WEBVTT 1 00:00.000 --> 00:08.430 So now that we have our iKV2 key ring created, the next step is going to be to 2 00:08.430 --> 00:09.200 create the 3 00:09.200 --> 00:12.240 three P's of iKV2. 4 00:12.240 --> 00:16.720 That's the proposal, the policy, and the profile. 5 00:16.720 --> 00:22.230 Now two of these do have defaults and we could possibly use those, but we're 6 00:22.230 --> 00:22.840 not going 7 00:22.840 --> 00:23.840 to. 8 00:23.840 --> 00:27.260 We will explore what they look like and we'll talk a little bit more about that 9 00:27.260 --> 00:27.800 , but then 10 00:27.800 --> 00:32.760 we'll create our own constructs on both of the routers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:27.800 --> 00:32.760 we'll create our own constructs on both of the routers. 11 00:32.760 --> 00:39.250 So that said, let's go ahead and jump in and configure the three P's of iKV2 on 12 00:39.250 --> 00:39.400 both 13 00:39.400 --> 00:42.760 of our routers. 14 00:42.760 --> 00:47.680 So let's begin here by looking at what we have by default. 15 00:47.680 --> 00:53.250 So if we do a show crypto iKV2 proposal, what we see here is that we actually 16 00:53.250 --> 00:54.160 do have 17 00:54.160 --> 00:56.400 a default proposal. 18 00:56.400 --> 01:05.410 It's set to use a ES CBC 256 encryption using shop 512 or shop 384 for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 18 00:56.400 --> 01:05.410 It's set to use a ES CBC 256 encryption using shop 512 or shop 384 for 19 01:05.410 --> 01:07.120 integrity and those 20 01:07.120 --> 01:12.240 same algorithms for prf or the pseudo random function. 21 01:12.240 --> 01:19.000 We can also see that it'll use Diffie Helmand Group 19 14 or 21. 22 01:19.000 --> 01:24.640 So if this proposal meets our needs, we could certainly use it. 23 01:24.640 --> 01:31.120 If we instead look at the policy, notice there's also a default policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 23 01:24.640 --> 01:31.120 If we instead look at the policy, notice there's also a default policy. 24 01:31.120 --> 01:33.440 Now this isn't really doing too much. 25 01:33.440 --> 01:38.910 It's pretty much matching on anything and then calling to the default proposal 26 01:38.910 --> 01:39.680 above. 27 01:39.680 --> 01:44.920 So to a certain extent, it's sort of a very, very generic policy. 28 01:44.920 --> 01:49.000 However, it does still exist and we could still use it. 29 01:49.000 --> 01:53.480 If we look at the profile, however, there is no default. 30 01:53.480 --> 01:57.000 So either way, we have to write the profile. 31 01:57.000 --> 02:03.160 Whether we either use these default proposals or policies or whether we get rid WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:57.000 --> 02:03.160 Whether we either use these default proposals or policies or whether we get rid 32 02:03.160 --> 02:03.800 of them 33 02:03.800 --> 02:05.840 is a different discussion. 34 02:05.840 --> 02:10.260 So we're not going to use these defaults and when we're not going to use these 35 02:10.260 --> 02:11.000 defaults, 36 02:11.000 --> 02:16.580 that again leaves us with a choice, we can leave them there or we can get rid 37 02:16.580 --> 02:17.480 of them. 38 02:17.480 --> 02:22.040 Now normally speaking, there would be no reason to get rid of defaults. 39 02:22.040 --> 02:23.920 However, I will say this. 40 02:23.920 --> 02:29.720 I have run into versions of code that if you create your own components and the 41 02:29.720 --> 02:30.480 default WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 41 02:29.720 --> 02:30.480 default 42 02:30.480 --> 02:37.000 are still there, well, let's say the code gets confused as to which ones to use 43 02:37.000 --> 02:37.180 and 44 02:37.180 --> 02:42.070 it will continue using the defaults rather than the ones you created, even 45 02:42.070 --> 02:43.020 though you point 46 02:43.020 --> 02:45.020 it to the ones you created. 47 02:45.020 --> 02:48.060 So again, this code would have no problem. 48 02:48.060 --> 02:51.420 So on this code, there's no reason to get rid of the defaults. 49 02:51.420 --> 02:54.900 But if you want to, let me show you how to do it. 50 02:54.900 --> 02:58.690 So all we have to do to get rid of the default is go into configuration mode 51 02:58.690 --> 02:59.460 and simply say 52 02:59.460 --> 03:05.940 no crypto like V2 and then of course, either policy or proposal default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 52 02:59.460 --> 03:05.940 no crypto like V2 and then of course, either policy or proposal default. 