WEBVTT

1
00:00.000 --> 00:08.120
In this demonstration, for our ike version 2 authentication, we're going to be

2
00:08.120 --> 00:08.560
using

3
00:08.560 --> 00:10.400
pre-shared key.

4
00:10.400 --> 00:13.990
Now in order to use pre-shared key, of course, we're going to have to actually

5
00:13.990 --> 00:14.680
create those

6
00:14.680 --> 00:19.800
keys and they're created in an ike V2 key ring.

7
00:19.800 --> 00:25.680
Now general best practices would be to have these keys be rather long, randomly

8
00:25.680 --> 00:26.600
generated

9
00:26.600 --> 00:27.600
characters.

10
00:27.600 --> 00:32.650
However, this being a lab environment, if you want to use something as simple
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.600 --> 00:32.650
However, this being a lab environment, if you want to use something as simple

11
00:32.650 --> 00:33.240
as Cisco

12
00:33.240 --> 00:37.120
123, that would be perfectly fine.

13
00:37.120 --> 00:40.590
Now the other thing we're going to need, as we go through pretty much all of

14
00:40.590 --> 00:41.280
the videos

15
00:41.280 --> 00:48.370
in this skill, we're going to need both the public and the private addresses of

16
00:48.370 --> 00:49.080
both on

17
00:49.080 --> 00:54.640
Pram R1 and GCPR1 in Google Cloud.

18
00:54.640 --> 01:00.470
Where the challenge will also need that information for on Pram R2 and GCPR2 as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:54.640 --> 01:00.470
Where the challenge will also need that information for on Pram R2 and GCPR2 as

19
01:00.470 --> 01:01.280
well.

20
01:01.280 --> 01:05.800
So please have that information handy as we're going through these videos.

21
01:05.800 --> 01:12.140
Some components will use the public or outside addresses and some of them will

22
01:12.140 --> 01:13.400
use the private

23
01:13.400 --> 01:16.320
or pre-nat addresses.

24
01:16.320 --> 01:23.640
So all of that said, let's go ahead and jump in and configure our key rings.

25
01:23.640 --> 01:27.440
So we'll just start our configuration here on on Pram R1.

26
01:27.440 --> 01:30.920
We'll of course go into configuration mode.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:27.440 --> 01:30.920
We'll of course go into configuration mode.

27
01:30.920 --> 01:33.000
Then we'll create our key ring.

28
01:33.000 --> 01:37.660
The command for this is crypto ike V2 key ring and then we simply give it a

29
01:37.660 --> 01:38.320
name.

30
01:38.320 --> 01:40.800
All just call it GCP keys.

31
01:40.800 --> 01:44.320
The next thing we need to do is create an actual peer.

32
01:44.320 --> 01:46.920
Now once again this peer is just given a name.

33
01:46.920 --> 01:49.240
I'll just call it GCP tunnel one.

34
01:49.240 --> 01:53.620
It doesn't really matter what the peer name is, but we need to create a peer.

35
01:53.620 --> 01:59.140
We then have to give the outside address of the peer router.

36
01:59.140 --> 02:03.620
So we simply use the address command followed by its outside address and then
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:59.140 --> 02:03.620
So we simply use the address command followed by its outside address and then

37
02:03.620 --> 02:04.380
we need to put

38
02:04.380 --> 02:08.220
in our local and our remote key.

39
02:08.220 --> 02:13.000
Now one other quick thing to note on these keys, you could technically use a

40
02:13.000 --> 02:14.340
different key

41
02:14.340 --> 02:19.030
for local than you are from remote and then of course just invert those on the

42
02:19.030 --> 02:19.500
other

43
02:19.500 --> 02:24.020
side. So on the other side, naturally the local would have to match whatever

44
02:24.020 --> 02:24.400
the remote is

45
02:24.400 --> 02:28.020
here and the remote here would have to match whatever the local is there.

46
02:28.020 --> 02:31.920
In my experience, there's generally no good reason to do that, but it is an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:28.020 --> 02:31.920
In my experience, there's generally no good reason to do that, but it is an

47
02:31.920 --> 02:32.580
option if

48
02:32.580 --> 02:33.580
you want to do so.

49
02:33.580 --> 02:36.860
Well, of course, use the same key here.

50
02:36.860 --> 02:40.510
We'll go ahead and exit configuration and now we have to go put the same

51
02:40.510 --> 02:41.460
configuration

52
02:41.460 --> 02:44.020
on GCP R1.

53
02:44.020 --> 02:48.500
So this is going to be the exact same configuration except here the address is

54
02:48.500 --> 02:48.900
going

55
02:48.900 --> 02:53.400
to be the outside address of the headquarters location.

56
02:53.400 --> 02:58.820
So now we have both routers configured with their key rings for the iq version

57
02:58.820 --> 03:00.540
to authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:58.820 --> 03:00.540
to authentication.

58
03:00.540 --> 03:05.660
So in this video, we created the iq v2 key rings that we're going to be using

59
03:05.660 --> 03:06.400
for the iq

60
03:06.400 --> 03:10.620
version to authentication, which of course is going to be pre-shared key.

61
03:10.620 --> 03:14.800
So the next thing we need to do is set up the rest of the components for iq

62
03:14.800 --> 03:15.420
version

63
03:15.420 --> 03:18.220
And that's what we're going to do in the next video.

64
03:18.220 --> 03:44.800
[ Silence ]