WEBVTT

1
00:00.000 --> 00:07.000
So next up, we're going to configure the components for IPsec.

2
00:07.000 --> 00:09.000
Now, there's only two of these.

3
00:09.000 --> 00:13.000
We have to configure our transform set, which actually, of course,

4
00:13.000 --> 00:17.000
controls how the traffic is being encrypted across the tunnel.

5
00:17.000 --> 00:22.000
And we, of course, have to configure the profile, which is pretty much how we

6
00:22.000 --> 00:26.000
tie the transform set on to our interface when we configure our tunnel.

7
00:26.000 --> 00:30.000
So this is a fairly simple process. This won't take very long.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:30.000 --> 00:33.000
Let's just hop in and get started. We'll do the same thing we've been doing.

9
00:33.000 --> 00:37.000
We'll start on the on-prem router one, and then the applicable parts.

10
00:37.000 --> 00:45.000
We'll just paste on to AWS router one. So let's go ahead and jump in.

11
00:45.000 --> 00:48.000
So let's start with creating our transform set.

12
00:48.000 --> 00:54.000
So we'll simply say crypto, IPsec, transform set.

13
00:54.000 --> 00:59.000
This, of course, wants a name. We'll just call it TS underscore AWS.

14
00:59.000 --> 01:05.000
Then we specify the type of encryption that we want to use for our traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:59.000 --> 01:05.000
Then we specify the type of encryption that we want to use for our traffic.

15
01:05.000 --> 01:11.000
Now, once again, ESP dash GCM is generally considered one of our preferred

16
01:11.000 --> 01:12.000
methods.

17
01:12.000 --> 01:15.000
So let's do that ESP GCM.

18
01:15.000 --> 01:19.000
Then we choose how many bits for the key.

19
01:19.000 --> 01:24.990
Let's just go with the maximum of 256. And the other thing we want to configure

20
01:24.990 --> 01:26.000
here is the mode.

21
01:26.000 --> 01:31.000
So if we say mode, you notice that there's two choices, transport and tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
01:26.000 --> 01:31.000
So if we say mode, you notice that there's two choices, transport and tunnel.

22
01:31.000 --> 01:35.000
We're going to configure this for tunnel mode.

23
01:35.000 --> 01:40.490
The next piece we're going to need is the IPsec profile, which sort of ties all

24
01:40.490 --> 01:46.500
of these pieces together and gives us a way to apply all of it to our interface

25
01:46.500 --> 01:47.000
.

26
01:47.000 --> 01:53.480
So this is going to be crypto, IPsec profile. Again, it's going to want to name

27
01:53.480 --> 01:57.000
what was called an IPsec profile AWS.

28
01:57.000 --> 02:00.000
And this is where we start tying the pieces together.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
02:00.000 --> 02:05.070
First, we're going to set the transform set to the transform set we just

30
02:05.070 --> 02:06.000
created.

31
02:06.000 --> 02:09.000
So that's TS underscore AWS.

32
02:09.000 --> 02:14.000
Next, since we're using GCM, we also need to set the PFS here.

33
02:14.000 --> 02:18.000
And once again, we'll just set this to Diffie, Hellman group 20.

34
02:18.000 --> 02:22.000
You can, of course, use one of these other options if you want.

35
02:22.000 --> 02:28.000
And finally, we have to set the Ike version to profile to be our profile.

36
02:28.000 --> 02:33.700
So we simply put in the Ike version to profile AWS that we completed in our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
02:28.000 --> 02:33.700
So we simply put in the Ike version to profile AWS that we completed in our

37
02:33.700 --> 02:35.000
previous step.

38
02:35.000 --> 02:38.000
We'll go ahead and exit configuration.

39
02:38.000 --> 02:44.010
And notice once again, there was nothing we put in here that device specific

40
02:44.010 --> 02:46.000
for one router versus the other.

41
02:46.000 --> 02:51.780
So we can literally take this exact same configuration and put it in on AWS

42
02:51.780 --> 02:53.000
router one.

43
02:53.000 --> 02:56.000
So once again, we'll just paste this in.

44
02:56.000 --> 02:59.000
And then we'll just verify both devices.

45
02:59.000 --> 03:01.000
So we'll show our transform set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:59.000 --> 03:01.000
So we'll show our transform set.

46
03:01.000 --> 03:08.000
We see that it is using ESP GCM 256 and it's operating in tunnel mode.

47
03:08.000 --> 03:10.000
We'll look at our profile.

48
03:10.000 --> 03:15.040
What we see under our profile is that it's calling to the Ike version to

49
03:15.040 --> 03:16.000
profile.

50
03:16.000 --> 03:18.000
It is using PFS.

51
03:18.000 --> 03:20.000
It's using Diffie, Hellman group 20.

52
03:20.000 --> 03:26.000
And it is properly calling to our transform set TS underscore AWS,

53
03:26.000 --> 03:32.000
which it conveniently tells us here is using ESP GCM 256.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
03:26.000 --> 03:32.000
which it conveniently tells us here is using ESP GCM 256.

54
03:32.000 --> 03:34.000
So all of this looks correct.

55
03:34.000 --> 03:38.480
Let's go ahead and verify on-prem router one just to make sure it's correct as

56
03:38.480 --> 03:39.000
well.

57
03:39.000 --> 03:42.000
So we'll do our show crypto IPsec transform set.

58
03:42.000 --> 03:45.000
Once again, this looks correct.

59
03:45.000 --> 03:50.000
And we see that our profile here is configured correctly as well.

60
03:50.000 --> 03:56.000
So now that all of the components are in place for our IPsec VPN tunnel.

61
03:56.000 --> 03:59.000
Well, it's finally time to configure the tunnels.

62
03:59.000 --> 04:01.000
And that's exactly what we're going to do next.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
03:59.000 --> 04:01.000
And that's exactly what we're going to do next.

63
04:01.000 --> 04:10.720
[BLANK_AUDIO]