WEBVTT

1
00:00.000 --> 00:08.880
So as we jump into iOS Xe to configure our IPsec VPN, there are a few things we

2
00:08.880 --> 00:09.080
want to

3
00:09.080 --> 00:10.720
keep in mind.

4
00:10.720 --> 00:16.620
First and foremost, previously, we recorded the external address for the VPN

5
00:16.620 --> 00:17.680
gateway from

6
00:17.680 --> 00:19.080
Google Cloud.

7
00:19.080 --> 00:23.330
So we're going to be taking that IP address, plugging it in to our VPN

8
00:23.330 --> 00:24.520
configuration that

9
00:24.520 --> 00:28.160
I have outlined in the code window below this video.

10
00:28.160 --> 00:31.960
And we'll be using that to configure the IPsec VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.160 --> 00:31.960
And we'll be using that to configure the IPsec VPN.

11
00:31.960 --> 00:37.400
When we look at that code, it is set to use certain Ike version 2 and IPsec

12
00:37.400 --> 00:38.600
parameters.

13
00:38.600 --> 00:42.800
Now honestly, these are just the same parameters that we used when we

14
00:42.800 --> 00:45.080
configured our VPN for Microsoft

15
00:45.080 --> 00:46.200
Azure.

16
00:46.200 --> 00:50.160
Those are good settings, so there's really no need to change them up here.

17
00:50.160 --> 00:54.930
But I want you to remember that we can actually use any parameters that Google

18
00:54.930 --> 00:56.360
Cloud supports

19
00:56.360 --> 01:01.880
on that reference web page and Google Cloud will automatically negotiate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:56.360 --> 01:01.880
on that reference web page and Google Cloud will automatically negotiate.

20
01:01.880 --> 01:05.790
So although we are using, of course, particular parameters in this

21
01:05.790 --> 01:07.160
configuration, we could

22
01:07.160 --> 01:10.920
actually use anything that Google Cloud supports.

23
01:10.920 --> 01:16.620
So all of that said, let's jump in and put our configuration on our router on

24
01:16.620 --> 01:20.680
Pram R1.

25
01:20.680 --> 01:25.300
So the first thing that we want to configure here is of course our Ike V2 key

26
01:25.300 --> 01:25.920
ring.

27
01:25.920 --> 01:28.400
So we'll go ahead and put this in.

28
01:28.400 --> 01:32.140
Keep in mind, all we really need to make sure here is that we're using the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:28.400 --> 01:32.140
Keep in mind, all we really need to make sure here is that we're using the

29
01:32.140 --> 01:33.240
correct external

30
01:33.240 --> 01:36.160
address for our VPN gateway.

31
01:36.160 --> 01:40.440
And of course, that we're using the same pre-shared key here that we put into

32
01:40.440 --> 01:42.680
Google Cloud.

33
01:42.680 --> 01:46.920
Next we need to configure the three P's for Ike V2.

34
01:46.920 --> 01:51.480
Remember that that's our proposal, our policy and our profile.

35
01:51.480 --> 01:55.210
So as we look down what we just put in here, we see that we are in fact setting

36
01:55.210 --> 01:56.120
the encryption

37
01:56.120 --> 01:59.680
to AES GCM256.

38
01:59.680 --> 02:05.960
For PRF, we're using SHA256 and we're using Diffie Helmand Group 14.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:59.680 --> 02:05.960
For PRF, we're using SHA256 and we're using Diffie Helmand Group 14.

39
02:05.960 --> 02:11.950
Then for our policy, we're matching on our local address, tying that to the

40
02:11.950 --> 02:12.920
proposal that

41
02:12.920 --> 02:15.040
we just created.

42
02:15.040 --> 02:20.040
Then for our profile, we're matching our local interface gigabit one.

43
02:20.040 --> 02:22.440
And of course, we're matching the remote address.

44
02:22.440 --> 02:29.640
And again, this should be that same external address of the GCP VPN gateway.

45
02:29.640 --> 02:31.560
We match our local address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:29.640 --> 02:31.560
We match our local address.

46
02:31.560 --> 02:36.440
And of course, we're configuring both our local and our remote authentication

47
02:36.440 --> 02:37.600
to use pre-shared

48
02:37.600 --> 02:38.600
key.

49
02:38.600 --> 02:43.460
And of course, that means we then call to our key ring that we created

50
02:43.460 --> 02:44.680
previously.

51
02:44.680 --> 02:48.040
So that takes care of the Ike V2 components.

52
02:48.040 --> 02:52.880
Once we put in our IPsec components, so again, we have our transform set, which

53
02:52.880 --> 02:53.240
is going

54
02:53.240 --> 02:58.240
to be using ESP GCM256 and using Tunnel Mode.

