WEBVTT

1
00:00.000 --> 00:05.000
So here we have ourselves a two part challenge.

2
00:05.000 --> 00:08.000
Let's begin with part one.

3
00:08.000 --> 00:11.000
Part one actually has two different steps

4
00:11.000 --> 00:13.000
we're supposed to configure.

5
00:13.000 --> 00:18.000
They want us to add some functionality to our VPN here on AWS

6
00:18.000 --> 00:19.000
R one.

7
00:19.000 --> 00:23.000
So the first thing we're supposed to do is we're supposed to configure

8
00:23.000 --> 00:27.000
Ike version two options to support some additional features.

9
00:27.000 --> 00:30.000
Well, in order to do this, of course, we're going to have to go into
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:30.000 --> 00:31.000
configuration mode.

11
00:31.000 --> 00:35.000
We're going to have to go into our Ike version two proposal.

12
00:35.000 --> 00:38.000
And then let's take a look at what they want us to change.

13
00:38.000 --> 00:41.000
They want us to add additional support.

14
00:41.000 --> 00:44.000
So we have to make sure we don't remove the old options,

15
00:44.000 --> 00:46.000
but they want us to add an encryption.

16
00:46.000 --> 00:48.000
So they want us to add.

17
00:48.000 --> 00:54.000
A. E. S. G. C. M. one 28.

18
00:54.000 --> 00:58.000
Now, here's the problem with this configuration.

19
00:58.000 --> 01:00.000
This is where we need to be very careful.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
01:00.000 --> 01:04.000
If we were to look at this proposal now, notice that the

21
01:04.000 --> 01:09.000
encryption has replaced what we had, not just add to it.

22
01:09.000 --> 01:14.000
When we're going to modify the encryption, we have to add both.

23
01:14.000 --> 01:17.000
So what we need to do is go back to our encryption line and then add

24
01:17.000 --> 01:21.000
the other one, the A. E. S. G. C. M. 256.

25
01:21.000 --> 01:24.000
This is the one we were already supporting.

26
01:24.000 --> 01:27.000
And again, we're just supposed to add this new functionality.

27
01:27.000 --> 01:31.000
So now when we hit enter and if we look at it again,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:27.000 --> 01:31.000
So now when we hit enter and if we look at it again,

28
01:31.000 --> 01:35.000
we see that now both encryptions are there.

29
01:35.000 --> 01:38.000
And that's how all of these settings work.

30
01:38.000 --> 01:42.000
So we need to be very careful as we're adding these new features.

31
01:42.000 --> 01:46.000
For example, for the PRF, we're still supposed to support our

32
01:46.000 --> 01:50.000
SHA-512, which is what we were already supporting, but now we're

33
01:50.000 --> 01:54.000
supposed to add support for SHA-384.

34
01:54.000 --> 01:57.000
So we would have to put both of them in like this.

35
01:57.000 --> 02:00.000
And the exact same thing with the group, we're supposed to add
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
02:00.000 --> 02:05.000
groups 19 and 21, where we already had 20.

37
02:05.000 --> 02:09.000
So we would say 19, 20, and 21.

38
02:09.000 --> 02:12.000
If we've done all of this correctly, we should look at our proposal

39
02:12.000 --> 02:18.000
again, and now we have this as it's supposed to be for our first step.

40
02:18.000 --> 02:23.000
We have both of our encryptions, we have both PRFs, and we have all

41
02:23.000 --> 02:27.000
three groups 19, 20, and 21.

42
02:27.000 --> 02:31.000
So now let's look at the second step for part one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
02:27.000 --> 02:31.000
So now let's look at the second step for part one.

43
02:31.000 --> 02:35.000
And it's saying that we're supposed to make a new transform set

44
02:35.000 --> 02:39.000
that isn't going to be used, but they have certain settings they

45
02:39.000 --> 02:40.000
want on it.

46
02:40.000 --> 02:46.000
So in order for this, what we have to do, we do crypto, IP sack,

47
02:46.000 --> 02:51.000
transform set, and of course, the next thing at once is a name,

48
02:51.000 --> 02:54.000
and they have given us the name to use.

49
02:54.000 --> 02:57.000
It's TS_AWS_2.

50
02:57.000 --> 03:01.000
Then we're supposed to specify encryptions, and they are giving
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:57.000 --> 03:01.000
Then we're supposed to specify encryptions, and they are giving

51
03:01.000 --> 03:04.000
us two encryptions that they want this to support.

52
03:04.000 --> 03:09.000
So we're supposed to do ESP AES, and then we have some choices as

53
03:09.000 --> 03:14.000
far as the length, we're supposed to choose 256.

