WEBVTT 1 00:00.000 --> 00:10.280 So our next step is to create the VPN gateway and the peer gateway in GCP. 2 00:10.280 --> 00:15.260 Now in the case of GCP, the peer gateway is actually sort of part of the VPN 3 00:15.260 --> 00:16.000 gateway. 4 00:16.000 --> 00:20.090 You'll see how it gets configured as we go, but there's something very 5 00:20.090 --> 00:20.880 interesting I 6 00:20.880 --> 00:25.120 want you to keep in mind as we're going through this configuration. 7 00:25.120 --> 00:29.600 Even like other cloud providers, we are not going to be providing the 8 00:29.600 --> 00:31.200 parameters for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:29.600 --> 00:31.200 parameters for 9 00:31.200 --> 00:36.840 like V2 or IP sec as we're going through this configuration. 10 00:36.840 --> 00:41.540 The interesting thing about Google Cloud is they have certain parameters that 11 00:41.540 --> 00:42.440 they accept 12 00:42.440 --> 00:48.170 and will negotiate with the peer gateway and those are actually listed on their 13 00:48.170 --> 00:48.840 website. 14 00:48.840 --> 00:51.880 I have a link to that below this video. 15 00:51.880 --> 00:56.120 But anything on that list is essentially fair game then. 16 00:56.120 --> 01:00.570 You can configure your on-prem router as long as it's using any of those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 16 00:56.120 --> 01:00.570 You can configure your on-prem router as long as it's using any of those 17 01:00.570 --> 01:01.640 parameters. 18 01:01.640 --> 01:06.980 They will be successfully negotiated with Google Cloud and then your IP sec VPN 19 01:06.980 --> 01:07.560 will come 20 01:07.560 --> 01:08.560 up. 21 01:08.560 --> 01:13.440 Now you could make an argument as to whether that's good or bad. 22 01:13.440 --> 01:14.840 Here's what I mean by that. 23 01:14.840 --> 01:19.750 The good is while all we really have to do is put in our pre-shared key, point 24 01:19.750 --> 01:20.280 our two 25 01:20.280 --> 01:23.640 devices at each other and we get a VPN. 26 01:23.640 --> 01:28.360 So from that perspective, it's easy and very quick to do. 27 01:28.360 --> 01:34.310 The downside to that is if somebody was trying to form a malicious VPN, all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 01:28.360 --> 01:34.310 The downside to that is if somebody was trying to form a malicious VPN, all 28 01:34.310 --> 01:35.520 they would really 29 01:35.520 --> 01:39.670 need and arguably they shouldn't be able to get this of course, but all they 30 01:39.670 --> 01:40.720 would need 31 01:40.720 --> 01:42.960 is our pre-shared key. 32 01:42.960 --> 01:48.000 With other parameters already being negotiated, they wouldn't have to know 33 01:48.000 --> 01:48.760 those. 34 01:48.760 --> 01:53.240 See with other environments where you have to provide not only the pre-shared 35 01:53.240 --> 01:53.560 key, but 36 01:53.560 --> 01:59.870 also tell it which encryption to use, which exchanges and data integrity 37 01:59.870 --> 02:01.200 methods to use WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:59.870 --> 02:01.200 methods to use 38 02:01.200 --> 02:06.160 and so on, you would have to know all that for your VPN to come up. 39 02:06.160 --> 02:10.320 In this case, we literally just need to know the pre-shared key. 40 02:10.320 --> 02:15.230 So again, you can look at that as either a positive or a negative depending on 41 02:15.230 --> 02:15.880 exactly 42 02:15.880 --> 02:17.560 how you want to think it through. 43 02:17.560 --> 02:20.720 And nonetheless, it doesn't change what we have to actually do. 44 02:20.720 --> 02:24.160 So let's go ahead and jump into GCP. 45 02:24.160 --> 02:28.350 Once again, we'll start off on the console main page and we'll go from there to 46 02:28.350 --> 02:28.800 build our 47 02:28.800 --> 02:32.360 VPN gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 02:28.800 --> 02:32.360 VPN gateway. 48 02:32.360 --> 02:36.060 So what we're going to do is we're going to come over here to our navigation 49 02:36.060 --> 02:36.600 menu and 50 02:36.600 --> 02:39.800 we're going to go to network connectivity. 51 02:39.800 --> 02:45.390 Now one thing to note here, you may not have network connectivity on your quick 52 02:45.390 --> 02:45.880 launch 53 02:45.880 --> 02:50.040 bar here because these are simply our pinned products. 