WEBVTT

1
00:00.000 --> 00:08.320
So the next thing we want to do is configure the three Ps of Ike V2.

2
00:08.320 --> 00:12.760
That would be the proposal, the policy, and the profile.

3
00:12.760 --> 00:15.720
We're going to create those on both of our routers.

4
00:15.720 --> 00:19.840
So again, we're going to be on on-prem R1 as well as Azure R1.

5
00:19.840 --> 00:24.800
We'll get these three components configured and verified on both devices.

6
00:24.800 --> 00:26.640
So let's jump into the command line.

7
00:26.640 --> 00:28.560
We'll just start on Azure R1.

8
00:28.560 --> 00:35.960
So let's begin by looking at what's already configured on iOS XE.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:28.560 --> 00:35.960
So let's begin by looking at what's already configured on iOS XE.

9
00:35.960 --> 00:42.450
If we do a show crypto Ike V2 proposal, notice that there is a default proposal

10
00:42.450 --> 00:42.920
already

11
00:42.920 --> 00:45.040
on these devices.

12
00:45.040 --> 00:50.360
If we do policy, notice that there's a default policy as well.

13
00:50.360 --> 00:53.960
Profile, however, there's not a default.

14
00:53.960 --> 00:59.700
So let's begin here just by saying we could if we wanted to use these default

15
00:59.700 --> 01:00.840
policies.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:59.700 --> 01:00.840
policies.

16
01:00.840 --> 01:04.200
We are not going to, we're going to write our own policies.

17
01:04.200 --> 01:06.280
So then you're left with another choice.

18
01:06.280 --> 01:10.720
Do you keep the defaults or do you get rid of them?

19
01:10.720 --> 01:16.320
Although this is normally just personal preference, I have run versions of code

20
01:16.320 --> 01:16.760
that don't

21
01:16.760 --> 01:22.240
actually work very well if you leave these defaults here and don't use them.

22
01:22.240 --> 01:27.280
So mostly out of habit, I usually get rid of the defaults and make my own.

23
01:27.280 --> 01:30.280
But again, this version of code has no problem with it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
01:27.280 --> 01:30.280
But again, this version of code has no problem with it.

24
01:30.280 --> 01:33.360
So from that perspective, it really is up to you.

25
01:33.360 --> 01:36.920
But we're going to get rid of those defaults and create our own.

26
01:36.920 --> 01:40.980
So to get rid of them, we simply go into configuration mode and then we say no

27
01:40.980 --> 01:41.520
crypto

28
01:41.520 --> 01:46.960
Ike V2 policy default and no crypto Ike V2 proposal default.

29
01:46.960 --> 01:49.440
Again, there is no profile by default.

30
01:49.440 --> 01:51.840
So we don't have to worry about that one.

31
01:51.840 --> 01:56.280
We could verify this by doing the show crypto Ike V2 proposal again.

32
01:56.280 --> 01:59.800
We see here now that the default is disabled.

33
01:59.800 --> 02:04.280
And if we look again at policy, we see that the defaults disabled here as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:59.800 --> 02:04.280
And if we look again at policy, we see that the defaults disabled here as well.

34
02:04.280 --> 02:09.800
So now we can jump in and make our own components here on R1.

35
02:09.800 --> 02:13.680
So the first thing we want to do is create a proposal.

36
02:13.680 --> 02:17.680
So it's crypto Ike V2 proposal and then we give it a name.

37
02:17.680 --> 02:21.600
In this case, I'm just going to call it Ike V2 proposal Azure.

38
02:21.600 --> 02:26.480
So go ahead and hit enter and it tells us here that we have two choices on how

39
02:26.480 --> 02:27.000
to configure

40
02:27.000 --> 02:28.560
this proposal.

