WEBVTT

1
00:00.000 --> 00:08.150
So now that we have created all of the components needed for iKV2 and we've

2
00:08.150 --> 00:09.320
configured the components

3
00:09.320 --> 00:16.320
for IPsec, it is finally time to actually build the tunnel that is the IPsec

4
00:16.320 --> 00:17.200
VPN between

5
00:17.200 --> 00:20.640
on-prem R1 and Azure R1.

6
00:20.640 --> 00:24.970
So let's jump in using the components that we've already built and configure

7
00:24.970 --> 00:25.720
our tunnel

8
00:25.720 --> 00:29.760
between those two devices.

9
00:29.760 --> 00:35.220
It will begin here with on-prem R1, of course we go into configuration mode and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.760 --> 00:35.220
It will begin here with on-prem R1, of course we go into configuration mode and

10
00:35.220 --> 00:35.320
we're

11
00:35.320 --> 00:37.360
going to have to create a tunnel.

12
00:37.360 --> 00:40.320
So we'll go into interface, tunnel 1.

13
00:40.320 --> 00:43.660
Now it's completely optional of course, but you can set a description so we

14
00:43.660 --> 00:44.160
could say

15
00:44.160 --> 00:48.920
something like 2, Azure R1.

16
00:48.920 --> 00:51.000
It's of course going into an IP address.

17
00:51.000 --> 00:55.850
We're just going to use the 169.254 subnet and then we're going to say .31

18
00:55.850 --> 00:56.600
because it's

19
00:56.600 --> 01:00.910
acting as site 3 and this is tunnel 1 and then the two devices are going to be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:56.600 --> 01:00.910
acting as site 3 and this is tunnel 1 and then the two devices are going to be

20
01:00.910 --> 01:01.360
either

21
01:01.360 --> 01:04.600
.1 or .2 on this subnet.

22
01:04.600 --> 01:07.600
So we'll just make this one .2, the other side will be .1.

23
01:07.600 --> 01:10.920
It's also not a bad idea to set the M2U.

24
01:10.920 --> 01:15.160
We'll just set it to 1400 just so we don't get fragmentation.

25
01:15.160 --> 01:17.240
That's usually a pretty safe number.

26
01:17.240 --> 01:22.280
You could of course always actually test the M2U on the tunnel once it's up and

27
01:22.280 --> 01:22.720
then adjust

28
01:22.720 --> 01:25.000
the M2U accordingly.

29
01:25.000 --> 01:30.160
When we set the M2U, we should usually set the TCP maximum segment size and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:25.000 --> 01:30.160
When we set the M2U, we should usually set the TCP maximum segment size and

30
01:30.160 --> 01:30.800
this should

31
01:30.800 --> 01:34.680
be set to 40 bytes smaller than the M2U.

32
01:34.680 --> 01:37.520
So we'll set this to 1360.

33
01:37.520 --> 01:39.360
We need to set the tunnel source.

34
01:39.360 --> 01:44.000
That's going to be our outside interface or gigabit 1 in this case.

35
01:44.000 --> 01:46.640
We also need to set the tunnel destination.

36
01:46.640 --> 01:52.590
Now the tunnels are of course going to be using the outside public address for

37
01:52.590 --> 01:52.960
the

38
01:52.960 --> 01:53.960
peer.

39
01:53.960 --> 02:00.640
So in this case, this is the public IP address that Azure gave to Azure R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:53.960 --> 02:00.640
So in this case, this is the public IP address that Azure gave to Azure R1.

40
02:00.640 --> 02:06.520
We need to set the tunnel mode, telling it to use IPsec over IPv4.

41
02:06.520 --> 02:11.520
And then finally, we're going to tell it which IPsec profile to use.

42
02:11.520 --> 02:15.480
We do this with the tunnel protection IPsec command.

43
02:15.480 --> 02:17.320
And then we call it the profile.

44
02:17.320 --> 02:21.800
This of course is the profile that we created in the previous video.

45
02:21.800 --> 02:22.960
That's all of that's done.

46
02:22.960 --> 02:29.100
We can exit out of configuration and we can go do the same configuration on

47
02:29.100 --> 02:30.440
Azure R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.100 --> 02:30.440
Azure R1.

48
02:30.440 --> 02:31.800
Now there will be a few changes.

49
02:31.800 --> 02:34.320
Of course, the description is going to change.

50
02:34.320 --> 02:39.080
The IP address is going to end in dot 1 instead of dot 2.

51
02:39.080 --> 02:43.080
And of course, the tunnel destination will be the public address of the

52
02:43.080 --> 02:47.220
headquarters site.