54 02:50.040 --> 02:55.600 Google puts some here by default and network connectivity is not one of those. 55 02:55.600 --> 03:00.160 I have of course pinned it in my environment, but if you don't have this, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 02:55.600 --> 03:00.160 I have of course pinned it in my environment, but if you don't have this, 56 03:00.160 --> 03:01.480 simply search for 57 03:01.480 --> 03:04.200 it up here in the search bar. 58 03:04.200 --> 03:09.470 Once you find network connectivity, then you can pin it to your quick launch 59 03:09.470 --> 03:09.800 menu. 60 03:09.800 --> 03:13.550 But once we have it here or you just launch it from the search menu, what we 61 03:13.550 --> 03:14.640 want to do 62 03:14.640 --> 03:17.400 is go to VPN. 63 03:17.400 --> 03:20.800 As you can see by default, we don't have any VPN here. 64 03:20.800 --> 03:24.280 So what we're going to do is we're going to say create VPN connection. 65 03:24.280 --> 03:29.400 So this is going to take us into the create a VPN configuration dialogue. 66 03:29.400 --> 03:34.340 And as you can see, we have two choices here, high availability VPN, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 66 03:29.400 --> 03:34.340 And as you can see, we have two choices here, high availability VPN, which 67 03:34.340 --> 03:36.320 actually requires 68 03:36.320 --> 03:37.320 BGP. 69 03:37.320 --> 03:40.720 Now, we're not going to be configuring BGP right now. 70 03:40.720 --> 03:44.280 So we're not going to go with the high availability option. 71 03:44.280 --> 03:48.960 We're going to be using a classic VPN so that we can do static routing. 72 03:48.960 --> 03:51.320 Now it says no high availability. 73 03:51.320 --> 03:55.880 However, just be aware that we can still do high availability. 74 03:55.880 --> 03:59.820 It just means that we're going to have to do it ourselves by deploying our own 75 03:59.820 --> 04:00.440 separate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:59.820 --> 04:00.440 separate 76 04:00.440 --> 04:01.520 tunnel. 77 04:01.520 --> 04:04.840 So let's go ahead and choose classic VPN. 78 04:04.840 --> 04:07.360 We'll hit continue. 79 04:07.360 --> 04:11.680 We'll call this VNG1 for virtual network gateway. 80 04:11.680 --> 04:14.320 Again, we can put on a description if we want. 81 04:14.320 --> 04:20.920 Notice here, we now just get to choose our network and we simply choose VPC1. 82 04:20.920 --> 04:24.710 This is where we were saying before we don't need a special VPC or some 83 04:24.710 --> 04:25.760 separate subnet 84 04:25.760 --> 04:27.400 or anything like that. 85 04:27.400 --> 04:33.040 We just connect this virtual network gateway directly to our existing VPC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 04:27.400 --> 04:33.040 We just connect this virtual network gateway directly to our existing VPC. 86 04:33.040 --> 04:38.000 Now, of course, we want to choose the region for the IP address. 87 04:38.000 --> 04:39.760 We click on the drop down. 88 04:39.760 --> 04:45.360 If we had a reserved static IP address already, we could choose it here. 89 04:45.360 --> 04:49.200 Since we don't, we'll simply say create IP address. 90 04:49.200 --> 04:51.280 We can give it a name. 91 04:51.280 --> 04:54.400 We'll simply call it VNG1 IP1. 92 04:54.400 --> 04:57.820 It's not, of course, asking for the actual address because it's going to assign 93 04:57.820 --> 04:59.280 that to us. 94 04:59.280 --> 05:02.880 We're just naming the reservation that's going to create. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 94 04:59.280 --> 05:02.880 We're just naming the reservation that's going to create. 95 05:02.880 --> 05:07.650 That way, this virtual network gateway's address doesn't change from time to 96 05:07.650 --> 05:08.240 time. 97 05:08.240 --> 05:11.080 That would make our VPN not very reliable. 98 05:11.080 --> 05:13.280 So we'll go ahead and hit reserve. 99 05:13.280 --> 05:18.640 It will pull an address out of its pool and assign it to this VNG. 100 05:18.640 --> 05:21.440 Next let's scroll down here to our tunnels. 101 05:21.440 --> 05:25.240 For our name, it's adding a dash tunnel dash 1 here. 102 05:25.240 --> 05:28.000 So we'll just put our name in front of it. 103 05:28.000 --> 05:31.440 VNG1 dash tunnel dash 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 05:28.000 --> 05:31.440 VNG1 dash tunnel dash 1. 