WEBVTT

1
00:00.000 --> 00:07.720
So for this challenge, we're tasked with deploying a redundant or a second

2
00:07.720 --> 00:09.720
tunnel between

3
00:09.720 --> 00:14.080
on-prem R2 and Azure R2.

4
00:14.080 --> 00:17.420
Now since we've already been through configuring a tunnel, this is going to be

5
00:17.420 --> 00:19.400
fairly straightforward.

6
00:19.400 --> 00:22.960
And as such, I'm only going to be showing us one side.

7
00:22.960 --> 00:26.360
I'm going to show us the on-prem R2 side here.

8
00:26.360 --> 00:31.520
Just remember that Azure R2 is going to be configured almost identical.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:26.360 --> 00:31.520
Just remember that Azure R2 is going to be configured almost identical.

9
00:31.520 --> 00:35.640
Of course, things like IP addresses and descriptions and such will be a little

10
00:35.640 --> 00:36.560
bit different.

11
00:36.560 --> 00:43.000
But that said, let's jump in here and begin our configuration on on-prem R2.

12
00:43.000 --> 00:46.080
So our first step is going to be to configure the key ring.

13
00:46.080 --> 00:52.480
So let's go ahead and put that in, including our address for the Azure router.

14
00:52.480 --> 00:57.000
And the two keys we're going to be using for our local and remote pre-shared

15
00:57.000 --> 00:58.560
key authentication.

16
00:58.560 --> 01:03.730
The next thing we're going to want to do is delete the default Ike V2 policy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:58.560 --> 01:03.730
The next thing we're going to want to do is delete the default Ike V2 policy

17
01:03.730 --> 01:04.400
and the

18
01:04.400 --> 01:07.440
default Ike V2 proposal.

19
01:07.440 --> 01:09.000
So we'll go ahead and get rid of those.

20
01:09.000 --> 01:14.300
And then of course, we'll put in the proposal, the policy, and the profile that

21
01:14.300 --> 01:14.880
we actually

22
01:14.880 --> 01:16.640
want to use.

23
01:16.640 --> 01:18.600
So first we'll put in our proposal.

24
01:18.600 --> 01:23.470
Again, we're going to use the same encryption, PRF and Diffie Helmand Group as

25
01:23.470 --> 01:25.800
we did previously.

26
01:25.800 --> 01:29.640
We'll set our fragmentation the same as we did before.

27
01:29.640 --> 01:34.680
Next we'll put in our policy, which again is going to match on the local
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:29.640 --> 01:34.680
Next we'll put in our policy, which again is going to match on the local

28
01:34.680 --> 01:35.680
address and match

29
01:35.680 --> 01:39.520
on the proposal that we created earlier.

30
01:39.520 --> 01:43.930
And finally, we'll put in our profile, tying all of this together, setting up

31
01:43.930 --> 01:44.640
our local

32
01:44.640 --> 01:50.560
and remote authentication and setting up dead peer detection.

33
01:50.560 --> 01:54.920
Next, we'll put in our two components for IPsec.

34
01:54.920 --> 02:00.050
So we'll start with our IPsec transform set and then we create our IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:54.920 --> 02:00.050
So we'll start with our IPsec transform set and then we create our IPsec

35
02:00.050 --> 02:01.000
profile, which

36
02:01.000 --> 02:07.210
ties the transform set together with the Ike V2 profile and ties in the perfect

37
02:07.210 --> 02:07.920
forward

38
02:07.920 --> 02:09.960
secrecy Diffie Helmand Group.

39
02:09.960 --> 02:16.120
So this takes care of all of the components for Ike V2 and IPsec.

40
02:16.120 --> 02:20.840
With all of that in place, of course, we can now configure our tunnel.

41
02:20.840 --> 02:24.400
Even though this is the first tunnel on this device, we'll go ahead and make

42
02:24.400 --> 02:25.240
this interface

43
02:25.240 --> 02:30.750
tunnel to just because it is the second tunnel between on-prem and the Azure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:25.240 --> 02:30.750
tunnel to just because it is the second tunnel between on-prem and the Azure

44
02:30.750 --> 02:32.120
environment.

45
02:32.120 --> 02:33.960
Again, this could be tunnel one.

46
02:33.960 --> 02:35.800
It doesn't really matter.