41
02:28.560 --> 02:34.210
We have to either have a set of encryption algorithm other than a ESG CM, an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
02:28.560 --> 02:34.210
We have to either have a set of encryption algorithm other than a ESG CM, an

42
02:34.210 --> 02:35.640
integrity algorithm

43
02:35.640 --> 02:43.740
and a Diffie Helming Group or we can use a ESG CM and use a PRF algorithm and a

44
02:43.740 --> 02:44.560
Diffie

45
02:44.560 --> 02:45.880
Helming Group.

46
02:45.880 --> 02:49.480
Well, we're going to go with that second option.

47
02:49.480 --> 02:54.600
So we're just going to set our encryption to be a ESG CM 256.

48
02:54.600 --> 02:56.800
We'll go ahead and hit enter.

49
02:56.800 --> 03:00.160
Then we'll set PRF to shop 512.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:56.800 --> 03:00.160
Then we'll set PRF to shop 512.

50
03:00.160 --> 03:02.440
This is our pseudo random function.

51
03:02.440 --> 03:05.240
So we'll go ahead and hit enter on that one.

52
03:05.240 --> 03:10.160
And for the final component, we'll just use Diffie Helming Group 20.

53
03:10.160 --> 03:12.880
So go ahead and enter on that as well.

54
03:12.880 --> 03:17.540
One other setting that's commonly going to be set here is we'll set the crypto

55
03:17.540 --> 03:18.360
Ike V2

56
03:18.360 --> 03:21.440
fragmentation Mtu to be 1200.

57
03:21.440 --> 03:26.400
That way we don't have fragmentation happening on our Ike V2 communications.

58
03:26.400 --> 03:30.120
So we're going to want to do the same thing over on the other routers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
03:26.400 --> 03:30.120
So we're going to want to do the same thing over on the other routers.

59
03:30.120 --> 03:31.920
Let's hop over to on prem R1.

60
03:31.920 --> 03:35.440
We'll go into configuration mode.

61
03:35.440 --> 03:39.560
We'll start by getting rid of our default policy and proposal.

62
03:39.560 --> 03:42.640
And then we'll create our new proposal.

63
03:42.640 --> 03:46.560
So this is the same configuration that we just did on Azure R1.

64
03:46.560 --> 03:51.240
I just pasted the same thing in here on on prem R1.

65
03:51.240 --> 03:54.000
So let's go back over to Azure R1.

66
03:54.000 --> 03:57.280
The next thing we're going to want here is a policy.

67
03:57.280 --> 04:00.640
So this is going to be crypto Ike V2 policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:57.280 --> 04:00.640
So this is going to be crypto Ike V2 policy.

68
04:00.640 --> 04:05.200
And again, for the name, we're just going to call it Ike V2 policy Azure.

69
04:05.200 --> 04:06.760
So we'll hit enter.

70
04:06.760 --> 04:11.720
This tells us that we must have at least one complete proposal attached.

71
04:11.720 --> 04:14.040
Well, that would be the proposal we just created.

72
04:14.040 --> 04:16.120
So let's go ahead and attach that.

73
04:16.120 --> 04:19.520
And the other thing we need is a match statement.

74
04:19.520 --> 04:23.880
We need to put a match for what this policy will be applied to.

75
04:23.880 --> 04:30.640
Now, for this address, we're going to be using the private address of the local
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
04:23.880 --> 04:30.640
Now, for this address, we're going to be using the private address of the local

76
04:30.640 --> 04:31.680
device.

77
04:31.680 --> 04:38.010
So in this case, it's the 10.30.1.254, which remember is the address of the

78
04:38.010 --> 04:39.680
outside interface

79
04:39.680 --> 04:41.880
here on Azure R1.

80
04:41.880 --> 04:45.880
So that's what we're going to use here for the local address.

81
04:45.880 --> 04:49.520
Once again, we're going to need the same thing over on on prem R1.

82
04:49.520 --> 04:51.360
So let's go over there.

83
04:51.360 --> 04:56.580
Again, same configuration, except of course, the match address local is going

84
04:56.580 --> 04:58.120
to change here.

85
04:58.120 --> 05:02.120
This is the outside address of on prem R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
04:58.120 --> 05:02.120
This is the outside address of on prem R1.