104 05:31.440 --> 05:37.000 For the remote peer IP address, this is where we're actually configuring the 105 05:37.000 --> 05:39.200 VPN peer gateway. 106 05:39.200 --> 05:43.950 So this is going to be the outside address of your headquarters as it would be 107 05:43.950 --> 05:44.640 seen from 108 05:44.640 --> 05:45.640 Google Cloud. 109 05:45.640 --> 05:50.040 In other words, after it's knatted, that public address. 110 05:50.040 --> 05:52.440 So let's go ahead and put this in. 111 05:52.440 --> 05:56.720 Once we have that configured, of course, the next field is the Ike version, 112 05:56.720 --> 05:57.520 where of course 113 05:57.520 --> 06:00.240 going to stay with Ike version 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 113 05:57.520 --> 06:00.240 going to stay with Ike version 2. 114 06:00.240 --> 06:02.560 And then we put in our pre-shared key. 115 06:02.560 --> 06:07.150 Now if you like, you can have Google Cloud here generate your key and copy it 116 06:07.150 --> 06:07.880 to the clip 117 06:07.880 --> 06:12.400 board for you so that you can put it on your device or we can use one that we 118 06:12.400 --> 06:13.280 provide. 119 06:13.280 --> 06:17.000 In our case, I'm going to use one that I'm providing. 120 06:17.000 --> 06:20.040 The next step is to configure your routing. 121 06:20.040 --> 06:23.800 Now it's defaulting here to doing dynamic with BGP. 122 06:23.800 --> 06:27.080 Again, we're not interested in running BGP right now. 123 06:27.080 --> 06:28.880 We're just going to do static routing. 124 06:28.880 --> 06:32.240 So what we're going to do is we're going to say route based. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 124 06:28.880 --> 06:32.240 So what we're going to do is we're going to say route based. 125 06:32.240 --> 06:35.200 And here we put in the remote address range. 126 06:35.200 --> 06:38.600 Now we want this to be for all internal networks. 127 06:38.600 --> 06:43.120 So we're going to make this 10.0.0.0/8. 128 06:43.120 --> 06:46.840 So once we have this tunnel configured, we can go ahead and hit done. 129 06:46.840 --> 06:48.160 Once again, we don't have to. 130 06:48.160 --> 06:51.160 It'll just shrink this dialog box. 131 06:51.160 --> 06:54.160 Notice we do have an option to add a tunnel right now. 132 06:54.160 --> 06:58.630 If we wanted to build redundant tunnels to begin with, or we can just hit 133 06:58.630 --> 06:59.360 create. 134 06:59.360 --> 07:00.360 That's what we're going to do. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 134 06:59.360 --> 07:00.360 That's what we're going to do. 135 07:00.360 --> 07:02.240 So let's hit create. 136 07:02.240 --> 07:07.160 Once it's complete, we see here our gateway name as VNG1. 137 07:07.160 --> 07:08.920 We see its IP address. 138 07:08.920 --> 07:13.700 Very important we want to record this so we can plug this into our iOS XE 139 07:13.700 --> 07:14.920 configuration 140 07:14.920 --> 07:17.240 that we're going to be doing here shortly. 141 07:17.240 --> 07:19.360 So we want to record that IP address. 142 07:19.360 --> 07:24.440 We see that it is in fact connected to VPC1, our VPC network. 143 07:24.440 --> 07:25.720 It's in our region. 144 07:25.720 --> 07:30.440 And we in fact do have one tunnel, VNG1, tunnel 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 144 07:25.720 --> 07:30.440 And we in fact do have one tunnel, VNG1, tunnel 1. 145 07:30.440 --> 07:35.480 Now if we want to come up here to this header and click on cloud VPN tunnels, 146 07:35.480 --> 07:35.800 this is going 147 07:35.800 --> 07:39.680 to give us some more information about this tunnel. 148 07:39.680 --> 07:41.840 So of course we see the tunnel name. 149 07:41.840 --> 07:44.760 We see the cloud VPN gateway here again. 150 07:44.760 --> 07:50.750 We see the peer VPN gateway and most importantly for us right now, we see that 151 07:50.750 --> 07:51.480 the VPN tunnel 152 07:51.480 --> 07:55.800 status is waiting for the first handshake. 153 07:55.800 --> 07:59.320 It's waiting for like phase one. 154 07:59.320 --> 08:01.040 And that's what we want for right now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 154 07:59.320 --> 08:01.040 And that's what we want for right now. 155 08:01.040 --> 08:04.500 Of course it's not going to progress because we haven't configured our on-prem 156 08:04.500 --> 08:07.520 router yet. 157 08:07.520 --> 08:11.570 So now that we've been through the configuration, we've seen everything it 158 08:11.570 --> 08:12.560 asked us to create 159 08:12.560 --> 08:14.320 this tunnel. 