WEBVTT

1
00:00.000 --> 00:08.120
So let's begin here by configuring our Ike version two key ring that we're

2
00:08.120 --> 00:08.280
going to

3
00:08.280 --> 00:12.400
be using for authentication with our pre shared key.

4
00:12.400 --> 00:16.280
Now as we jump into this a couple things to keep in mind.

5
00:16.280 --> 00:19.440
First this step is technically optional.

6
00:19.440 --> 00:24.120
We could specify these keys in our Ike profile.

7
00:24.120 --> 00:29.420
However, by using a key chain, it does give us a little more flexibility to use

8
00:29.420 --> 00:31.120
an Ike profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:29.420 --> 00:31.120
an Ike profile

9
00:31.120 --> 00:36.560
for different remote clients and have different keys for each one.

10
00:36.560 --> 00:41.340
So it does add that level of flexibility to the whole process, but it's not

11
00:41.340 --> 00:43.320
strictly necessary.

12
00:43.320 --> 00:47.720
The other thing to keep in mind is the actual pre shared keys we're going to

13
00:47.720 --> 00:48.240
use.

14
00:48.240 --> 00:54.180
It would generally be considered best practice to use large complex keys, not

15
00:54.180 --> 00:55.040
something simple

16
00:55.040 --> 01:00.800
like maybe Cisco 123 or super secret key, something along those lines.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:55.040 --> 01:00.800
like maybe Cisco 123 or super secret key, something along those lines.

17
01:00.800 --> 01:04.200
Clearly, we want this to be as secure as possible.

18
01:04.200 --> 01:08.390
But that said, this being a lab environment, if you want to use something a

19
01:08.390 --> 01:09.480
little easier,

20
01:09.480 --> 01:10.720
feel free to do so.

21
01:10.720 --> 01:12.360
I'm going to provide the keys here.

22
01:12.360 --> 01:16.730
However, if you want to use the same keys that we're using that said, let's

23
01:16.730 --> 01:17.200
jump into

24
01:17.200 --> 01:22.960
the command line and get these key rings configured.

25
01:22.960 --> 01:27.480
So we'll start here on the on premises router one.

26
01:27.480 --> 01:33.150
And just a quick note, I did change this host name to on prem r one rather than
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:27.480 --> 01:33.150
And just a quick note, I did change this host name to on prem r one rather than

27
01:33.150 --> 01:33.560
just

28
01:33.560 --> 01:38.620
our one, which is what it would be if you have loaded up our pre saved

29
01:38.620 --> 01:40.040
configurations.

30
01:40.040 --> 01:44.440
I did this just for clarification as we're moving through the command line.

31
01:44.440 --> 01:48.960
So the first thing we want to do is go ahead and create this key ring.

32
01:48.960 --> 01:51.000
So we're going to configuration mode.

33
01:51.000 --> 01:56.000
We're going to crypto for Ike version two.

34
01:56.000 --> 01:57.800
We'll create a key ring.

35
01:57.800 --> 02:00.000
And here we just give it a name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
02:00.000 --> 02:04.640
So I'm just going to call it AWS underscore keys, even though it's only going

37
02:04.640 --> 02:05.400
to have one

38
02:05.400 --> 02:07.240
key at the moment.

39
02:07.240 --> 02:10.440
The next thing we want to do is create a peer.

40
02:10.440 --> 02:14.520
So we'll create a peer, we have to give it some form of a name.

41
02:14.520 --> 02:18.480
I'm just going to call it AWS tunnel one, since this is the first tunnel

42
02:18.480 --> 02:19.360
interface that

43
02:19.360 --> 02:20.920
we're building.

44
02:20.920 --> 02:24.970
The next thing we're going to want to provide is an address to identify the

45
02:24.970 --> 02:25.920
peer that we're

46
02:25.920 --> 02:28.840
going to match up with this key chain.

47
02:28.840 --> 02:34.950
So since this is the on prem router, this is going to be the public address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:28.840 --> 02:34.950
So since this is the on prem router, this is going to be the public address

48
02:34.950 --> 02:35.720
from AWS.

49
02:35.720 --> 02:40.230
If you don't know what this is, of course, you need to go over to AWS, look at

50
02:40.230 --> 02:41.000
your elastic

51
02:41.000 --> 02:47.040
IPs, which one is applied to your router one gigabit one interface.

52
02:47.040 --> 02:49.040
I have that information here.

53
02:49.040 --> 02:56.120
Mine happens to be 54.163.151.21.

54
02:56.120 --> 03:00.900
The next thing we want to do here is actually configure, of course, the pre
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:56.120 --> 03:00.900
The next thing we want to do here is actually configure, of course, the pre

55
03:00.900 --> 03:02.000
shared keys.

56
03:02.000 --> 03:06.480
So we'll say pre shared key, and then we have to specify whether this is local

57
03:06.480 --> 03:07.940
or remote,

58
03:07.940 --> 03:12.210
or we could just put a key in here, but we're going to say local, and then we

59
03:12.210 --> 03:12.720
're going to

60
03:12.720 --> 03:18.080
put in the pre shared key that I provided for the use in this lab.

61
03:18.080 --> 03:21.000
So it's just a randomly generated key.

62
03:21.000 --> 03:25.200
And then we'll do the same thing for the remote key.

63
03:25.200 --> 03:28.430
These of course could be different if you want them to be, or you can just use

64
03:28.430 --> 03:28.920
the same

65
03:28.920 --> 03:32.240
key for both local and remote.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:28.920 --> 03:32.240
key for both local and remote.

66
03:32.240 --> 03:34.480
We'll exit configuration.

67
03:34.480 --> 03:39.250
So now that that's configured, let's go configure the same thing over on AWS

68
03:39.250 --> 03:39.760
router

69
03:39.760 --> 03:40.760
one.

70
03:40.760 --> 03:45.530
Of course, the only thing that's going to be different here is going to be the

71
03:45.530 --> 03:45.960
address.

72
03:45.960 --> 03:49.920
Since this is identical, we'll simply paste in the configuration.

73
03:49.920 --> 03:54.770
Now of course, on this one, the address, which I've hidden for hopefully

74
03:54.770 --> 03:56.320
obvious reasons,

75
03:56.320 --> 04:01.480
is the actual public IP address of your headquarters site.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:56.320 --> 04:01.480
is the actual public IP address of your headquarters site.

76
04:01.480 --> 04:08.090
So this would be the IP address as assigned by your service provider to router

77
04:08.090 --> 04:08.520
one on

78
04:08.520 --> 04:10.480
the on-prem router.

79
04:10.480 --> 04:15.150
In our design, of course, this would be the outside interface of the device

80
04:15.150 --> 04:16.080
that's doing

81
04:16.080 --> 04:18.560
that or Pat.

82
04:18.560 --> 04:23.320
So our main goal here was simply to get the key ring configured.

83
04:23.320 --> 04:24.440
We've done that.

84
04:24.440 --> 04:30.820
So now let's move on with actually setting up the three P's of like version two
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:24.440 --> 04:30.820
So now let's move on with actually setting up the three P's of like version two

85
04:30.820 --> 04:30.880
.

86
04:30.880 --> 04:32.520
We'll do that in the next video.

87
04:32.520 --> 04:41.600
[BLANK_AUDIO]