53 03:05.940 --> 03:07.580 Should we do that? 54 03:07.580 --> 03:12.260 If we look at these commands again, it'll tell us that the default is disabled. 55 03:12.260 --> 03:17.020 So it says that for the proposal and it says that for the policy. 56 03:17.020 --> 03:20.700 Of course, there wasn't a default for the profile anyway. 57 03:20.700 --> 03:25.030 So now that we've gotten rid of the defaults, let's go back into configuration 58 03:25.030 --> 03:26.020 mode and create 59 03:26.020 --> 03:28.780 the ones that we actually want to use. 60 03:28.780 --> 03:31.660 So let's go ahead and start with the proposal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 03:28.780 --> 03:31.660 So let's go ahead and start with the proposal. 61 03:31.660 --> 03:36.220 So the command for this is crypto like V2 proposal and then we give it a name. 62 03:36.220 --> 03:40.180 I'm just going to call it like V2 proposal GCP. 63 03:40.180 --> 03:45.670 We hit enter and notice it tells us right away that we basically have two 64 03:45.670 --> 03:46.780 choices on how 65 03:46.780 --> 03:48.340 to configure this. 66 03:48.340 --> 03:55.080 First, we could use a set of encryption algorithms other than AES GCM along 67 03:55.080 --> 03:56.340 with an integrity 68 03:56.340 --> 04:05.500 algorithm and a Diffie Helm and group or we can use AES GCM and then instead of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 03:56.340 --> 04:05.500 algorithm and a Diffie Helm and group or we can use AES GCM and then instead of 69 04:05.500 --> 04:05.940 providing 70 04:05.940 --> 04:11.480 an integrity algorithm, we provide a PRF algorithm and then we still provide 71 04:11.480 --> 04:12.580 the Diffie Helm 72 04:12.580 --> 04:13.660 and group. 73 04:13.660 --> 04:16.900 So we are going to use AES GCM. 74 04:16.900 --> 04:19.340 So we're going to be using option number two here. 75 04:19.340 --> 04:23.660 Well, like it says, that means we have to use a GCM encryption. 76 04:23.660 --> 04:29.940 So part one here, we're going to say encryption AES GCM 256 for our encryption 77 04:29.940 --> 04:30.620 for our pseudo WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 77 04:29.940 --> 04:30.620 for our pseudo 78 04:30.620 --> 04:34.340 random function will tell it to use shop 512. 79 04:34.340 --> 04:35.860 And of course, these settings are optional. 80 04:35.860 --> 04:39.490 You can use whatever you want in your environment that meets your security 81 04:39.490 --> 04:40.060 policy. 82 04:40.060 --> 04:42.740 These are just the choices that I'm putting in. 83 04:42.740 --> 04:47.460 Finally a Diffie Helm and group and we'll just use Diffie Helm and group 20. 84 04:47.460 --> 04:52.210 Although optional, there is another highly recommended command here, crypto, I 85 04:52.210 --> 04:53.620 keV2 fragmentation, 86 04:53.620 --> 04:57.980 setting the Mtu to a relatively lower number like 1200. 87 04:57.980 --> 05:01.280 So we'll go ahead and put that in because although not strictly required, it is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 04:57.980 --> 05:01.280 So we'll go ahead and put that in because although not strictly required, it is 88 05:01.280 --> 05:01.860 recommended 89 05:01.860 --> 05:02.860 best practice. 90 05:02.860 --> 05:04.540 So let's go ahead and do that. 91 05:04.540 --> 05:07.780 And then that moves us on to the policy. 92 05:07.780 --> 05:09.980 First thing we need to do of course is create the policy. 93 05:09.980 --> 05:14.180 So this is going to be our crypto IkeV2 policy and then we give it a name. 94 05:14.180 --> 05:18.100 Again, we're just going to call it IkeV2 policy GCP. 95 05:18.100 --> 05:22.300 Notice that the first thing it tells us is that we have to have at least one 96 05:22.300 --> 05:22.900 proposal 97 05:22.900 --> 05:23.900 attached. 98 05:23.900 --> 05:28.260 Well, lucky for us, we just created a proposal in the last section there. 99 05:28.260 --> 05:30.860 So we can go ahead and assign that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 05:28.260 --> 05:30.860 So we can go ahead and assign that. 100 05:30.860 --> 05:34.420 So we simply say proposal and put in the name of the proposal. 101 05:34.420 --> 05:38.340 Now if we wanted we could do something like a match any here to have it match 102 05:38.340 --> 05:40.080 on any address, 103 05:40.080 --> 05:45.120 but it's generally more common to have it match on the address of the outside 104 05:45.120 --> 05:46.180 interface. 