WEBVTT

1
00:00.000 --> 00:07.440
So now let's jump in and take a look at our solution on how to deploy our

2
00:07.440 --> 00:09.080
second tunnel.

3
00:09.080 --> 00:15.200
So we'll start off here on the network connectivity VPN page under the header

4
00:15.200 --> 00:17.140
cloud VPN tunnels.

5
00:17.140 --> 00:21.850
Here of course we have our existing tunnel that we already have going to on

6
00:21.850 --> 00:22.600
prem R1.

7
00:22.600 --> 00:26.920
So what we're going to do now is create a VPN tunnel.

8
00:26.920 --> 00:30.800
So we'll simply come up here, click on create VPN tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:26.920 --> 00:30.800
So we'll simply come up here, click on create VPN tunnel.

9
00:30.800 --> 00:33.600
We'll choose our VPN gateway.

10
00:33.600 --> 00:37.520
Notice it is saying here that it doesn't support high availability.

11
00:37.520 --> 00:42.400
That's simply referring to the way Google Cloud refers to redundancy,

12
00:42.400 --> 00:45.480
meaning running BGP and all of that.

13
00:45.480 --> 00:50.800
We can still have two tunnels and then do our own load sharing across those

14
00:50.800 --> 00:51.600
tunnels.

15
00:51.600 --> 00:56.240
So we're going to be doing the fault tolerance a slightly different way.

16
00:56.240 --> 00:58.640
We'll hit continue.

17
00:58.640 --> 01:04.640
We'll do a slight modification here on the name so that it's VNG one tunnel two
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:58.640 --> 01:04.640
We'll do a slight modification here on the name so that it's VNG one tunnel two

18
01:04.640 --> 01:04.640
.

19
01:04.640 --> 01:08.360
Next we need to put in the remote peer IP address.

20
01:08.360 --> 01:11.280
This is where we need that second IP address,

21
01:11.280 --> 01:15.560
because if we tried to put in the same one, we would get an error about having

22
01:15.560 --> 01:17.320
the same IP address

23
01:17.320 --> 01:20.080
going to the same VPN gateway.

24
01:20.080 --> 01:23.040
So here we'll put in our other public address.

25
01:23.040 --> 01:25.960
Next we'll put in our pre-shared key.

26
01:25.960 --> 01:28.240
Down here under our routing options,

27
01:28.240 --> 01:32.670
we're going to change this to route based once again and point all of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.240 --> 01:32.670
we're going to change this to route based once again and point all of the

28
01:32.670 --> 01:34.120
internal networks

29
01:34.120 --> 01:36.080
back through this tunnel.

30
01:36.080 --> 01:39.520
So 10.0.0.0/8.

31
01:39.520 --> 01:41.560
We'll go ahead and hit create.

32
01:41.560 --> 01:46.160
So now we see both of our tunnels here configured and we see that our new

33
01:46.160 --> 01:46.880
tunnel

34
01:46.880 --> 01:49.360
is waiting for its first handshake.

35
01:49.360 --> 01:51.960
So all of this looks correct.

36
01:51.960 --> 01:57.580
Let's go ahead and jump in to on-prem R2 and put its configuration in for this

37
01:57.580 --> 01:58.480
tunnel.

38
01:58.480 --> 02:03.220
So the first thing we want to configure here on on-prem R2 is we want to create
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:58.480 --> 02:03.220
So the first thing we want to configure here on on-prem R2 is we want to create

39
02:03.220 --> 02:04.640
our key ring.

40
02:04.640 --> 02:10.750
Again, this is just going to be using that same outside address for the GCP VPN

41
02:10.750 --> 02:11.920
gateway.

42
02:11.920 --> 02:16.000
And of course, make sure we put in our pre-shared keys.

43
02:16.000 --> 02:19.440
Next we'll put in our IKV2 components.

44
02:19.440 --> 02:25.730
So our proposal, our policy, and our profile, then of course the IP second

45
02:25.730 --> 02:26.680
components,

46
02:26.680 --> 02:31.480
the tunnel interface, and of course the static route.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:26.680 --> 02:31.480
the tunnel interface, and of course the static route.

47
02:31.480 --> 02:35.240
Once all of that's done, we can exit out of configuration mode.

48
02:35.240 --> 02:39.280
Then for verification, let's do a show IP interface brief.

49
02:39.280 --> 02:43.280
We see here that our tunnel 2 is in fact up up.

50
02:43.280 --> 02:46.240
Let's jump over to Google Cloud.

51
02:46.240 --> 02:51.360
We see here that both tunnels are now showing as established, so now our

52
02:51.360 --> 02:52.640
redundant tunnel

53
02:52.640 --> 02:55.200
is working as designed.

54
02:55.200 --> 03:00.000
So that completes this challenge and therefore this skill.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
03:00.000 --> 03:04.290
If you find that you are missing any of the information needed to complete this

56
03:04.290 --> 03:04.960
challenge,

57
03:04.960 --> 03:09.110
I would encourage you to go back and review the steps in the skill above for

58
03:09.110 --> 03:09.880
any missing

59
03:09.880 --> 03:11.480
information.

60
03:11.480 --> 03:18.280
Otherwise, congratulations on completing Configure Native IPSec VPN to GCP.

61
03:18.280 --> 03:22.520
I hope this has been informative for you and I'd like to thank you for viewing.

62
03:22.520 --> 03:32.520
[BLANK_AUDIO]