WEBVTT 1 00:00.000 --> 00:06.720 So the next thing we're going to want to configure here are the three Ps for 2 00:06.720 --> 00:08.720 Ike version two. 3 00:08.720 --> 00:13.680 That would be the proposal, the policy, and the profile. 4 00:13.680 --> 00:19.370 Now these again are going to be very similar between the on-prem and the AWS 5 00:19.370 --> 00:20.280 router. 6 00:20.280 --> 00:24.680 However, of course, some of the addresses are going to have to change. 7 00:24.680 --> 00:30.000 So as we did before, let's jump in and configure the on-prem router, then we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:30.000 --> 00:30.320 take that 9 00:30.320 --> 00:36.800 configuration, we'll put it into our text editor, we'll modify that for the AWS 10 00:36.800 --> 00:37.120 router 11 00:37.120 --> 00:41.630 one, and then of course we'll just paste that in rather than typing it all over 12 00:41.630 --> 00:42.360 again. 13 00:42.360 --> 00:46.980 So let's go ahead and jump in and get the three Ps of Ike version two 14 00:46.980 --> 00:47.920 configured on 15 00:47.920 --> 00:51.600 both of our routers. 16 00:51.600 --> 00:57.100 So the first thing we want to talk about are some defaults that we have on iOS 17 00:57.100 --> 00:57.600 XE. 18 00:57.600 --> 01:05.600 Let's start off with a show crypto, Ike version two proposal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 18 00:57.600 --> 01:05.600 Let's start off with a show crypto, Ike version two proposal. 19 01:05.600 --> 01:11.540 Notice that with nothing configured whatsoever, there is a default proposal 20 01:11.540 --> 01:12.920 already here that's 21 01:12.920 --> 01:19.180 going to propose various different encryption, integrity, PRF, and Diffie-Hell 22 01:19.180 --> 01:21.200 man groups. 23 01:21.200 --> 01:28.320 So if we hit up, we'll take off proposal and we'll put on policy. 24 01:28.320 --> 01:31.400 There is also a default policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 01:28.320 --> 01:31.400 There is also a default policy. 25 01:31.400 --> 01:34.320 Now it's not really defining anything as we can see. 26 01:34.320 --> 01:36.920 It's going to match any VRF. 27 01:36.920 --> 01:39.440 It's going to match any local address. 28 01:39.440 --> 01:43.520 So it's really not defining anything, but it does exist. 29 01:43.520 --> 01:49.560 And finally, if we do profile, there's not a default profile. 30 01:49.560 --> 01:52.880 Now why are we talking about this? 31 01:52.880 --> 01:58.320 So let me start by saying I personally have never run into this problem. 32 01:58.320 --> 02:03.500 However, through the years, I have read several documents about certain people WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 32 01:58.320 --> 02:03.500 However, through the years, I have read several documents about certain people 33 02:03.500 --> 02:04.240 in certain 34 02:04.240 --> 02:10.800 situations having problems with these default proposals and policies. 35 02:10.800 --> 02:15.080 Now if you create your own and you point the device towards your own and you 36 02:15.080 --> 02:15.960 match on things 37 02:15.960 --> 02:19.280 properly, you should not have a problem. 38 02:19.280 --> 02:23.800 However, again, on some platforms, people have had issues. 39 02:23.800 --> 02:27.000 So I just thought I would show you real quickly how to get rid of these 40 02:27.000 --> 02:27.920 defaults should you 41 02:27.920 --> 02:28.920 need to. 42 02:28.920 --> 02:33.180 Again, I've never had a need to do so, but just in case, since we're not going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 42 02:28.920 --> 02:33.180 Again, I've never had a need to do so, but just in case, since we're not going 43 02:33.180 --> 02:33.640 to use 44 02:33.640 --> 02:37.440 them anyway, I'm going to show you how to get rid of that. 45 02:37.440 --> 02:44.900 All we have to do is go into configuration mode and say no, crypto, like 46 02:44.900 --> 02:46.360 version two, 47 02:46.360 --> 02:49.200 proposal default. 48 02:49.200 --> 02:53.240 Notice it's telling us it can't remove it because it's in use. 49 02:53.240 --> 02:54.680 Okay. 50 02:54.680 --> 02:56.840 So let's get rid of the policy. 51 02:56.840 --> 03:01.280 If we get rid of the policy, then we can get rid of the proposal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 02:56.840 --> 03:01.280 If we get rid of the policy, then we can get rid of the proposal. 