105 05:46.180 --> 05:49.990 Now keep in mind when we say the address of the outside interface, this is 106 05:49.990 --> 05:50.700 going to be 107 05:50.700 --> 05:55.060 the private address with a pre-matt address. 108 05:55.060 --> 05:59.300 So we'll go ahead and put that in here for on prem R1. 109 05:59.300 --> 06:01.060 And then we'll exit out of here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 05:59.300 --> 06:01.060 And then we'll exit out of here. 110 06:01.060 --> 06:03.300 That takes care of the policy. 111 06:03.300 --> 06:05.420 The next thing we need is a profile. 112 06:05.420 --> 06:09.500 Of course, you can see it's the same basic structure here where we say crypto I 113 06:09.500 --> 06:10.180 keV2, then 114 06:10.180 --> 06:12.940 the word profile and then we just give it a name. 115 06:12.940 --> 06:15.940 Again, IkeV2 profile here is fine. 116 06:15.940 --> 06:20.980 This tells us that we have to have at least two components in our profile. 117 06:20.980 --> 06:26.020 We have to have a local end-to-remote authentication method and we have to have 118 06:26.020 --> 06:28.300 either a match identity 119 06:28.300 --> 06:32.780 or a match certificate or a match any. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 06:28.300 --> 06:32.780 or a match certificate or a match any. 120 06:32.780 --> 06:36.340 Let's go ahead and put in that match identity statement first. 121 06:36.340 --> 06:40.060 For this we're going to match the remote address. 122 06:40.060 --> 06:43.300 In this case it's the 10.40.1.2. 123 06:43.300 --> 06:51.040 So once again, it's the outside interface of GCPR1 but it's the outside address 124 06:51.040 --> 06:51.640 before 125 06:51.640 --> 06:52.640 that. 126 06:52.640 --> 06:55.460 So the private outside address. 127 06:55.460 --> 06:58.300 You can do more match statements if you like. 128 06:58.300 --> 07:02.820 We could match a local address for interface gig 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 128 06:58.300 --> 07:02.820 We could match a local address for interface gig 1. 129 07:02.820 --> 07:06.820 So that means we're definitely identifying this particular tunnel we want to 130 07:06.820 --> 07:07.260 build between 131 07:07.260 --> 07:12.300 our local gigabit 1 interface and this remote address. 132 07:12.300 --> 07:16.580 You can also specify the identity by the local address. 133 07:16.580 --> 07:19.940 So there's a lot of ways we can identify this. 134 07:19.940 --> 07:23.870 But remember that the other thing we had to have was a local end-to-remote 135 07:23.870 --> 07:24.900 authentication 136 07:24.900 --> 07:25.900 method. 137 07:25.900 --> 07:29.840 So we're going to say authentication remote is pre-share because that's what we 138 07:29.840 --> 07:30.280 intend WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 138 07:29.840 --> 07:30.280 intend 139 07:30.280 --> 07:31.280 on using. 140 07:31.280 --> 07:35.060 We'll set the local to pre-share as well. 141 07:35.060 --> 07:40.050 This is where we then call to that key ring that we created previously to be 142 07:40.050 --> 07:40.620 used by 143 07:40.620 --> 07:43.580 the pre-share key authentication. 144 07:43.580 --> 07:45.060 And then another optional step. 145 07:45.060 --> 07:49.460 But again, generally best practice is to do dead peer detection. 146 07:49.460 --> 07:54.560 We're putting in some best practice timers here and we're telling it to run on 147 07:54.560 --> 07:54.900 demand. 148 07:54.900 --> 07:58.340 So that you take care of all the configuration we need to do on this router. 149 07:58.340 --> 08:01.900 We can now go ahead and verify what we just put in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 149 07:58.340 --> 08:01.900 We can now go ahead and verify what we just put in. 150 08:01.900 --> 08:04.220 So we'll start by looking at our proposal. 151 08:04.220 --> 08:07.820 So we see here we have the proposal with the name that we suggested. 152 08:07.820 --> 08:13.060 It's using the AES GCM256 algorithm like we said. 153 08:13.060 --> 08:16.900 Integrity is set to none because GCM doesn't use integrity. 154 08:16.900 --> 08:18.820 It uses PRF. 155 08:18.820 --> 08:22.700 So that has the algorithm set to sharp 512 like we said. 156 08:22.700 --> 08:25.500 And it's set to use DiffieHumman Group 20. 157 08:25.500 --> 08:30.380 Now keep in mind, you can have multiples on this like we saw in the default WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 08:25.500 --> 08:30.380 Now keep in mind, you can have multiples on this like we saw in the default 158 08:30.380 --> 08:31.100 proposal. 