54
03:14.000 --> 03:19.000
Then we can add the other one that's being requested, ESP,

55
03:19.000 --> 03:25.000
SHA512 HMAC, hit enter, and the last thing we're supposed to do

56
03:25.000 --> 03:27.000
is say mode tunnel.

57
03:27.000 --> 03:31.000
We'll exit configuration mode, and let's do a show,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
03:27.000 --> 03:31.000
We'll exit configuration mode, and let's do a show,

58
03:31.000 --> 03:36.000
crypto, IP sack, transform set.

59
03:36.000 --> 03:40.000
We can see here that we now have our transform set two,

60
03:40.000 --> 03:43.000
which is configured exactly as requested.

61
03:43.000 --> 03:50.000
It's doing ESP 256 AES, ESP SHA512 HMAC, and it's configured for

62
03:50.000 --> 03:51.000
tunnel mode.

63
03:51.000 --> 03:56.000
So that takes care of everything needed for part one.

64
03:56.000 --> 03:58.000
Part two is a little bit different.

65
03:58.000 --> 04:02.000
Part two, we have a coworker who has sent us a configuration,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:58.000 --> 04:02.000
Part two, we have a coworker who has sent us a configuration,

66
04:02.000 --> 04:06.000
which they say is not working properly, and we're supposed to

67
04:06.000 --> 04:09.000
look at it and see if we can figure out what's wrong.

68
04:09.000 --> 04:13.000
So let's switch over to notepad++ and take a look at the

69
04:13.000 --> 04:16.000
configuration that we've been sent.

70
04:16.000 --> 04:19.000
So here we have the configuration that's been sent,

71
04:19.000 --> 04:21.000
and let's just go down through it.

72
04:21.000 --> 04:25.000
First, let's look at our crypto proposal here.

73
04:25.000 --> 04:29.000
So this first section, we have a proposal.

74
04:29.000 --> 04:31.000
It has encryption set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
04:29.000 --> 04:31.000
It has encryption set.

75
04:31.000 --> 04:33.000
It's using GCM.

76
04:33.000 --> 04:37.000
It's got the PRF set, and it's got a Diffie-Hellman group.

77
04:37.000 --> 04:41.000
So at first glance, all of this seems to be okay.

78
04:41.000 --> 04:45.000
Next, we have our Ike version two policy.

79
04:45.000 --> 04:49.000
The policy is matching on a local address.

80
04:49.000 --> 04:53.000
Now, given that this is for my coworker, we could verify,

81
04:53.000 --> 04:56.000
but we will assume that the address is given are correct.

82
04:56.000 --> 04:59.000
We would really have no way of knowing if that's incorrect.

83
04:59.000 --> 05:04.000
So we're really trying to focus on the structure of the IPsec VPN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
04:59.000 --> 05:04.000
So we're really trying to focus on the structure of the IPsec VPN.

84
05:04.000 --> 05:08.000
So assuming that address is correct, it is calling to the correct

85
05:08.000 --> 05:09.000
proposal.

86
05:09.000 --> 05:11.000
So this section looks correct.

87
05:11.000 --> 05:14.000
Next, we have our keyring.

88
05:14.000 --> 05:17.000
So the keyring has a name Ike V2 keys.

89
05:17.000 --> 05:19.000
It's got a peer called peer one.

90
05:19.000 --> 05:24.000
Again, we will assume the address is correct, and it has pre-shared keys.

91
05:24.000 --> 05:28.000
Well, again, we don't know if these keys are what are intended to be used,

92
05:28.000 --> 05:32.000
but assuming that they're the same on both sides, that key looks acceptable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
05:28.000 --> 05:32.000
but assuming that they're the same on both sides, that key looks acceptable.

93
05:32.000 --> 05:36.000
So once again, our keyring looks like it's perfectly fine.

94
05:36.000 --> 05:40.000
Next, we'll move on to our Ike V2 profile.

95
05:40.000 --> 05:44.000
Once again, it has a name that looks okay.

96
05:44.000 --> 05:47.000
It's matching on a local interface.

97
05:47.000 --> 05:49.000
It's matching on a remote address.

98
05:49.000 --> 05:51.000
Again, we'll assume that's correct.

99
05:51.000 --> 05:56.000
The identity for the local address actually does match the local address above.

100
05:56.000 --> 05:58.000
So pretty good assumption.

101
05:58.000 --> 05:59.000
It's correct.

102
05:59.000 --> 06:03.000
It's configured to use both remote and local pre-shared keys,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
05:59.000 --> 06:03.000
It's configured to use both remote and local pre-shared keys,

103
06:03.000 --> 06:06.000
and it is calling to the correct key chain name.

