WEBVTT

1
00:00.000 --> 00:09.320
Our next step is going to be to configure the Azure side of our VPN connection.

2
00:09.320 --> 00:14.060
This is where we're going to configure the Ike version 2 parameters, the IPsec

3
00:14.060 --> 00:15.520
parameters,

4
00:15.520 --> 00:20.000
and the type of authentication we're going to be using all of these details as

5
00:20.000 --> 00:20.360
far as

6
00:20.360 --> 00:24.040
how the VPN itself is going to be created.

7
00:24.040 --> 00:31.000
So let's go ahead and jump in and get those settings in place for our VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:24.040 --> 00:31.000
So let's go ahead and jump in and get those settings in place for our VPN.

8
00:31.000 --> 00:36.600
So starting off here on the homepage, we'll go to our virtual network gateways.

9
00:36.600 --> 00:39.840
From here we'll click on VNG1.

10
00:39.840 --> 00:44.120
This will bring us to the overview page of VNG1.

11
00:44.120 --> 00:49.640
Then what we want to do is expand settings and go to connections.

12
00:49.640 --> 00:54.120
Notice that as of right now we have nothing under connections.

13
00:54.120 --> 00:57.560
So what we want to do is come over here and click add.

14
00:57.560 --> 01:00.000
Choose your subscription if necessary.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
01:00.000 --> 01:03.480
Choose your resource group if it's not already listed here.

16
01:03.480 --> 01:05.760
Then we want to go to the connection type.

17
01:05.760 --> 01:10.360
Now in this case we're not building a vnet to vnet connection.

18
01:10.360 --> 01:15.270
So that's something you can do within Azure, but that's not what we're here for

19
01:15.270 --> 01:15.280
.

20
01:15.280 --> 01:18.910
So we want to come down here to the connection type and change this to either

21
01:18.910 --> 01:19.680
site to site

22
01:19.680 --> 01:22.720
IPsec or express route.

23
01:22.720 --> 01:28.320
In this case we're doing an IPsec VPN, so that's what we're going to select.

24
01:28.320 --> 01:30.560
Next we need to give it a name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:28.320 --> 01:30.560
Next we need to give it a name.

25
01:30.560 --> 01:36.600
I'm simply going to choose VPN1, make sure my region is correct, and then we

26
01:36.600 --> 01:37.480
hit next.

27
01:37.480 --> 01:42.590
This first part here is where we now tie our virtual network gateway to our

28
01:42.590 --> 01:43.520
local network

29
01:43.520 --> 01:44.760
gateway.

30
01:44.760 --> 01:47.000
Now of course we only have one each of these.

31
01:47.000 --> 01:51.960
So go ahead and select your virtual network gateway and your local network

32
01:51.960 --> 01:52.840
gateway that we

33
01:52.840 --> 01:55.200
created previously.

34
01:55.200 --> 01:59.600
Then for authentication, we are in fact going to use pre-shared key.

35
01:59.600 --> 02:04.230
Notice that using a key vault certificate is also an option, but we're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:59.600 --> 02:04.230
Notice that using a key vault certificate is also an option, but we're going to

36
02:04.230 --> 02:04.840
be using

37
02:04.840 --> 02:06.560
pre-shared key.

38
02:06.560 --> 02:10.080
So here paste in the pre-shared key you want to use.

39
02:10.080 --> 02:14.740
We can choose then if we want to use iq version 1 or iq version 2, we are going

40
02:14.740 --> 02:15.520
to be using

41
02:15.520 --> 02:18.040
iq version 2.

42
02:18.040 --> 02:23.680
Next we can choose if we want to use Azure private IP addresses or enable bgp.

43
02:23.680 --> 02:27.740
Again we're not going to be doing those right now, but those are definitely

44
02:27.740 --> 02:28.520
options.

45
02:28.520 --> 02:34.060
The next thing we want to do is we want to select custom settings for our IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:28.520 --> 02:34.060
The next thing we want to do is we want to select custom settings for our IPsec

46
02:34.060 --> 02:35.040
and iq

47
02:35.040 --> 02:36.520
policy.

