WEBVTT

1
00:00.000 --> 00:09.600
So now it's finally time to configure the iOS XE side of this IPsec VPN tunnel.

2
00:09.600 --> 00:13.410
So what we're going to do is we're going to take the text document that we

3
00:13.410 --> 00:13.960
downloaded

4
00:13.960 --> 00:15.920
from Microsoft Azure.

5
00:15.920 --> 00:21.260
We're going to take the two gateway addresses, plug them into the configuration

6
00:21.260 --> 00:21.520
that is

7
00:21.520 --> 00:25.640
down below this video, and we're going to paste that into our router in order

8
00:25.640 --> 00:26.200
to bring

9
00:26.200 --> 00:28.640
the VPN online.

10
00:28.640 --> 00:32.290
Once the interface is up, we'll also of course do some testing to make sure it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.640 --> 00:32.290
Once the interface is up, we'll also of course do some testing to make sure it

11
00:32.290 --> 00:32.920
's actually

12
00:32.920 --> 00:33.920
working.

13
00:33.920 --> 00:41.380
So all of that said, let's jump into the command line with on-prem R1.

14
00:41.380 --> 00:45.560
So the first thing we want to do is configure our iqv2 key ring.

15
00:45.560 --> 00:49.630
So if we take a look over what we just put in here, the main things are we're

16
00:49.630 --> 00:50.200
putting

17
00:50.200 --> 00:56.900
in our pre-shared keys and we're putting in the addresses of each peer for each

18
00:56.900 --> 00:57.880
tunnel.

19
00:57.880 --> 01:03.080
So these are the addresses that I pulled out of that downloaded configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:57.880 --> 01:03.080
So these are the addresses that I pulled out of that downloaded configuration.

20
01:03.080 --> 01:05.600
So that's the first thing we want to do.

21
01:05.600 --> 01:11.680
Remember the next step with configuring IPsec is to put in our iqv2 proposal.

22
01:11.680 --> 01:13.600
This is fairly straightforward.

23
01:13.600 --> 01:18.220
It's just we have to match the encryption, the PRF, and the Diffie Helming

24
01:18.220 --> 01:19.000
Group that

25
01:19.000 --> 01:22.240
we configured in Microsoft Azure.

26
01:22.240 --> 01:24.320
Next up we'll configure the policy.

27
01:24.320 --> 01:29.480
This of course is what ties our proposal to the local address.

28
01:29.480 --> 01:33.320
This is the local address on R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:29.480 --> 01:33.320
This is the local address on R1.

29
01:33.320 --> 01:35.760
Finally we'll put in our profile.

30
01:35.760 --> 01:40.900
The main things we have to configure here is of course the local interface, the

31
01:40.900 --> 01:41.360
remote

32
01:41.360 --> 01:47.150
address of both of our neighboring peers, as well as matching on that local

33
01:47.150 --> 01:48.000
address,

34
01:48.000 --> 01:53.500
of course configuring both the local and remote authentication to be pre-shared

35
01:53.500 --> 01:53.840
key and

36
01:53.840 --> 01:57.440
calling to the key ring that we configured earlier.

37
01:57.440 --> 02:00.440
Next we'll put in our IPsec components.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:57.440 --> 02:00.440
Next we'll put in our IPsec components.

38
02:00.440 --> 02:06.060
Once again these need to match the encryption that we configured on the Azure

39
02:06.060 --> 02:06.760
side.

40
02:06.760 --> 02:12.660
And of course this is also where we tie in the transform set with the iqv2

41
02:12.660 --> 02:13.760
profile.

42
02:13.760 --> 02:16.600
So again this is the piece that ties all of it together.

43
02:16.600 --> 02:21.280
So now we're ready to actually configure our two tunnel interfaces.

44
02:21.280 --> 02:24.920
So we'll simply start with interface tunnel one.

45
02:24.920 --> 02:27.680
First we have its IP address.

46
02:27.680 --> 02:33.040
Here we're using a private address the 169.254 address space.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:27.680 --> 02:33.040
Here we're using a private address the 169.254 address space.

47
02:33.040 --> 02:36.490
It doesn't really matter what addressing we use on our tunnel because we're

48
02:36.490 --> 02:37.400
going to point

49
02:37.400 --> 02:42.040
our routing to the interface, not to an IP address.

50
02:42.040 --> 02:46.130
It has to have an IP address to enable IP routing on the interface, but it

51
02:46.130 --> 02:46.760
doesn't really

52
02:46.760 --> 02:49.560
matter what the IP address is.

53
02:49.560 --> 02:55.170
We're also going to adjust the tunnel Mtu as well as the TCP MSS or maximum

54
02:55.170 --> 02:57.000
segment size,

55
02:57.000 --> 03:03.900
which should always be 40 bytes less than the Mtu to account for the IP and TCP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:57.000 --> 03:03.900
which should always be 40 bytes less than the Mtu to account for the IP and TCP

56
03:03.900 --> 03:05.040
headers.

57
03:05.040 --> 03:08.120
Then of course we have to configure the tunnel source.

58
03:08.120 --> 03:12.280
That's our outside interface in this case gigabit ethernet one.

59
03:12.280 --> 03:17.760
Then of course we have to change the mode from the default which of course is g

60
03:17.760 --> 03:19.240
ire to IPsec

61
03:19.240 --> 03:21.720
over IPv4.

62
03:21.720 --> 03:26.910
We then configure the destination again using one of those peer IP addresses

63
03:26.910 --> 03:27.680
and then of

64
03:27.680 --> 03:31.720
course we assign our tunnel protection profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:27.680 --> 03:31.720
course we assign our tunnel protection profile.