55
02:58.240 --> 03:01.930
Then of course, we have our IPsec profile, which is what we actually apply to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:58.240 --> 03:01.930
Then of course, we have our IPsec profile, which is what we actually apply to

56
03:01.930 --> 03:02.520
our tunnel

57
03:02.520 --> 03:04.040
interface.

58
03:04.040 --> 03:09.120
That's tying together our transform set and our Ike V2 profile.

59
03:09.120 --> 03:14.080
So all of this configured, we're now ready to configure our tunnel interface.

60
03:14.080 --> 03:16.760
So we'll paste in our configuration.

61
03:16.760 --> 03:20.210
The first thing, of course, we have to configure with the tunnel is an IP

62
03:20.210 --> 03:20.880
address.

63
03:20.880 --> 03:24.620
Now the IP address here doesn't particularly matter because we're going to be

64
03:24.620 --> 03:25.320
routing to

65
03:25.320 --> 03:28.640
the tunnel, not to an IP address.

66
03:28.640 --> 03:34.000
It has to have an IP address in order to do IP forwarding and IP routing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:28.640 --> 03:34.000
It has to have an IP address in order to do IP forwarding and IP routing.

67
03:34.000 --> 03:37.720
However, it doesn't really matter what that address is.

68
03:37.720 --> 03:44.300
The IPMTU and the TCP MSS or maximum segment size should be adjusted for the

69
03:44.300 --> 03:45.360
tunnel.

70
03:45.360 --> 03:50.640
Now here we're setting the MTU to 1400, which is rather conservative.

71
03:50.640 --> 03:55.500
If you wanted to, after the tunnel was up, you could come back, actually test

72
03:55.500 --> 03:56.040
the MTU

73
03:56.040 --> 04:01.190
on the tunnel and set this a little more accurately, but 1400 is a relatively
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:56.040 --> 04:01.190
on the tunnel and set this a little more accurately, but 1400 is a relatively

74
04:01.190 --> 04:02.520
safe number,

75
04:02.520 --> 04:06.000
and for lab use, it's going to be perfectly fine.

76
04:06.000 --> 04:11.890
The TCP maximum segment size should always be 40 bytes smaller than the MTU to

77
04:11.890 --> 04:12.400
account

78
04:12.400 --> 04:15.520
for the IP and TCP headers.

79
04:15.520 --> 04:19.120
Then of course, like any other tunnel, we have to set the tunnel source.

80
04:19.120 --> 04:23.520
In this case, it's our egress interface or Gigabit Ethernet 1.

81
04:23.520 --> 04:30.010
We need to change the default tunnel mode from GRE to IPsec over IPv4, which is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
04:23.520 --> 04:30.010
We need to change the default tunnel mode from GRE to IPsec over IPv4, which is

82
04:30.010 --> 04:30.600
what we're

83
04:30.600 --> 04:32.200
doing here.

84
04:32.200 --> 04:36.110
And since this is a point to point tunnel, not a point to multi point, we also

85
04:36.110 --> 04:36.520
need to

86
04:36.520 --> 04:38.680
set the tunnel destination.

87
04:38.680 --> 04:43.280
This again would be that external address from Google Cloud.

88
04:43.280 --> 04:49.080
Finally, we set the tunnel protection for IPsec to use our IPsec profile that

89
04:49.080 --> 04:49.760
we created

90
04:49.760 --> 04:51.080
above.

91
04:51.080 --> 04:55.630
The last thing we want to do is configure a static route to point all of our

92
04:55.630 --> 05:00.360
traffic for 10.40.0.0/16
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:55.630 --> 05:00.360
traffic for 10.40.0.0/16

93
05:00.360 --> 05:02.440
out that tunnel interface.

94
05:02.440 --> 05:07.520
So once we have the route in like that, we can simply exit configuration.

95
05:07.520 --> 05:10.440
So let's go ahead and do some verification.

96
05:10.440 --> 05:13.040
Let's just start with the show IP interface brief.

97
05:13.040 --> 05:16.340
Of course, the main thing we're looking for here is that our tunnel one

98
05:16.340 --> 05:17.160
interface is in

99
05:17.160 --> 05:18.920
fact up.

100
05:18.920 --> 05:21.640
Let's go ahead and see if we can ping the other side.

101
05:21.640 --> 05:27.080
So let's tell it to ping that 10.40.10.100, which is SRV1.

102
05:27.080 --> 05:30.320
Of course, we will have to source it from our inside interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
05:27.080 --> 05:30.320
Of course, we will have to source it from our inside interface.

103
05:30.320 --> 05:32.520
But let's go ahead and do that ping.

104
05:32.520 --> 05:34.200
We see that it's successful.

105
05:34.200 --> 05:36.800
So we are going across the tunnel.