48
02:36.520 --> 02:39.560
Now most of these we're going to leave with their defaults.

49
02:39.560 --> 02:46.840
So for example on iq phase 1, we're going to leave the GCM AES 256.

50
02:46.840 --> 02:48.080
That's fine.

51
02:48.080 --> 02:52.400
For the Shah, we're going to change this to Shah 256.

52
02:52.400 --> 02:56.570
And for the Diffie Helmand Group, we're going to change this to Diffie Helmand

53
02:56.570 --> 02:57.600
Group 14.

54
02:57.600 --> 03:02.070
The key here is you have to find settings that we have in common with our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:57.600 --> 03:02.070
The key here is you have to find settings that we have in common with our

55
03:02.070 --> 03:03.440
version of code

56
03:03.440 --> 03:08.640
on iqs xe and the settings that are available here.

57
03:08.640 --> 03:14.150
For example Diffie Helmand Group 24 is not available on iqs xe at least not in

58
03:14.150 --> 03:15.080
the version

59
03:15.080 --> 03:16.640
of code we're using.

60
03:16.640 --> 03:20.240
So we'll use Diffie Helmand Group 14.

61
03:20.240 --> 03:26.000
For iq phase 2 or the IPsec settings, we will actually leave these at their

62
03:26.000 --> 03:27.440
defaults GCM

63
03:27.440 --> 03:34.810
AES 256 for both the encryption and the integrity and we'll leave the PFS group
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
03:27.440 --> 03:34.810
AES 256 for both the encryption and the integrity and we'll leave the PFS group

64
03:34.810 --> 03:35.440
or the perfect

65
03:35.440 --> 03:39.000
forward secrecy group set to none.

66
03:39.000 --> 03:44.830
Something else to note here, there's only one set of settings here for this

67
03:44.830 --> 03:45.960
connection.

68
03:45.960 --> 03:49.920
So we can't configure this to take a bunch of different options.

69
03:49.920 --> 03:54.980
So whatever we choose here is how we're going to have to configure the ios xe

70
03:54.980 --> 03:55.680
side.

71
03:55.680 --> 03:59.320
The rest of these settings, again they're all adjustable but we don't need to

72
03:59.320 --> 03:59.920
change any

73
03:59.920 --> 04:05.880
of these right now so we can just go ahead and go to review and create.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:59.920 --> 04:05.880
of these right now so we can just go ahead and go to review and create.

74
04:05.880 --> 04:09.950
Once again we get our validation summary page as long as everything looks

75
04:09.950 --> 04:10.760
correct here

76
04:10.760 --> 04:13.160
we go ahead and hit create.

77
04:13.160 --> 04:16.950
Once the deployment is complete let's go to the resource and here on the

78
04:16.950 --> 04:18.520
overview page

79
04:18.520 --> 04:23.080
one of the more important things we want to do at this point is click up here

80
04:23.080 --> 04:23.520
on the

81
04:23.520 --> 04:26.280
download configuration.

82
04:26.280 --> 04:30.280
On the download configuration it's going to ask us for what device do you want
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
04:26.280 --> 04:30.280
On the download configuration it's going to ask us for what device do you want

83
04:30.280 --> 04:30.920
to download

84
04:30.920 --> 04:32.600
the configuration.

85
04:32.600 --> 04:38.840
This is to aid us in deploying this configuration on our on-prem routers.

86
04:38.840 --> 04:42.400
So this is talking about the devices in the on-prem location.

87
04:42.400 --> 04:47.100
So of course this is going to be Cisco for the device family it's going to be

88
04:47.100 --> 04:48.880
iOS xe and

89
04:48.880 --> 04:53.880
for the firmware version they only have one choice at the moment they of course

90
04:53.880 --> 04:54.640
may update

91
04:54.640 --> 04:59.190
this in the future but for now we'll just download the firmware version that's

92
04:59.190 --> 04:59.880
available

93
04:59.880 --> 05:03.000
and we'll say download configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
04:59.880 --> 05:03.000
and we'll say download configuration.