52 03:01.280 --> 03:05.490 So we couldn't get rid of the proposal first because you can see right here 53 03:05.490 --> 03:06.400 that that default 54 03:06.400 --> 03:09.840 policy was actually calling to the default proposal. 55 03:09.840 --> 03:15.160 So we do have to delete these in the correct order or else it won't work. 56 03:15.160 --> 03:19.740 Now that that's done, we can ask to see all three of those things again and 57 03:19.740 --> 03:20.360 notice what 58 03:20.360 --> 03:22.440 it tells us under each one. 59 03:22.440 --> 03:25.960 When we look at the proposal, it tells us that the default is disabled. 60 03:25.960 --> 03:29.400 The policy also tells us the default is disabled now. 61 03:29.400 --> 03:33.280 And of course, there wasn't a default profile to begin with. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 61 03:29.400 --> 03:33.280 And of course, there wasn't a default profile to begin with. 62 03:33.280 --> 03:37.630 So now that we've got this turned off here on router one, just for consistency, 63 03:37.630 --> 03:37.840 let's 64 03:37.840 --> 03:42.520 go ahead and disable it on AWS router one as well. 65 03:42.520 --> 03:46.120 So since this is the same configuration, we'll just go ahead and paste it in. 66 03:46.120 --> 03:47.760 We put it in the correct order. 67 03:47.760 --> 03:50.080 So it took both of them out. 68 03:50.080 --> 03:54.600 Just to verify we're in the same place, we'll look at all three commands again. 69 03:54.600 --> 03:59.840 Once again, we see both defaults are disabled and there is no default profile. 70 03:59.840 --> 04:04.560 So now we've got both of our routers on a level playing field and we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 70 03:59.840 --> 04:04.560 So now we've got both of our routers on a level playing field and we have 71 04:04.560 --> 04:05.440 disabled the 72 04:05.440 --> 04:08.280 default proposal and policy. 73 04:08.280 --> 04:11.640 So now let's go ahead and begin configuring our own. 74 04:11.640 --> 04:14.240 Let's jump back over to on-prem R1. 75 04:14.240 --> 04:19.240 So the first thing we're going to want is under crypto, Ike version two, we'll 76 04:19.240 --> 04:21.320 do a proposal. 77 04:21.320 --> 04:23.480 At this point, it's just going to want to name. 78 04:23.480 --> 04:29.880 So we'll call it Ike V2 proposal for AWS. 79 04:29.880 --> 04:34.500 So we see here as soon as we come in, it tells us that we essentially have two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 79 04:29.880 --> 04:34.500 So we see here as soon as we come in, it tells us that we essentially have two 80 04:34.500 --> 04:35.360 choices. 81 04:35.360 --> 04:42.440 The first choice is to use an encryption algorithm other than AES GCM. 82 04:42.440 --> 04:46.320 And if we choose to do that, we're going to have to specify an integrity 83 04:46.320 --> 04:47.320 algorithm and 84 04:47.320 --> 04:49.680 a Diffie-Hellman group. 85 04:49.680 --> 04:57.000 Or alternatively, we can set the encryption algorithm to AES GCM and instead 86 04:57.000 --> 04:58.200 specify a 87 04:58.200 --> 05:04.880 pseudo random function or a PRF algorithm and a Diffie-Hellman group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 04:58.200 --> 05:04.880 pseudo random function or a PRF algorithm and a Diffie-Hellman group. 88 05:04.880 --> 05:09.120 Now in this particular case, GCM is generally preferred. 89 05:09.120 --> 05:10.200 So let's go ahead and do that. 90 05:10.200 --> 05:16.110 We'll say encryption GCM and then notice we basically have two choices for the 91 05:16.110 --> 05:16.920 bit length. 92 05:16.920 --> 05:19.480 It's either 128 or 256. 93 05:19.480 --> 05:22.160 Let's go ahead and do 256. 94 05:22.160 --> 05:27.970 Now it's already told us that if we do this, we have to specify the PRF for the 95 05:27.970 --> 05:28.680 PRF. 96 05:28.680 --> 05:30.960 We'll just do SHA 512. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 96 05:28.680 --> 05:30.960 We'll just do SHA 512. 97 05:30.960 --> 05:34.760 Finally, we need a Diffie-Hellman group. 98 05:34.760 --> 05:37.640 We can really use any of these options. 99 05:37.640 --> 05:40.800 I'm just going to go ahead and use Diffie-Hellman group 20. 100 05:40.800 --> 05:45.240 We may modify this later, but this is what we'll choose for now. 101 05:45.240 --> 05:47.720 So that takes care of the proposal. 