65
03:31.720 --> 03:34.680
The tunnel two interface is going to be almost identical.

66
03:34.680 --> 03:38.820
We'll set a different IP address on it and of course the tunnel destination is

67
03:38.820 --> 03:39.240
going

68
03:39.240 --> 03:44.440
to be different, but other than those two things it's the same configuration.

69
03:44.440 --> 03:50.720
And then all we need to do is point our routes for the 10.30.0 network to each

70
03:50.720 --> 03:52.800
of these tunnels.

71
03:52.800 --> 03:57.480
So we'll simply put in two routes, one down each of our tunnels.

72
03:57.480 --> 04:00.080
So let's of course do some verification.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:57.480 --> 04:00.080
So let's of course do some verification.

73
04:00.080 --> 04:02.720
We can do a show IP interface brief.

74
04:02.720 --> 04:07.760
What we see here is that tunnel one and tunnel two are both up and online.

75
04:07.760 --> 04:13.960
If we do a show IP route, we see that we have a static route to the 10.30.0.0/

76
04:13.960 --> 04:14.400
60.

77
04:14.400 --> 04:19.040
16 pointing out each of the two tunnel interfaces.

78
04:19.040 --> 04:24.280
So it will be doing equal cost multi-pathing across those two tunnels.

79
04:24.280 --> 04:29.980
We can also do a show crypto IPsec SA and we see here for our tunnels each of

80
04:29.980 --> 04:30.680
these are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:29.980 --> 04:30.680
these are

81
04:30.680 --> 04:31.960
up.

82
04:31.960 --> 04:37.480
And finally we can verify some traffic here by paying 10.30.10.100.

83
04:37.480 --> 04:42.030
We will have to source it from our gigabit to interface which is our inside

84
04:42.030 --> 04:42.840
interface.

85
04:42.840 --> 04:46.440
So let's go ahead and repeat that just a few times.

86
04:46.440 --> 04:48.720
So we see of course that this is working.

87
04:48.720 --> 04:52.660
Let's let the ping run to generate some traffic while we do some further

88
04:52.660 --> 04:53.440
testing.

89
04:53.440 --> 04:57.360
For part of that testing, let's jump over to the workstation.

90
04:57.360 --> 05:02.800
So from here on the workstation, we'll also do a ping to 10.30.10.100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:57.360 --> 05:02.800
So from here on the workstation, we'll also do a ping to 10.30.10.100.

91
05:02.800 --> 05:05.120
And we see here that this is functional.

92
05:05.120 --> 05:12.190
So now we have reachability across our VPN from workstation 1 to SRV1 in the

93
05:12.190 --> 05:13.440
Azure Cloud

94
05:13.440 --> 05:16.520
across our native VPN.

95
05:16.520 --> 05:21.990
Let's let our traffic run for just a few minutes and then we'll jump over to

96
05:21.990 --> 05:22.760
Azure.

97
05:22.760 --> 05:26.260
Take a look at the statistics on our tunnel.

98
05:26.260 --> 05:30.200
So now here on the overview page for VNG1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:26.260 --> 05:30.200
So now here on the overview page for VNG1.

99
05:30.200 --> 05:34.220
Now that this has been running for a while, we see that we have charts here

100
05:34.220 --> 05:34.880
showing the

101
05:34.880 --> 05:39.760
ingress and egress traffic that's going through our tunnel.

102
05:39.760 --> 05:44.240
And for one final verification, just to ensure that the traffic is actually

103
05:44.240 --> 05:45.520
being encrypted,

104
05:45.520 --> 05:53.240
let's go back over to on-prem R1 and once again verify that IPsec SA.

105
05:53.240 --> 05:57.340
So let's go ahead and stop our ping that was still running and we'll do our

106
05:57.340 --> 05:57.920
show crypto

107
05:57.920 --> 06:00.440
IPsec SA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
05:57.920 --> 06:00.440
IPsec SA.

108
06:00.440 --> 06:06.150
What we're looking for here specifically is that all of the packets, in this

109
06:06.150 --> 06:09.320
case, 52,183

110
06:09.320 --> 06:17.750
outbound and 52,187 inbound have been both encapsulated and decapsulated as

111
06:17.750 --> 06:19.580
well as encrypted

112
06:19.580 --> 06:21.620
and decrypted.

113
06:21.620 --> 06:29.360
So all of this indicates that our VPN is working exactly as we designed.

114
06:29.360 --> 06:34.520
So in this video, we got the iOS XE side of our tunnel configured.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
06:29.360 --> 06:34.520
So in this video, we got the iOS XE side of our tunnel configured.

115
06:34.520 --> 06:39.700
We saw that the tunnel came up as we wanted it to is passing traffic through

116
06:39.700 --> 06:40.320
and is not

117
06:40.320 --> 06:45.540
only encapsulating but is also encrypting all of that traffic.

118
06:45.540 --> 06:51.500
So that concludes everything that we needed cover in this skill except for the

119
06:51.500 --> 06:52.560
challenge.

120
06:52.560 --> 06:59.490
And the challenge we're going to take tunnel 2, move it from on-prem R1 over to

121
06:59.490 --> 07:01.440
on-prem R2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
06:59.490 --> 07:01.440
on-prem R2.

122
07:01.440 --> 07:03.200
So go ahead and give that a shot.

123
07:03.200 --> 07:06.800
I'll see you in the solution video on the other side.

124
07:06.800 --> 07:30.000