106
05:36.800 --> 05:41.200
We can verify this with a show crypto IPsec SA.

107
05:41.200 --> 05:44.000
There's a couple key things in here we want to look for.

108
05:44.000 --> 05:48.490
First, we can see the number of packets that have been encapsulated and de-caps

109
05:48.490 --> 05:49.200
ulated,

110
05:49.200 --> 05:51.520
as well as encrypted and decrypted.

111
05:51.520 --> 05:54.480
So far, it's just a few pings.

112
05:54.480 --> 06:00.190
Also note that for the current peer, that it's using port 4,500, which tells us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:54.480 --> 06:00.190
Also note that for the current peer, that it's using port 4,500, which tells us

113
06:00.190 --> 06:00.760
that it's

114
06:00.760 --> 06:03.880
using IPsec natural reversal.

115
06:03.880 --> 06:07.920
So this confirms a lot of aspects of the tunnel in that it's encrypting and dec

116
06:07.920 --> 06:09.680
rypting the packets

117
06:09.680 --> 06:13.600
and it's using IPsec with natural reversal.

118
06:13.600 --> 06:18.040
Let's go ahead and start a continuous ping here to generate some traffic.

119
06:18.040 --> 06:21.320
So we'll simply repeat this ping a few times.

120
06:21.320 --> 06:24.720
We'll hit enter and we'll simply let this ping.

121
06:24.720 --> 06:30.400
Now let's jump over to workstation1 and do some verification from there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
06:24.720 --> 06:30.400
Now let's jump over to workstation1 and do some verification from there.

122
06:30.400 --> 06:35.440
The workstation1 remember is in the on-prem or headquarters location and all we

123
06:35.440 --> 06:36.000
really

124
06:36.000 --> 06:41.320
want to do is verify that it can also reach our server so we'll ping the 10.40.

125
06:41.320 --> 06:43.240
10.100.

126
06:43.240 --> 06:46.880
And what we see here is that it is in fact working.

127
06:46.880 --> 06:48.800
So all of this looks good.

128
06:48.800 --> 06:53.330
Let's actually jump back over to Google Cloud and do some verification from

129
06:53.330 --> 06:54.080
that side as

130
06:54.080 --> 06:55.400
well.

131
06:55.400 --> 06:59.950
So here on Google Cloud, let's go to our navigation menu, down to network

132
06:59.950 --> 07:01.440
connectivity and choose
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:59.950 --> 07:01.440
connectivity and choose

133
07:01.440 --> 07:03.280
VPN.

134
07:03.280 --> 07:09.280
First thing to note here is that our VPN tunnel status is now established.

135
07:09.280 --> 07:11.920
So we see right here that it's working.

136
07:11.920 --> 07:16.330
If we then click on our actual tunnel, this will bring up a little bit more

137
07:16.330 --> 07:17.200
detail about

138
07:17.200 --> 07:22.600
the tunnel, but what we really want to see is going over here to monitoring.

139
07:22.600 --> 07:27.100
So even though we just started our ping and just started generating traffic, we

140
07:27.100 --> 07:28.320
see already

141
07:28.320 --> 07:33.720
that we're seeing traffic hitting the tunnel and Google Cloud is recognizing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
07:28.320 --> 07:33.720
that we're seeing traffic hitting the tunnel and Google Cloud is recognizing

142
07:33.720 --> 07:34.840
that traffic.

143
07:34.840 --> 07:39.200
So this tunnel is working exactly as we want.

144
07:39.200 --> 07:45.730
So in this video, we got our IP sec tunnel up and running between iOS XE and

145
07:45.730 --> 07:46.880
the native

146
07:46.880 --> 07:49.600
Google Cloud VPN gateway.

147
07:49.600 --> 07:53.970
We see that our traffic is traversing the tunnel appropriately and that it's

148
07:53.970 --> 07:55.160
being encrypted

149
07:55.160 --> 07:56.760
and decrypted.

150
07:56.760 --> 08:00.360
So everything here is working exactly as designed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
07:56.760 --> 08:00.360
So everything here is working exactly as designed.

151
08:00.360 --> 08:04.990
So that's everything that we need to cover in this skill, except for the

152
08:04.990 --> 08:06.040
challenge.

153
08:06.040 --> 08:10.460
In this challenge, we're going to be building a redundant tunnel, but this time

154
08:10.460 --> 08:10.960
it's going

155
08:10.960 --> 08:14.200
to be going to on prem R2.

156
08:14.200 --> 08:16.840
That's going to cause a little bit of a net issue.

157
08:16.840 --> 08:21.040
So we're actually going to talk about that before we jump into the challenge.

158
08:21.040 --> 08:22.920
So I'll see you in that video.

159
08:22.920 --> 08:32.920
[BLANK_AUDIO]