160 08:14.320 --> 08:21.560 And this it never asked us what parameters to use for Ike V2 or IPsec. 161 08:21.560 --> 08:26.560 So what parameters exactly does Google Cloud support? 162 08:26.560 --> 08:30.820 Well, let's take a look at their information page, which again is referenced WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 162 08:26.560 --> 08:30.820 Well, let's take a look at their information page, which again is referenced 163 08:30.820 --> 08:31.840 with the link 164 08:31.840 --> 08:33.360 below this video. 165 08:33.360 --> 08:37.760 But let's hop over real quick, take a look at that page so that we know what 166 08:37.760 --> 08:38.800 Google Cloud 167 08:38.800 --> 08:40.680 actually supports. 168 08:40.680 --> 08:43.520 So let me switch over here to their web page. 169 08:43.520 --> 08:48.360 So what we see here is a list of the supported Ike ciphers. 170 08:48.360 --> 08:52.770 And if we scroll down, it's going to talk to you about how the proposal order 171 08:52.770 --> 08:53.400 works, whether 172 08:53.400 --> 08:55.920 it supports Ike fragmentation. 173 08:55.920 --> 09:00.410 But of course, the most important thing are the encryption and integrity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 173 08:55.920 --> 09:00.410 But of course, the most important thing are the encryption and integrity 174 09:00.410 --> 09:01.400 algorithms that 175 09:01.400 --> 09:02.720 are supported. 176 09:02.720 --> 09:10.040 So just as an example, we see here that it is definitely supporting AES GCM 256 177 09:10.040 --> 09:10.120 . 178 09:10.120 --> 09:13.960 Before the suite, a random function, we see a lot of supported things. 179 09:13.960 --> 09:18.420 But most importantly, we see that it supports shot to 256, which is what we're 180 09:18.420 --> 09:19.040 going to be 181 09:19.040 --> 09:21.960 using for Diffie, Helmand. 182 09:21.960 --> 09:25.000 We see that it supports a large number of groups. 183 09:25.000 --> 09:29.370 We're just going to use group 14, which is the same group we happen to use when 184 09:29.370 --> 09:29.600 we were 185 09:29.600 --> 09:33.520 building this VPN to Microsoft Azure. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 185 09:29.600 --> 09:33.520 building this VPN to Microsoft Azure. 186 09:33.520 --> 09:37.920 But we do see here that it supports honestly, quite a few more groups than say, 187 09:37.920 --> 09:38.880 for example, 188 09:38.880 --> 09:44.480 Microsoft Azure did for Ike phase two, which is your IP [garbled] section. 189 09:44.480 --> 09:51.360 We see here again, it supports AES GCM 256 for the PFS algorithm. 190 09:51.360 --> 09:55.520 We can configure any of these different choices here for the Diffie Helmand 191 09:55.520 --> 09:56.120 group. 192 09:56.120 --> 09:59.960 It supports the same ones that it does for phase one. 193 09:59.960 --> 10:04.200 So again, we can use any of these options and they'll just be automatically WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 193 09:59.960 --> 10:04.200 So again, we can use any of these options and they'll just be automatically 194 10:04.200 --> 10:05.000 negotiated 195 10:05.000 --> 10:07.560 with Google Cloud. 196 10:07.560 --> 10:13.140 So in this video, we saw how to go in and configure our virtual network gateway 197 10:13.140 --> 10:14.680 and our peer gateway 198 10:14.680 --> 10:18.120 in Google Cloud, configure our tunnel. 199 10:18.120 --> 10:22.460 And we've discussed here how we don't have to actually configure various Ike 200 10:22.460 --> 10:23.040 version 201 10:23.040 --> 10:28.150 two and IP [garbled] parameters on that tunnel because it'll support everything 202 10:28.150 --> 10:29.120 listed here on 203 10:29.120 --> 10:30.640 this web page. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 203 10:29.120 --> 10:30.640 this web page. 204 10:30.640 --> 10:35.070 The next thing we have to do is really sort of one final little step before we 205 10:35.070 --> 10:35.600 deploy 206 10:35.600 --> 10:42.970 our IP [garbled] VPN, which is simply to deploy our server SRV one into subnet 10 207 10:42.970 --> 10:43.400 just so we 208 10:43.400 --> 10:46.400 have something to test with our traffic. 209 10:46.400 --> 10:48.480 So let's do that in the next video. 210 10:48.480 --> 10:58.480 [BLANK_AUDIO]