102 05:47.720 --> 05:53.000 We'll exit out of configuration mode here and verify that it took our proposal. 103 05:53.000 --> 05:56.840 So if we do our show crypto Ike version 2 proposal again, we see that now the 104 05:56.840 --> 05:58.200 only one we have 105 05:58.200 --> 06:00.160 is the one we just created. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 105 05:58.200 --> 06:00.160 is the one we just created. 106 06:00.160 --> 06:06.320 It has our encryption, our PRF, and our Diffie-Hellman group specified. 107 06:06.320 --> 06:10.220 By the way, another command that's generally recommended, and we'll just turn 108 06:10.220 --> 06:10.760 this on on 109 06:10.760 --> 06:17.740 both devices, is the crypto Ike version 2, fragmentation MTU, and set it to 110 06:17.740 --> 06:19.040 something like 111 06:19.040 --> 06:20.320 1200. 112 06:20.320 --> 06:23.640 So that should take care of configuring the proposal. 113 06:23.640 --> 06:27.320 And this is going to be identical on AWS R1. 114 06:27.320 --> 06:30.920 There's nothing device specific about this configuration. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 114 06:27.320 --> 06:30.920 There's nothing device specific about this configuration. 115 06:30.920 --> 06:34.800 So let's just hop over there and put this configuration in. 116 06:34.800 --> 06:39.200 So again, we'll just paste this in and let's move on to the policies. 117 06:39.200 --> 06:43.200 Again, we'll always start on the on-prem router. 118 06:43.200 --> 06:51.080 So for the policy, crypto Ike version 2, policy, once again, we just have to 119 06:51.080 --> 06:53.440 give it a name. 120 06:53.440 --> 06:59.080 So we'll call it Ike V2, underscore policy, underscore AWS. 121 06:59.080 --> 07:04.040 Now, the first thing this tells us is that the policy must have at least one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 06:59.080 --> 07:04.040 Now, the first thing this tells us is that the policy must have at least one 122 07:04.040 --> 07:04.720 complete 123 07:04.720 --> 07:05.960 proposal attached. 124 07:05.960 --> 07:09.520 Okay, so let's go ahead and do that first then. 125 07:09.520 --> 07:15.800 So we'll put in proposal and then the name of our proposal, which is Ike V2, 126 07:15.800 --> 07:16.880 underscore 127 07:16.880 --> 07:20.480 proposal, underscore AWS. 128 07:20.480 --> 07:25.390 If for any reason that proposal was not complete, it would kick this command 129 07:25.390 --> 07:26.400 out telling us 130 07:26.400 --> 07:31.440 that it cannot attach that particular proposal because it's not complete. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 130 07:26.400 --> 07:31.440 that it cannot attach that particular proposal because it's not complete. 131 07:31.440 --> 07:33.480 In our case, we're okay. 132 07:33.480 --> 07:39.280 The other thing we probably want to do here is do a match for an address. 133 07:39.280 --> 07:41.160 We'll match a local address. 134 07:41.160 --> 07:45.630 And it's simply once an IP before address to match on this being the on-prem 135 07:45.630 --> 07:46.400 router. 136 07:46.400 --> 07:49.750 This would be the address we're going to be sourcing the tunnel from, which is 137 07:49.750 --> 07:50.200 going to 138 07:50.200 --> 07:54.840 be the 204 dot 186 dot 19 dot 10. 139 07:54.840 --> 08:00.440 So once again, we'll exit out here and we'll repeat our command to look at the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 139 07:54.840 --> 08:00.440 So once again, we'll exit out here and we'll repeat our command to look at the 140 08:00.440 --> 08:00.560 policy. 141 08:00.560 --> 08:02.160 And this is exactly what it should look like. 142 08:02.160 --> 08:04.460 We see our policy with its name. 143 08:04.460 --> 08:06.840 It's using the global VRF. 144 08:06.840 --> 08:10.200 It's matching the local address of our gigabit interface. 145 08:10.200 --> 08:17.160 If we do a show IP interface brief, notice that is the address on gigabit one. 146 08:17.160 --> 08:22.160 And then of course, our proposal is also attached to that policy. 147 08:22.160 --> 08:25.640 So now what we'll do is we'll put this in notepad. 148 08:25.640 --> 08:29.720 If we look at this in notepad, I've already put the policy in and configured 149 08:29.720 --> 08:30.360 the local WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 149 08:29.720 --> 08:30.360 the local 150 08:30.360 --> 08:38.640 address to be AWS router one's interface, which is 10 dot 20 dot 1 dot 254. 