86
05:02.120 --> 05:06.410
So again, difference here on the local address, but other than that, this is

87
05:06.410 --> 05:08.320
the same configuration.

88
05:08.320 --> 05:12.440
So since we're already here on on prem R1, let's just start our next component

89
05:12.440 --> 05:13.800
from here.

90
05:13.800 --> 05:16.920
This is of course going to be the profile.

91
05:16.920 --> 05:21.660
So once again, we start the creation by saying crypto like V2 profile and we

92
05:21.660 --> 05:22.440
give the profile

93
05:22.440 --> 05:23.440
a name.

94
05:23.440 --> 05:25.720
We'll stick with our same naming convention.

95
05:25.720 --> 05:29.040
Let's call it I'd V2 profile Azure.

96
05:29.040 --> 05:33.320
The first things you want to configure is what it has here on its list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
05:29.040 --> 05:33.320
The first things you want to configure is what it has here on its list.

97
05:33.320 --> 05:37.740
It's telling us right away that we have to have a local and a remote

98
05:37.740 --> 05:39.960
authentication method.

99
05:39.960 --> 05:44.280
We have to have a match statement such as an identity or certificate.

100
05:44.280 --> 05:46.840
So let's go ahead and put these in.

101
05:46.840 --> 05:51.880
First, let's match on our local interface, gigabit one.

102
05:51.880 --> 05:54.280
That's the outside interface.

103
05:54.280 --> 05:57.880
And let's also match on the remote identity here.

104
05:57.880 --> 06:01.810
So this is going to again be the private address, but this time it's the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
05:57.880 --> 06:01.810
So this is going to again be the private address, but this time it's the

105
06:01.810 --> 06:03.360
private address of

106
06:03.360 --> 06:05.440
Azure R1.

107
06:05.440 --> 06:08.840
So what we're actually doing is listing our counterpart.

108
06:08.840 --> 06:13.160
Then we're also going to match the identity of our local address.

109
06:13.160 --> 06:16.520
So we'll put in our local outside address.

110
06:16.520 --> 06:20.500
Then we remembered said that we have to list our local and our remote

111
06:20.500 --> 06:22.120
authentication method.

112
06:22.120 --> 06:25.960
The authentication method we're using is pre-shared key.

113
06:25.960 --> 06:28.440
That's why we made a key ring earlier.

114
06:28.440 --> 06:32.760
So the remote authentication is going to be pre-shared.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
06:28.440 --> 06:32.760
So the remote authentication is going to be pre-shared.

115
06:32.760 --> 06:34.880
So is the local.

116
06:34.880 --> 06:38.480
And then we're going to call to our key chain.

117
06:38.480 --> 06:42.560
And that's of course telling it the key chain to use for the pre-shared key

118
06:42.560 --> 06:43.920
authentication.

119
06:43.920 --> 06:49.110
Finally, and this is not strictly necessary, but we'll also configure dead peer

120
06:49.110 --> 06:49.840
detection

121
06:49.840 --> 06:54.640
and we'll set some fairly common timers here and run it on demand.

122
06:54.640 --> 06:58.880
So that takes care of our profile here on on-prem R1.

123
06:58.880 --> 07:02.080
Let's go put it on Azure R1 as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
06:58.880 --> 07:02.080
Let's go put it on Azure R1 as well.

124
07:02.080 --> 07:05.880
And note that we got timed out here on Azure R1.

125
07:05.880 --> 07:09.490
Azure does time us out of the console regardless of how we have our router

126
07:09.490 --> 07:11.040
actually configured.

127
07:11.040 --> 07:14.520
So we are going to have to reconnect here to R1.

128
07:14.520 --> 07:19.240
Go back into configuration mode and now we can paste in our profile.