94
05:03.000 --> 05:08.890
Once the file is downloaded let's go ahead and open it in notepad++ and I just

95
05:08.890 --> 05:09.040
want to

96
05:09.040 --> 05:13.360
point out a few quick things about this downloaded document.

97
05:13.360 --> 05:16.760
First it gives us some really great information.

98
05:16.760 --> 05:21.310
You know it tells us what the device information is the network parameters so

99
05:21.310 --> 05:22.480
pretty important

100
05:22.480 --> 05:28.180
here this is where we're going to get those public IP addresses for the Azure

101
05:28.180 --> 05:28.840
endpoints.

102
05:28.840 --> 05:33.000
So good information here but further down we want to get the configuration so
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
05:28.840 --> 05:33.000
So good information here but further down we want to get the configuration so

103
05:33.000 --> 05:33.600
let's scroll

104
05:33.600 --> 05:35.200
down a bit.

105
05:35.200 --> 05:39.120
The first part of the configuration here they actually give us some access

106
05:39.120 --> 05:39.800
lists that

107
05:39.800 --> 05:45.000
we can apply if we need to to permit the traffic through our network.

108
05:45.000 --> 05:50.290
And then further down they begin giving us the configuration itself and this is

109
05:50.290 --> 05:50.840
really

110
05:50.840 --> 05:52.920
good for certain parts of it.

111
05:52.920 --> 05:57.500
Now of course we don't want to use this if we want to name our own components

112
05:57.500 --> 05:58.080
because

113
05:58.080 --> 06:03.430
of course this has names built in but more importantly there are parts of this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:58.080 --> 06:03.430
of course this has names built in but more importantly there are parts of this

114
06:03.430 --> 06:03.600
that are

115
06:03.600 --> 06:05.840
simply not correct.

116
06:05.840 --> 06:14.670
For example under the iqv2 policy it's listing here that outside public address

117
06:14.670 --> 06:14.880
under

118
06:14.880 --> 06:20.570
the match address local when in fact this needs to be our private internal

119
06:20.570 --> 06:21.600
address.

120
06:21.600 --> 06:26.640
Now of course Microsoft has no way of knowing that in this configuration.

121
06:26.640 --> 06:30.870
So there are certain components here that we can use and certain components
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
06:26.640 --> 06:30.870
So there are certain components here that we can use and certain components

122
06:30.870 --> 06:31.480
here that

123
06:31.480 --> 06:33.480
we're not going to use.

124
06:33.480 --> 06:38.380
Another example would be under the crypto iqv2 proposal it simply says

125
06:38.380 --> 06:39.520
encryption.

126
06:39.520 --> 06:41.520
That's not a complete command.

127
06:41.520 --> 06:48.290
So this document is not 100% correct however it's a very useful resource as we

128
06:48.290 --> 06:49.040
move into

129
06:49.040 --> 06:51.920
actually configuring iOS Xe.

130
06:51.920 --> 06:55.080
So I would recommend keeping this document handy.

131
06:55.080 --> 07:00.060
We're going to be using pieces of this to plug into a baseline configuration
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
06:55.080 --> 07:00.060
We're going to be using pieces of this to plug into a baseline configuration

132
07:00.060 --> 07:01.680
that I use

133
07:01.680 --> 07:05.370
and then we can have the total configuration again the main things we're

134
07:05.370 --> 07:06.840
looking for here

135
07:06.840 --> 07:10.480
would be those peer addresses.

136
07:10.480 --> 07:16.680
So in this video we configured the Azure side of our VPN connection.

137
07:16.680 --> 07:22.240
Now we're almost ready to configure the iOS Xe side but before we do there are

138
07:22.240 --> 07:22.640
a few

139
07:22.640 --> 07:27.160
last minute little things that we should do in the Azure environment.

140
07:27.160 --> 07:32.380
We need to create an appropriate route and we should deploy our server so that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
07:27.160 --> 07:32.380
We need to create an appropriate route and we should deploy our server so that

141
07:32.380 --> 07:32.880
we have

142
07:32.880 --> 07:35.360
something to test our connectivity against.

143
07:35.360 --> 07:38.160
So let's do those two things in the next video.

144
07:38.160 --> 07:48.120
[BLANK_AUDIO]