151 08:38.640 --> 08:42.080 So that being the case, we can just highlight all of this. 152 08:42.080 --> 08:43.600 We can copy it. 153 08:43.600 --> 08:51.180 Go back over to our terminal software on AWS R one and paste this configuration 154 08:51.180 --> 08:51.400 in. 155 08:51.400 --> 08:53.520 Next up, of course, is the profile. 156 08:53.520 --> 08:59.960 Let's go back over to router one back in a configuration mode crypto. 157 08:59.960 --> 09:03.240 Ike version to profile. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 08:59.960 --> 09:03.240 Ike version to profile. 158 09:03.240 --> 09:05.960 Once again, it simply wants a name. 159 09:05.960 --> 09:11.080 Ike version to profile AWS. 160 09:11.080 --> 09:14.760 Keep in mind, this is just what I'm choosing to name these things. 161 09:14.760 --> 09:18.460 You can of course name these, whatever makes sense in your environment with 162 09:18.460 --> 09:19.360 your own naming 163 09:19.360 --> 09:20.360 convention. 164 09:20.360 --> 09:24.360 But regardless of what we name it, let's go ahead and hit enter. 165 09:24.360 --> 09:28.640 And it tells us that we have to have a local and a remote authentication method 166 09:28.640 --> 09:28.920 . 167 09:28.920 --> 09:34.160 And we have to have a match identity or a match certificate or match any WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 09:28.920 --> 09:34.160 And we have to have a match identity or a match certificate or match any 168 09:34.160 --> 09:35.320 statement. 169 09:35.320 --> 09:38.600 But we're going to actually do a match identity. 170 09:38.600 --> 09:43.480 But let's go ahead and put in all of the information we need here as we go. 171 09:43.480 --> 09:49.440 So the first thing we're going to do is a match address local. 172 09:49.440 --> 09:54.920 Now here we could put in an address or we can actually specify an interface. 173 09:54.920 --> 09:56.560 We'll do an interface. 174 09:56.560 --> 10:00.880 And in our case, it's going to be the gigabit one interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 174 09:56.560 --> 10:00.880 And in our case, it's going to be the gigabit one interface. 175 10:00.880 --> 10:03.800 The next thing we want to do is match the identity. 176 10:03.800 --> 10:06.240 So we'll say match identity. 177 10:06.240 --> 10:08.920 This is going to be for the remote address. 178 10:08.920 --> 10:11.640 Now this is where things get interesting. 179 10:11.640 --> 10:16.530 Since we're double nadding, this is actually going to be the private address of 180 10:16.530 --> 10:17.240 the other 181 10:17.240 --> 10:18.680 side. 182 10:18.680 --> 10:22.540 That's how the other side is going to identify itself to us to be able to match 183 10:22.540 --> 10:23.120 up to this 184 10:23.120 --> 10:24.680 profile. 185 10:24.680 --> 10:29.360 So since this is the on-prem router, this is going to be the address of the 186 10:29.360 --> 10:30.360 other side, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 186 10:29.360 --> 10:30.360 other side, 187 10:30.360 --> 10:34.360 which is the 10 dot 20 dot 1 dot 254. 188 10:34.360 --> 10:36.320 Now you can put a mask after this. 189 10:36.320 --> 10:41.490 If you want, it will default to a 32 bit mask, meaning the whole thing has to 190 10:41.490 --> 10:42.240 match. 191 10:42.240 --> 10:44.040 So we'll just go ahead and hit enter. 192 10:44.040 --> 10:46.240 The default will be fine. 193 10:46.240 --> 10:51.120 We also want to do an identity of a local address. 194 10:51.120 --> 10:54.160 This will be again our local interfaces address. 195 10:54.160 --> 10:59.040 So this in this case would be the 204 dot 186 dot 19 dot 10. 196 10:59.040 --> 11:02.160 Next we have to configure the authentication method. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 196 10:59.040 --> 11:02.160 Next we have to configure the authentication method. 197 11:02.160 --> 11:07.790 So we'll say authentication, remote, and we're of course going to be doing a 198 11:07.790 --> 11:08.680 pre-share 199 11:08.680 --> 11:09.840 key. 200 11:09.840 --> 11:11.960 So we just say pre-share. 201 11:11.960 --> 11:17.960 Now we mentioned when we created the key ring that the key ring was optional. 202 11:17.960 --> 11:24.730 If we wanted, we could put the key right here by putting the keyword key and 203 11:24.730 --> 11:25.720 simply pasting 204 11:25.720 --> 11:27.520 the key in. 205 11:27.520 --> 11:31.280 Or we can leave it off since we're using a key ring. