have to

102
05:38.910 --> 05:41.310
update the tunnel destination

103
05:41.310 --> 05:44.850
with the new addresses from AWS.

104
05:44.850 --> 05:49.050
Once we've made those changes, we can highlight all of this.

105
05:49.050 --> 05:52.800
We can simply copy it, go back to our router

106
05:52.800 --> 05:54.663
and paste in the configuration.

107
05:56.580 --> 05:59.160
So now we'll our show ip interface brief,

108
05:59.160 --> 06:02.580
and we can see that our two new tunnels are now up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
05:59.160 --> 06:02.580
and we can see that our two new tunnels are now up.

109
06:02.580 --> 06:04.650
If they're successful,

110
06:04.650 --> 06:08.070
we should be able to do a show ip sla statistics.

111
06:08.070 --> 06:10.710
We see that we currently have some successes,

112
06:10.710 --> 06:13.080
but we also have a lot of failures

113
06:13.080 --> 06:14.910
while our tunnels were down.

114
06:14.910 --> 06:17.580
So let's go ahead and do this again to make sure

115
06:17.580 --> 06:21.030
that our successes are going up but not our failures.

116
06:21.030 --> 06:22.920
So if we look at this again, we see that in fact

117
06:22.920 --> 06:27.090
the successes are going up and the failures are not.

118
06:27.090 --> 06:28.590
So this is a pretty good indication

119
06:28.590 --> 06:30.240
that it's currently working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
06:28.590 --> 06:30.240
that it's currently working.

120
06:30.240 --> 06:34.050
Of course, we can also do a show tracked objects,

121
06:34.050 --> 06:35.640
and we can see that the reachability

122
06:35.640 --> 06:38.490
for both tunnels is currently up.

123
06:38.490 --> 06:43.380
So now that our tunnels are up, we can now set up BGP.

124
06:43.380 --> 06:46.620
So here in Notepad++, once again,

125
06:46.620 --> 06:49.311
I've put together the cleaned up configuration

126
06:49.311 --> 06:53.340
from the downloaded configuration from AWS.

127
06:53.340 --> 06:56.820
All of this will be in that configuration you downloaded.

128
06:56.820 --> 07:00.690
Now, of course, the BGP AS number we chose
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
06:56.820 --> 07:00.690
Now, of course, the BGP AS number we chose

129
07:00.690 --> 07:03.390
when we set up our tunnels originally.

130
07:03.390 --> 07:05.850
Notice they've given us configurations

131
07:05.850 --> 07:08.550
for themselves as neighbors.

132
07:08.550 --> 07:11.880
They've adjusted some timers there for us for BGP

133
07:11.880 --> 07:13.920
to make convergence a little quicker,

134
07:13.920 --> 07:17.010
as well as including their own remote AS number.

135
07:17.010 --> 07:20.190
And as far as options go, they've configured us

136
07:20.190 --> 07:23.370
to use soft reconfiguration inbound.

137
07:23.370 --> 07:25.320
Technically that's optional.

138
07:25.320 --> 07:27.660
It's sort of a nice feature in BGP,

139
07:27.660 --> 07:29.670
but you wouldn't have to run this.

140
07:29.670 --> 07:33.390
This has nothing to do with the neighborship with AWS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
07:29.670 --> 07:33.390
This has nothing to do with the neighborship with AWS.

141
07:33.390 --> 07:36.630
So this line would be optional.

142
07:36.630 --> 07:38.460
Also note that I have already

143
07:38.460 --> 07:42.720
put into the configuration here to advertise our network,

144
07:42.720 --> 07:47.720
the 10.10.10.0/24, so specifically subnet 10, over to AWS.

145
07:51.570 --> 07:54.300
So now that we've seen this configuration, let's go ahead

146
07:54.300 --> 07:57.000
and paste it into router one.

147
07:57.000 --> 08:01.380
We'll go ahead and exit and then let's do some verification.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
07:57.000 --> 08:01.380
We'll go ahead and exit and then let's do some verification.

148
08:01.380 --> 08:04.140
Let's do a show ip bgp summary.

149
08:04.140 --> 08:07.440
We can see here that the neighbors are currently up

150
08:07.440 --> 08:11.370
and we've received one prefix from each of our neighbors.

151
08:11.370 --> 08:15.390
That's, of course, one neighborship down each tunnel.

152
08:15.390 --> 08:18.870
If we do a show ip bgp, we can see that

153
08:18.870 --> 08:21.819
for the network on the AWS side, the 10.20.20.0/16,

154
08:21.819 --> 08:26.819
we have two paths, one down each tunnel.

155
08:29.250 --> 08:34.050
Also note that AWS is actually setting the metric
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
08:29.250 --> 08:34.050
Also note that AWS is actually setting the metric

156
08:34.050 --> 08:37.380
or the MED on this update

157
08:37.380 --> 08:40.680
so that we're actually preferring a specific tunnel.

158
08:40.680 --> 08:44.070
Now we could of course change this using things like weight

159
08:44.070 --> 08:45.720
or local preference.

160
08:45.720 --> 08:50.490
But currently if we do a show ip route for BGP,

161
08:50.490 --> 08:55.350
we'll notice that we're using the path through 11.1,

162
08:55.350 --> 08:57.900
which is the one that has the lowest metric

163
08:57.900 --> 08:59.880
in our BGP table.

164
08:59.880 --> 09:02.670
So all of this appears to be working fine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
08:59.880 --> 09:02.670
So all of this appears to be working fine.

165
09:02.670 --> 09:04.680
Let's jump over to workstation one

166
09:04.680 --> 09:09.680
and see if we have reachability using BGP for our routing.

167
09:09.930 --> 09:14.930
So from workstation one, we'll do our ping to 10.20.20.32,

168
09:15.300 --> 09:19.440
and we can see that we have reachability with BGP.

169
09:19.440 --> 09:22.678
Also, we can jump back over to AWS,

170
09:22.678 --> 09:25.320
go to tunnel details.

171
09:25.320 --> 09:27.870
So we see here on the tunnel details

172
09:27.870 --> 09:31.380
that both of our tunnels are currently status up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

172
09:27.870 --> 09:31.380
that both of our tunnels are currently status up

173
09:31.380 --> 09:35.220
and that AWS has learned one BGP route

174
09:35.220 --> 09:38.730
over both of these tunnels from our router one.

175
09:38.730 --> 09:39.960
So now our tunnels are up

176
09:39.960 --> 09:42.993
and working with dynamic routing using BGP.

177
09:44.130 --> 09:48.300
So in this video we saw how to configure our AWS side

178
09:48.300 --> 09:49.650
to use dynamic routing,

179
09:49.650 --> 09:52.590
which is in fact the default setting.

180
09:52.590 --> 09:56.100
And we saw how to configure our IOS XE device

181
09:56.100 --> 09:59.010
to connect to it using BGP.

182
09:59.010 --> 10:02.280
Next, let's take a look at adding some redundancy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

182
09:59.010 --> 10:02.280
Next, let's take a look at adding some redundancy

183
10:02.280 --> 10:04.380
to the actual edge device.

184
10:04.380 --> 10:07.110
For this, we're gonna be switching up our topology

185
10:07.110 --> 10:09.033
and adding in router two.