104
06:06.000 --> 06:10.000
So again, the profile also looks correct.

105
06:10.000 --> 06:14.000
Next, we move into our IPsec pieces.

106
06:14.000 --> 06:18.000
So here we have the crypto IPsec transform set.

107
06:18.000 --> 06:21.000
It's called TS_1.

108
06:21.000 --> 06:26.000
It's configured with an encryption algorithm, ESPGCM256,

109
06:26.000 --> 06:28.000
and it's set to mode tunnel.

110
06:28.000 --> 06:30.000
This looks perfectly fine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
06:30.000 --> 06:33.000
That is a perfectly valid transform set.

112
06:33.000 --> 06:38.000
Next up is the IPsec profile.

113
06:38.000 --> 06:42.000
And if we take a look at the IPsec profile, we, of course, have our name.

114
06:42.000 --> 06:47.000
It is setting the PFS group, which is important since we're doing ESPG.

115
06:47.000 --> 06:50.000
It's set to Diffie-Hellman Group 20.

116
06:50.000 --> 06:52.000
That should be perfectly valid.

117
06:52.000 --> 06:56.000
It's also calling to our iCv2 profile.

118
06:56.000 --> 07:03.000
However, what it's not doing here is calling to our transform set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
06:56.000 --> 07:03.000
However, what it's not doing here is calling to our transform set.

119
07:03.000 --> 07:07.000
The profile is supposed to call to the transform set.

120
07:07.000 --> 07:10.000
And as we can see, it's not.

121
07:10.000 --> 07:14.000
So this would probably be our mistake.

122
07:14.000 --> 07:18.000
So the first thing we're going to do, let's clear off our notes here.

123
07:18.000 --> 07:26.000
And we should add a line here, set transform set, and it should be set to the

124
07:26.000 --> 07:32.000
TS_1, which is the transform set that we created above.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
07:26.000 --> 07:32.000
TS_1, which is the transform set that we created above.

125
07:32.000 --> 07:35.000
So now this looks correct.

126
07:35.000 --> 07:38.000
Now there is more configuration further down.

127
07:38.000 --> 07:41.000
We should never just assume that there's one problem.

128
07:41.000 --> 07:43.000
So let's scroll down.

129
07:43.000 --> 07:47.000
The only thing left here is the tunnel interface.

130
07:47.000 --> 07:52.200
So looking over the tunnel interface now, let's see if everything here looks

131
07:52.200 --> 07:53.000
correct.

132
07:53.000 --> 07:54.000
So of course we have our tunnel.

133
07:54.000 --> 07:56.000
It has a description.

134
07:56.000 --> 07:58.000
It has an IP address.

135
07:58.000 --> 08:02.000
The IP MTU and the TCP maximum segment size both look correct.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
07:58.000 --> 08:02.000
The IP MTU and the TCP maximum segment size both look correct.

136
08:02.000 --> 08:07.000
We again have to assume that it's using the source interface of gigabit 1.

137
08:07.000 --> 08:09.000
The tunnel mode is set correctly.

138
08:09.000 --> 08:13.510
The tunnel destination, once again, we sort of have to assume that's being

139
08:13.510 --> 08:18.690
configured properly, although we can see that it does match the peer address

140
08:18.690 --> 08:21.000
that was specified up here at the top.

141
08:21.000 --> 08:25.000
So there's probably a pretty good chance that that's correct.

142
08:25.000 --> 08:31.000
And it is calling correctly to the tunnel protection IPsec profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
08:25.000 --> 08:31.000
And it is calling correctly to the tunnel protection IPsec profile.

143
08:31.000 --> 08:33.000
So our names all look correct.

144
08:33.000 --> 08:37.000
So the tunnel interface looks correct as well.

145
08:37.000 --> 08:43.170
So if this were me, I would report back to my coworker that what was missing

146
08:43.170 --> 08:48.000
was setting the transform set right here in the IPsec profile.

147
08:48.000 --> 08:53.000
And that would take care of part two of this challenge.

148
08:53.000 --> 08:58.000
So that concludes everything that we need to discuss in this skill.

149
08:58.000 --> 09:05.000
Congratulations on completing Configure iOS XE site to site VPN in AWS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
08:58.000 --> 09:05.000
Congratulations on completing Configure iOS XE site to site VPN in AWS.

150
09:05.000 --> 09:08.000
I hope this has been informative for you.

151
09:08.000 --> 09:10.000
And I'd like to thank you for viewing.

152
09:10.000 --> 09:11.200
Reviewing.