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 205 11:27.520 --> 11:31.280 Or we can leave it off since we're using a key ring. 206 11:31.280 --> 11:33.800 In which case we'll just hit enter. 207 11:33.800 --> 11:37.400 We'll hit up, we'll change our remote to local. 208 11:37.400 --> 11:40.280 That way both methods are pre-share. 209 11:40.280 --> 11:43.840 Then of course, if we're going to use a key ring, we have to tell it that. 210 11:43.840 --> 11:45.920 So we say key ring. 211 11:45.920 --> 11:47.680 It's a local key ring. 212 11:47.680 --> 11:51.400 And we named it AWS underscore keys. 213 11:51.400 --> 11:56.070 It will of course use the identity information to know which key out of that 214 11:56.070 --> 11:58.280 key ring to use. 215 11:58.280 --> 12:03.810 It's also recommended to enable DPDs, which if we look at the help, these are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 215 11:58.280 --> 12:03.810 It's also recommended to enable DPDs, which if we look at the help, these are 216 12:03.810 --> 12:04.680 basically 217 12:04.680 --> 12:08.040 like live lists checks for the peers. 218 12:08.040 --> 12:10.000 It's basically a keep alive. 219 12:10.000 --> 12:12.400 So we'll turn on DPD. 220 12:12.400 --> 12:18.600 We'll set it for 10 and two and we'll do it as on demand. 221 12:18.600 --> 12:20.840 So once again, let's go ahead and exit. 222 12:20.840 --> 12:26.250 Let's look at our profile and we can see that everything we just configured is 223 12:26.250 --> 12:26.920 here. 224 12:26.920 --> 12:33.420 So we see things like the name, the local interface, the identities, both WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 224 12:26.920 --> 12:33.420 So we see things like the name, the local interface, the identities, both 225 12:33.420 --> 12:33.800 remote and 226 12:33.800 --> 12:39.000 local, as well as the authentication methods and the key ring. 227 12:39.000 --> 12:43.140 We also see here a little further down where DPD is now enabled with an 228 12:43.140 --> 12:44.400 interval of 10 229 12:44.400 --> 12:47.000 seconds and a retry of two. 230 12:47.000 --> 12:49.640 So this is looking pretty good. 231 12:49.640 --> 12:53.320 Once again, there'll be some minor changes for AWS R1. 232 12:53.320 --> 12:54.880 Let's take a look. 233 12:54.880 --> 12:59.000 So this is the proposed configuration for AWS R1. 234 12:59.000 --> 13:02.440 We can see here it's the same interface we're matching on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 234 12:59.000 --> 13:02.440 We can see here it's the same interface we're matching on. 235 13:02.440 --> 13:07.400 The remote address, of course, is going to be the on-prem routers address this 236 13:07.400 --> 13:08.000 time. 237 13:08.000 --> 13:12.630 The local address is, of course, this router's address and the rest of it is 238 13:12.630 --> 13:13.360 exactly the 239 13:13.360 --> 13:14.360 same. 240 13:14.360 --> 13:18.640 So let's go ahead and put this configuration on AWS R1. 241 13:18.640 --> 13:21.920 Again, we'll simply paste it in. 242 13:21.920 --> 13:24.040 We'll exit configuration. 243 13:24.040 --> 13:30.470 We've already verified on-prem router one, but let's verify here on AWS R1 as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 243 13:24.040 --> 13:30.470 We've already verified on-prem router one, but let's verify here on AWS R1 as 244 13:30.470 --> 13:30.840 well. 245 13:30.840 --> 13:33.720 So first we'll look at our proposal. 246 13:33.720 --> 13:36.000 Everything here looks correct. 247 13:36.000 --> 13:38.560 Next we'll look at our policy. 248 13:38.560 --> 13:40.720 Everything here looks correct as well. 249 13:40.720 --> 13:44.400 And finally, let's take a look at our profile. 250 13:44.400 --> 13:46.920 And this all looks correct also. 251 13:46.920 --> 13:53.120 So that takes care of the configuration of the three P's for iq version two. 252 13:53.120 --> 13:57.840 So now that we have all of the components configured for iq version two, we 253 13:57.840 --> 13:58.320 essentially 254 13:58.320 --> 14:02.280 need to do the same thing for ipsack. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 254 13:58.320 --> 14:02.280 need to do the same thing for ipsack. 255 14:02.280 --> 14:06.620 Those are quite easier to configure, but let's take a look at it in the next 256 14:06.620 --> 14:07.200 video.