53
02:47.220 --> 02:51.760
So once this configuration is in place, let's go back over to router 1 to do

54
02:51.760 --> 02:51.760
that.

55
02:51.760 --> 02:53.880
We can do some verification.

56
02:53.880 --> 02:57.120
Now this tunnel may take a few moments to come online.

57
02:57.120 --> 03:02.110
If we do a show IP interface brief, what we see is currently we have our tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:57.120 --> 03:02.110
If we do a show IP interface brief, what we see is currently we have our tunnel

58
03:02.110 --> 03:02.400
one.

59
03:02.400 --> 03:07.290
The status is up, but the protocol is still down because IPsec is not quite

60
03:07.290 --> 03:08.000
done with

61
03:08.000 --> 03:09.800
this negotiation yet.

62
03:09.800 --> 03:13.790
We'll give this just a few seconds, usually under a minute and our tunnel

63
03:13.790 --> 03:14.640
protocol should

64
03:14.640 --> 03:16.320
show up.

65
03:16.320 --> 03:17.720
So it's been just a few seconds.

66
03:17.720 --> 03:19.760
Let's go ahead and repeat that command.

67
03:19.760 --> 03:22.480
And we see now that tunnel one is up.

68
03:22.480 --> 03:26.960
Now of course, one very easy way to verify that is to try to ping the far end

69
03:26.960 --> 03:27.880
of the tunnel.

70
03:27.880 --> 03:34.720
So we'll say to ping 169.254.31.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:27.880 --> 03:34.720
So we'll say to ping 169.254.31.1.

71
03:34.720 --> 03:36.720
We can see here this is successful.

72
03:36.720 --> 03:39.680
So this means that our tunnel is operational.

73
03:39.680 --> 03:45.890
Another good command we can use to verify this is the show crypto IPsec SA

74
03:45.890 --> 03:47.240
where SA is security

75
03:47.240 --> 03:48.680
association.

76
03:48.680 --> 03:53.850
But if we hit enter on this, we can see quite a few things about our tunnel

77
03:53.850 --> 03:54.720
here, but probably

78
03:54.720 --> 03:59.420
the most important thing to look at is the number of packets that have been

79
03:59.420 --> 04:00.440
encapsulated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.420 --> 04:00.440
encapsulated

80
04:00.440 --> 04:02.480
and de-capsulated.

81
04:02.480 --> 04:05.680
We can see right here that number of packets is 5.

82
04:05.680 --> 04:09.360
That would be the 5 pings that we just sent through the tunnel.

83
04:09.360 --> 04:13.760
If we quit out of this and we ping again, let it do all 5.

84
04:13.760 --> 04:17.960
Look at our SA again, we see that now it's 10 packets.

85
04:17.960 --> 04:21.800
So this is clearly encrypting and decrypting traffic.

86
04:21.800 --> 04:27.360
Something else to note is that it's actually going over port 4500.

87
04:27.360 --> 04:31.500
This is important because this indicates that it's doing that traversal, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:27.360 --> 04:31.500
This is important because this indicates that it's doing that traversal, which

88
04:31.500 --> 04:32.160
we know it's

89
04:32.160 --> 04:36.920
going to because we have NAT on both ends of our tunnel here.

90
04:36.920 --> 04:40.620
So these are some good methods to ensure that the tunnel is up and that it is

91
04:40.620 --> 04:41.080
in fact

92
04:41.080 --> 04:44.320
encrypting and decrypting packets.

93
04:44.320 --> 04:51.520
So in this video, we actually built the IPsec tunnel between on-prem R1 and

94
04:51.520 --> 04:52.640
Azure R1.

95
04:52.640 --> 04:56.880
And as we see, it took a few seconds, but it came online.

96
04:56.880 --> 05:00.110
We see that it's actually encrypting and decrypting packets that are going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:56.880 --> 05:00.110
We see that it's actually encrypting and decrypting packets that are going

97
05:00.110 --> 05:01.840
through the tunnel.

98
05:01.840 --> 05:06.880
Now the next piece to this is going to be to learn what networks are available

99
05:06.880 --> 05:07.120
on the

100
05:07.120 --> 05:08.920
other side of the tunnel.

101
05:08.920 --> 05:11.480
Now of course, we could use any form of routing for this.

102
05:11.480 --> 05:15.640
We could use static routing or dynamic routing, really using almost any

103
05:15.640 --> 05:17.400
protocol we want.

104
05:17.400 --> 05:21.680
We're going to jump in and configure OSPF on this connection in the next video.

105
05:21.680 --> 05:31.680
[BLANK_AUDIO]