159 08:31.100 --> 08:35.500 And it'll negotiate with the other side as far as which components to use. 160 08:35.500 --> 08:39.020 Since we have full control of both sides, we can just put in the one option 161 08:39.020 --> 08:39.380 because we're 162 08:39.380 --> 08:42.620 going to configure the other side exactly the same. 163 08:42.620 --> 08:46.700 If we look at our policy, we again see the policy that we created. 164 08:46.700 --> 08:52.630 We see that it's matching on the local address and it's calling to the proposal 165 08:52.630 --> 08:52.660 . 166 08:52.660 --> 08:56.740 So this is tying that proposal to the local address. 167 08:56.740 --> 09:00.870 And finally, if we look at the profile, this of course shows us a lot of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 08:56.740 --> 09:00.870 And finally, if we look at the profile, this of course shows us a lot of 168 09:00.870 --> 09:02.820 different things. 169 09:02.820 --> 09:07.300 But some of the big things we see overall is the local address and interface is 170 09:07.300 --> 09:07.580 set to 171 09:07.580 --> 09:09.460 the gigabit one. 172 09:09.460 --> 09:15.300 The remote identity is set to match on GCP R1's gigabit one interface. 173 09:15.300 --> 09:19.180 Our local identity is set to our own address. 174 09:19.180 --> 09:23.860 Our local and remote authentication are both set to pre-share. 175 09:23.860 --> 09:28.140 It's set to use our key ring GCP_Keyes. 176 09:28.140 --> 09:32.250 And if we look a little further down, it tells us that our dead peer detection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 176 09:28.140 --> 09:32.250 And if we look a little further down, it tells us that our dead peer detection 177 09:32.250 --> 09:32.620 is set 178 09:32.620 --> 09:37.580 to an interval of 10 with the retry interval of 2 and it's running on demand. 179 09:37.580 --> 09:41.630 Again, there's a lot of other information here, but these are the things that 180 09:41.630 --> 09:42.660 we configured. 181 09:42.660 --> 09:45.900 So we can see that this is properly configured. 182 09:45.900 --> 09:51.420 That said, we now have to go put these same components on GCP_R1. 183 09:51.420 --> 09:54.260 So the first thing we want is our proposal. 184 09:54.260 --> 09:57.300 So there's our proposal configuration. 185 09:57.300 --> 09:59.020 Next is our policy. 186 09:59.020 --> 10:01.180 That takes care of our policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 186 09:59.020 --> 10:01.180 That takes care of our policy. 187 10:01.180 --> 10:04.940 Because if this is essentially the exact same configuration, we're just 188 10:04.940 --> 10:05.820 changing things 189 10:05.820 --> 10:08.500 like the local and remote addresses. 190 10:08.500 --> 10:11.460 And finally, of course, the profile. 191 10:11.460 --> 10:13.660 Now again, we could verify these. 192 10:13.660 --> 10:18.640 However, since we just put this configuration in essentially copied and pasted 193 10:18.640 --> 10:19.500 from on-prem 194 10:19.500 --> 10:24.580 R1 with just the addresses inverted, this should be perfectly fine. 195 10:24.580 --> 10:28.460 If we run into problems down the road, we'll do some troubleshooting then. 196 10:28.460 --> 10:33.380 But this should take care of creating the components for Ike version 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 196 10:28.460 --> 10:33.380 But this should take care of creating the components for Ike version 2. 197 10:33.380 --> 10:39.720 So in this video, we created the three Ps of Ike version 2 on both of our rout 198 10:39.720 --> 10:40.500 ers. 199 10:40.500 --> 10:46.230 So we created our proposal, our policy, and our profile, as well as removing 200 10:46.230 --> 10:47.180 the default 201 10:47.180 --> 10:49.340 proposal and policy. 202 10:49.340 --> 10:51.740 Now remember, that's not strictly necessary. 203 10:51.740 --> 10:56.420 And again, on most code, that's not going to be a requirement. 204 10:56.420 --> 10:58.220 Most codes going to be perfectly fine. 205 10:58.220 --> 11:02.590 Again, I have run into some very limited instances where that's created an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 205 10:58.220 --> 11:02.590 Again, I have run into some very limited instances where that's created an 206 11:02.590 --> 11:03.260 issue. 207 11:03.260 --> 11:07.860 So the next thing we're going to need are the components for IPsec. 208 11:07.860 --> 11:11.330 And we'll see as we jump into that in the next video that they're actually a 209 11:11.330 --> 11:12.420 lot easier 210 11:12.420 --> 11:13.220 and shorter. 211 11:13.220 --> 11:29.560 [ Silence ]