WEBVTT

1
00:00.000 --> 00:08.040
Next up, we just have to configure the IP Sec components, which include the

2
00:08.040 --> 00:08.680
transform

3
00:08.680 --> 00:12.120
set and the IP Sec profile.

4
00:12.120 --> 00:17.700
Now quite simply the transform set tells the device how to encrypt the traffic

5
00:17.700 --> 00:18.160
and then

6
00:18.160 --> 00:24.720
the IP Sec profile ties the transform set to the iq version 2 profile.

7
00:24.720 --> 00:27.240
So this is a fairly simple process.

8
00:27.240 --> 00:31.080
Let's just go ahead and jump into the command line and get these configured on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:27.240 --> 00:31.080
Let's just go ahead and jump into the command line and get these configured on

9
00:31.080 --> 00:34.360
both routers.

10
00:34.360 --> 00:37.160
So we'll just start on on prem R1 again.

11
00:37.160 --> 00:39.320
We'll go into configuration mode.

12
00:39.320 --> 00:45.160
Now the command for this one is crypto IP Sec, transform set and then we give

13
00:45.160 --> 00:46.320
it a name.

14
00:46.320 --> 00:49.720
So again I'm just going to call this TS_GCP.

15
00:49.720 --> 00:55.920
However, you also have to put the algorithm here that you plan on using.

16
00:55.920 --> 01:01.210
We're going to be doing ESP GCM and then if you look after that it also wants
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:55.920 --> 01:01.210
We're going to be doing ESP GCM and then if you look after that it also wants

17
01:01.210 --> 01:02.080
to know

18
01:02.080 --> 01:03.680
how many bits to make the keys.

19
01:03.680 --> 01:07.240
We'll just go ahead and do 256.

20
01:07.240 --> 01:11.840
So that creates the transform set and then as you can see there's not a whole

21
01:11.840 --> 01:12.280
lot to

22
01:12.280 --> 01:17.310
configure in the transform set except for the mode which we can set this to

23
01:17.310 --> 01:18.280
either tunnel

24
01:18.280 --> 01:20.040
or transport.

25
01:20.040 --> 01:24.160
We want to use a tunnel so we will set the mode here to tunnel.

26
01:24.160 --> 01:26.400
So that takes here the transform set.

27
01:26.400 --> 01:28.760
Now let's make the profile.

28
01:28.760 --> 01:32.360
You may be seeing a trend with these commands they're all very similar.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:28.760 --> 01:32.360
You may be seeing a trend with these commands they're all very similar.

29
01:32.360 --> 01:36.430
Now we have crypto IP Sec profile and we give it a name again we'll just call

30
01:36.430 --> 01:37.120
it IP Sec

31
01:37.120 --> 01:39.520
profile GCP.

32
01:39.520 --> 01:42.280
And there's really three things we want to put in here.

33
01:42.280 --> 01:46.840
The first is to call to that transform set that we just created.

34
01:46.840 --> 01:51.400
This again is what's going to tell it how to encrypt the actual payload.

35
01:51.400 --> 01:55.680
And with that we want to set a Diffie Helm and group to be used with our

36
01:55.680 --> 01:56.880
perfect forward

37
01:56.880 --> 01:58.520
secrecy.

38
01:58.520 --> 02:01.800
This is to go along with the ESP GCM.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:58.520 --> 02:01.800
This is to go along with the ESP GCM.

39
02:01.800 --> 02:05.880
And finally we need to call in our Ike version to profile.

40
02:05.880 --> 02:12.260
So we simply set the Ike V2 profile to the Ike V2 profile name that we created

41
02:12.260 --> 02:12.480
in the

42
02:12.480 --> 02:14.320
previous video.

43
02:14.320 --> 02:18.000
So once this is all set we can exit out a configuration.

44
02:18.000 --> 02:23.280
Of course we can verify these with a show crypto IP Sec transform set.

45
02:23.280 --> 02:25.200
We see here two things.

46
02:25.200 --> 02:28.800
Note first that there is a default transform set.

47
02:28.800 --> 02:33.450
And unlike the Ike V2 default components I've never had a problem with this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:28.800 --> 02:33.450
And unlike the Ike V2 default components I've never had a problem with this

48
02:33.450 --> 02:34.120
existing

49
02:34.120 --> 02:35.640
or being here.

50
02:35.640 --> 02:38.890
So that's not going to cause us any kind of an issue, but also of course note

51
02:38.890 --> 02:39.560
that the one

52
02:39.560 --> 02:45.650
we just created is here it's set to ESP GCM 256 as it should be and it's set to

53
02:45.650 --> 02:46.320
tunnel

54
02:46.320 --> 02:47.320
mode.

55
02:47.320 --> 02:55.440
We see here under the profile that we do in fact have the one we just created.

56
02:55.440 --> 02:59.700
We see that it's calling to the Ike V2 profile that it should be a little

57
02:59.700 --> 03:00.720
further down.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:59.700 --> 03:00.720
further down.

58
03:00.720 --> 03:06.520
We see that it's set to Diffie Helm and group 20 for the perfect forward secre

59
03:06.520 --> 03:06.760
cy.

60
03:06.760 --> 03:13.540
And we see that it is properly calling to the transform set that we created TS_

61
03:13.540 --> 03:13.880
GCP.

62
03:13.880 --> 03:18.080
So notice by the way that there's a default here as well, which is simply

63
03:18.080 --> 03:18.880
calling to the

64
03:18.880 --> 03:20.680
default transform set.

65
03:20.680 --> 03:24.200
So again this is not something we're going to be using, but the two components

66
03:24.200 --> 03:24.560
that we

67
03:24.560 --> 03:27.520
created are configured properly.

68
03:27.520 --> 03:31.400
Now of course we have to do GCP R1 the same way.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:27.520 --> 03:31.400
Now of course we have to do GCP R1 the same way.

69
03:31.400 --> 03:35.520
So here we'll just paste the configuration in because again it's exactly the

70
03:35.520 --> 03:36.040
same.

71
03:36.040 --> 03:39.360
This doesn't call to any kind of IP addresses or anything like that.

72
03:39.360 --> 03:45.200
So these two components are exactly the same on both devices.

73
03:45.200 --> 03:52.300
So in this video we simply configured our transform set and our profile for IP

74
03:52.300 --> 03:52.760
sec.

75
03:52.760 --> 03:55.720
And as I told you, it's real quick and easy.

76
03:55.720 --> 04:00.930
So now that we have all of our components for IPsec and Ike version 2, it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
03:55.720 --> 04:00.930
So now that we have all of our components for IPsec and Ike version 2, it's

77
04:00.930 --> 04:02.160
finally time

78
04:02.160 --> 04:06.840
to actually build our tunnel interfaces for our IPsec tunnel.

79
04:06.840 --> 04:09.840
That's exactly what we're gonna do in the next video.

80
04:09.840 --> 04:29.840
[ Silence ]