47
02:35.800 --> 02:40.920
We'll assign an IP address to it. Here we're going to use 32 in the third octet

48
02:40.920 --> 02:41.600
just because

49
02:41.600 --> 02:46.320
it's acting as site three and this is tunnel two.

50
02:46.320 --> 02:50.920
Then of course, we have dot two on one side and dot one on the other.

51
02:50.920 --> 02:53.400
This side is going to be dot two.

52
02:53.400 --> 02:57.960
Of course, we adjust our Mtu and our TCP maximum segment size.

53
02:57.960 --> 03:04.500
We set up our source and destination, set the mode and then configure the IPsec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:57.960 --> 03:04.500
We set up our source and destination, set the mode and then configure the IPsec

54
03:04.500 --> 03:04.680
profile.

55
03:04.680 --> 03:10.070
Once all of this is done, if we exit out here and we do a show IP interface

56
03:10.070 --> 03:11.000
brief, we see

57
03:11.000 --> 03:14.160
that our tunnel is now up.

58
03:14.160 --> 03:18.490
Since our tunnel is now up, we should be able to configure our dynamic routing

59
03:18.490 --> 03:19.240
protocol.

60
03:19.240 --> 03:22.760
So let's put in our configuration for OSPF.

61
03:22.760 --> 03:26.090
Remember, we're going to want this configured on the loopback interface, which

62
03:26.090 --> 03:26.720
we're also

63
03:26.720 --> 03:32.480
creating here and on gigabit two and interface tunnel two.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
03:26.720 --> 03:32.480
creating here and on gigabit two and interface tunnel two.

64
03:32.480 --> 03:34.480
So some ways we can verify this.

65
03:34.480 --> 03:38.800
Of course, show IP OSPF interface brief.

66
03:38.800 --> 03:43.680
We see OSPF is enabled on all the necessary interfaces.

67
03:43.680 --> 03:45.920
Show IP OSPF neighbor.

68
03:45.920 --> 03:48.320
We see two neighbors here actually.

69
03:48.320 --> 03:53.490
Since we didn't do passive interface on our gigabit two interfaces, what we see

70
03:53.490 --> 03:53.800
is we

71
03:53.800 --> 04:00.240
actually have a neighbor ship with on prem R1 over the ethernet or the client
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:53.800 --> 04:00.240
actually have a neighbor ship with on prem R1 over the ethernet or the client

72
04:00.240 --> 04:00.520
side.

73
04:00.520 --> 04:06.360
And we have our neighbor ship with Azure R2 over the tunnel two interface.

74
04:06.360 --> 04:11.310
Finally, we can do a show IP route OSPF and we see that we are, in fact,

75
04:11.310 --> 04:12.240
learning all

76
04:12.240 --> 04:17.800
of the routes to the remote location across the tunnel to interface.

77
04:17.800 --> 04:21.640
So the 10.30.10.0/24.

78
04:21.640 --> 04:30.440
In addition to Azure R2's loopback interface, the 10.20.30.2/32, both of these,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
04:21.640 --> 04:30.440
In addition to Azure R2's loopback interface, the 10.20.30.2/32, both of these,

79
04:30.440 --> 04:30.480
again,

80
04:30.480 --> 04:33.280
being learned across the tunnel.

81
04:33.280 --> 04:35.480
So we know this is functional.

82
04:35.480 --> 04:39.970
So with tunnel two up and operational and our dynamic routing protocol working

83
04:39.970 --> 04:40.680
correctly

84
04:40.680 --> 04:44.680
across that tunnel, that concludes this challenge.

85
04:44.680 --> 04:48.640
If you find you were missing any of the information needed for this challenge,

86
04:48.640 --> 04:49.360
I would encourage

87
04:49.360 --> 04:55.320
you to go back and review any necessary steps in the skill above.

88
04:55.320 --> 05:01.710
Otherwise, congratulations on completing Configure iOS XE Site to Site VPN in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:55.320 --> 05:01.710
Otherwise, congratulations on completing Configure iOS XE Site to Site VPN in

89
05:01.710 --> 05:02.560
Azure.

90
05:02.560 --> 05:06.800
I hope this has been informative for you and I'd like to thank you for viewing.

91
05:06.800 --> 05:16.800
[BLANK_AUDIO]