WEBVTT

1
00:00.000 --> 00:08.440
So our next step here is going to be to start making the components for IPsec.

2
00:08.440 --> 00:12.560
This is actually far easier than the components for IKV2.

3
00:12.560 --> 00:15.180
You'll see there's only two things we have to create here.

4
00:15.180 --> 00:19.520
We have the transform set and the IPsec profile.

5
00:19.520 --> 00:22.000
And these are actually relatively simple.

6
00:22.000 --> 00:25.900
Let's jump in and take a look, but you'll see that there's a lot less to these

7
00:25.900 --> 00:26.240
than

8
00:26.240 --> 00:28.560
there is to the IKV2 components.

9
00:29.560 --> 00:35.760
So the first thing we want to configure is the IPsec transform set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.560 --> 00:35.760
So the first thing we want to configure is the IPsec transform set.

10
00:35.760 --> 00:39.760
So for this we put in crypto IPsec transform set.

11
00:39.760 --> 00:43.840
We give it a name, so I'll just call it TS_Ager.

12
00:43.840 --> 00:47.200
And then you tell it how to actually encrypt the data.

13
00:47.200 --> 00:51.350
That's the whole purpose of the transform set is to tell the device what to do

14
00:51.350 --> 00:51.880
with the

15
00:51.880 --> 00:53.120
data.

16
00:53.120 --> 00:58.720
So we're going to use ESP GCM and then you tell it how many bits.

17
00:58.720 --> 01:02.440
So we'll use 256 bits for the keys.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:58.720 --> 01:02.440
So we'll use 256 bits for the keys.

18
01:02.440 --> 01:08.120
The next thing we want to do is set the mode to tunnel for the transform set.

19
01:08.120 --> 01:11.920
And that's actually all we need to configure as far as the transform set.

20
01:11.920 --> 01:15.760
The other thing we need is an IPsec profile.

21
01:15.760 --> 01:20.800
The command for that is crypto IPsec profile and then a profile name.

22
01:20.800 --> 01:25.160
So again we'll just call this IPsec profile Azure.

23
01:25.160 --> 01:28.720
So there's three major components that we need in the profile.

24
01:28.720 --> 01:34.720
The first is to set the transform set to the transform set we just created.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:28.720 --> 01:34.720
The first is to set the transform set to the transform set we just created.

25
01:34.720 --> 01:39.400
Now keep in mind as we're going through this, this is a modular structure.

26
01:39.400 --> 01:42.400
So we can have multiple transform sets.

27
01:42.400 --> 01:47.630
We can actually have multiple profiles and we can use these multiple profiles

28
01:47.630 --> 01:47.920
to tie

29
01:47.920 --> 01:53.060
different transform sets to different Ike V2 profiles because that's the next

30
01:53.060 --> 01:53.120
thing

31
01:53.120 --> 01:55.000
we need to set here.

32
01:55.000 --> 02:00.600
We call it to the Ike V2 profile that we created in the previous video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:55.000 --> 02:00.600
We call it to the Ike V2 profile that we created in the previous video.

33
02:00.600 --> 02:04.400
So the IPsec profile is what's tying these two pieces together.

34
02:04.400 --> 02:09.080
And again you can have multiple combinations here of different profiles tying

35
02:09.080 --> 02:09.360
different

36
02:09.360 --> 02:13.160
transform sets to different Ike V2 profiles.

37
02:13.160 --> 02:17.520
That's the cool thing about all of this being modular components.

38
02:17.520 --> 02:21.160
The other thing we need to do is set the Diffie Hulman group for our perfect

39
02:21.160 --> 02:22.800
forward secrecy.

40
02:22.800 --> 02:26.840
So we'll just set this to Diffie Hulman group 20.

41
02:26.840 --> 02:29.400
That's all we need to configure for IPsec.

42
02:29.400 --> 02:33.880
So let's go put the same configuration on Azure R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
02:29.400 --> 02:33.880
So let's go put the same configuration on Azure R1.

43
02:33.880 --> 02:37.870
So since we've already looked over it and it's exactly the same, we'll just

44
02:37.870 --> 02:38.160
paste the

45
02:38.160 --> 02:41.280
configuration here on Azure R1.

46
02:41.280 --> 02:45.440
And let's also do our verification from here as well.

47
02:45.440 --> 02:49.120
So we'll do a show crypto IPsec transform set.

48
02:49.120 --> 02:54.640
We see here that there is a default transform set which we could of course use.

49
02:54.640 --> 02:56.360
We chose not to.

50
02:56.360 --> 03:01.410
I've never actually run into a reason to get rid of the default transform set
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:56.360 --> 03:01.410
I've never actually run into a reason to get rid of the default transform set

51
03:01.410 --> 03:01.680
like we

52
03:01.680 --> 03:04.000
did with Ike V2.

53
03:04.000 --> 03:07.760
But the important thing is we see that the transform set that we just created

54
03:07.760 --> 03:10.720
using ESP GCM 256

55
03:10.720 --> 03:15.600
tunnel mode is actually here and configured as we wanted.

56
03:15.600 --> 03:18.680
We can verify the profile as well.

57
03:18.680 --> 03:22.720
And of course what we're seeing is we have our Ike V2 profile.

58
03:22.720 --> 03:27.520
We see our perfect forward secrecy is enabled using Diffie Hulman group 20 and

59
03:27.520 --> 03:28.040
it's calling

60
03:28.040 --> 03:30.680
to the proper transform set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
03:28.040 --> 03:30.680
to the proper transform set.

61
03:30.680 --> 03:34.520
Once again, there's also a default IPsec profile.

62
03:34.520 --> 03:36.560
But again, we're not going to be using that.

63
03:36.560 --> 03:41.690
So the two things that we need to use or want to use are here created and

64
03:41.690 --> 03:42.640
correct.

65
03:42.640 --> 03:48.160
So that should take care of the components we need for implementing IPsec.

66
03:48.160 --> 03:53.860
So in this video, we created our transform set and our IPsec profile which are

67
03:53.860 --> 03:54.380
the two

68
03:54.380 --> 03:59.080
components we need for the IPsec piece of this puzzle.

69
03:59.080 --> 04:04.360
Now that we have all of our components created for Ike version 2 and IPsec, it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:59.080 --> 04:04.360
Now that we have all of our components created for Ike version 2 and IPsec, it

70
04:04.360 --> 04:04.880
's finally

71
04:04.880 --> 04:08.480
time to actually build our tunnel interfaces.

72
04:08.480 --> 04:11.320
Now that's exactly what we're going to do in the next video.

73
04:11.320 --> 04:21.320
[BLANK_AUDIO]