129
07:19.240 --> 07:24.630
Again, this is going to be exactly the same as on-prem R1 except of course the

130
07:24.630 --> 07:25.560
match identity

131
07:25.560 --> 07:30.840
for the remote address and the identity for the local address are going to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
07:25.560 --> 07:30.840
for the remote address and the identity for the local address are going to be

132
07:30.840 --> 07:31.120
the other

133
07:31.120 --> 07:32.120
side now.

134
07:32.120 --> 07:33.560
They're going to be inverted.

135
07:33.560 --> 07:36.480
And that this should take care of our configuration.

136
07:36.480 --> 07:40.170
So let's just go ahead and verify that everything's in here the way we want it

137
07:40.170 --> 07:40.680
to be.

138
07:40.680 --> 07:44.520
We've seen these commands before so let's look at our proposal.

139
07:44.520 --> 07:49.320
Here we see that our proposal is set to use AESG CM256.

140
07:49.320 --> 07:54.960
PRF is set to shop 512 and we are set to use Diffie Helmand Group 20.

141
07:54.960 --> 07:57.160
So that is correct.

142
07:57.160 --> 08:03.520
If we look at our policy, we see that we have our policy like V2 policy Azure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
07:57.160 --> 08:03.520
If we look at our policy, we see that we have our policy like V2 policy Azure.

143
08:03.520 --> 08:07.120
We're set to use the forwarding VRF of the global table.

144
08:07.120 --> 08:09.560
We're not configuring VRFs right now.

145
08:09.560 --> 08:14.710
The match local address we see is set to its outside address and it is tied in

146
08:14.710 --> 08:15.400
to using

147
08:15.400 --> 08:17.480
our proposal.

148
08:17.480 --> 08:19.440
Finally the profile.

149
08:19.440 --> 08:22.530
Now this of course is going to show us a lot more information here, but the

150
08:22.530 --> 08:23.160
main things

151
08:23.160 --> 08:26.280
we're looking for are right up here near the top.

152
08:26.280 --> 08:31.960
We see once again our match criteria is set to the local interface gigabit 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
08:26.280 --> 08:31.960
We see once again our match criteria is set to the local interface gigabit 1.

153
08:31.960 --> 08:38.380
The remote identity of on-prem R1's private address, the local identity as its

154
08:38.380 --> 08:39.240
own private

155
08:39.240 --> 08:40.840
address.

156
08:40.840 --> 08:45.670
We see that both the local and the remote authentication are set to pre-shared

157
08:45.670 --> 08:46.200
key.

158
08:46.200 --> 08:50.600
We see the key ring is set to Azure keys and finally we see that we've

159
08:50.600 --> 08:52.720
configured DPD

160
08:52.720 --> 08:58.920
with an interval of 10, a retry interval of 2 and it's set to run on demand.

161
08:58.920 --> 09:03.000
So those are all the things we configured about this profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
08:58.920 --> 09:03.000
So those are all the things we configured about this profile.

162
09:03.000 --> 09:07.780
If we wanted we could verify all of this on on-prem R1 as well, but I don't

163
09:07.780 --> 09:08.440
really think

164
09:08.440 --> 09:13.680
we need to since we of course put the same configuration on both sides.

165
09:13.680 --> 09:18.480
If we went into a problem we'll troubleshoot that when it happens.

166
09:18.480 --> 09:24.610
So in this video we configured the three P's for Ike version 2, our proposal,

167
09:24.610 --> 09:25.920
our policy

168
09:25.920 --> 09:28.160
and our profile.

169
09:28.160 --> 09:32.630
Next up we're going to configure the components that we need for IP sec such as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
09:28.160 --> 09:32.630
Next up we're going to configure the components that we need for IP sec such as

170
09:32.630 --> 09:33.480
the transform

171
09:33.480 --> 09:34.480
set.

172
09:34.480 --> 09:39.080
However we're going to find out that those are actually far easier than what we

173
09:39.080 --> 09:39.240
had

174
09:39.240 --> 09:41.720
to do here for Ike version 2.

175
09:41.720 --> 09:44.000
But let's check that out in the next video.

176
09:44.000 --> 09:53.800
[BLANK_AUDIO]