WEBVTT

1
00:00.000 --> 00:08.000
So now that we have all of our iqv2 and ipsec components configured, it's

2
00:08.000 --> 00:08.800
finally time

3
00:08.800 --> 00:13.040
to configure our VTI or our virtual tunnel interface.

4
00:13.040 --> 00:18.180
Now this configuration isn't that different from any other tunnel configuration

5
00:18.180 --> 00:18.640
on iOS,

6
00:18.640 --> 00:23.000
except we're going to be configuring the tunnel mode and configuring the tunnel

7
00:23.000 --> 00:24.000
protection.

8
00:24.000 --> 00:26.320
So let's go ahead and jump into the command line.

9
00:26.320 --> 00:30.630
We'll start an on-prem R1 and we'll get our tunnels configured and make sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:26.320 --> 00:30.630
We'll start an on-prem R1 and we'll get our tunnels configured and make sure

10
00:30.630 --> 00:30.960
they come

11
00:30.960 --> 00:34.120
online.

12
00:34.120 --> 00:37.680
So once we go into configuration mode, the next thing we need to do is actually

13
00:37.680 --> 00:38.560
create

14
00:38.560 --> 00:40.160
the tunnel interface.

15
00:40.160 --> 00:43.320
So we'll just make interface tunnel 1.

16
00:43.320 --> 00:46.590
It's of course completely optional, but if you want you can put it in a

17
00:46.590 --> 00:47.400
description,

18
00:47.400 --> 00:51.040
such as in this case 2gcpr1.

19
00:51.040 --> 00:53.880
Of course the tunnel has to have an ip address.

20
00:53.880 --> 00:58.480
So we're going to use the 169.254 address space.

21
00:58.480 --> 01:04.520
We'll use a .41 in the third octet because this is sort of acting as site 4 in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.480 --> 01:04.520
We'll use a .41 in the third octet because this is sort of acting as site 4 in

22
01:04.520 --> 01:05.640
our topology

23
01:05.640 --> 01:07.840
and this is tunnel 1.

24
01:07.840 --> 01:12.200
Then for the last octet, one end is going to be a 1 and one end is going to be

25
01:12.200 --> 01:12.840
a 2.

26
01:12.840 --> 01:15.960
We'll just make this one the .2.

27
01:15.960 --> 01:19.320
Next we want to configure the mtu for the tunnel.

28
01:19.320 --> 01:23.960
Now we don't necessarily have to go all the way down to 1400 bytes.

29
01:23.960 --> 01:25.880
This is a very safe number.

30
01:25.880 --> 01:31.080
If you want you can actually bring the tunnel online, then test the actual mtu
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:25.880 --> 01:31.080
If you want you can actually bring the tunnel online, then test the actual mtu

31
01:31.080 --> 01:31.760
across the

32
01:31.760 --> 01:35.040
tunnel and then set the mtu accordingly.

33
01:35.040 --> 01:39.900
So you can set this more accurately, but for the sake of a lab, setting it to

34
01:39.900 --> 01:41.480
1400 is just

35
01:41.480 --> 01:43.400
a safe number.

36
01:43.400 --> 01:48.420
If you set the mtu, it's generally a good idea to also set the TCP maximum

37
01:48.420 --> 01:49.280
segment size

38
01:49.280 --> 01:56.050
and this should be 40 bytes below the mtu to count for the TCP and the ip

39
01:56.050 --> 01:57.280
headers.

40
01:57.280 --> 01:59.440
So we'll go ahead and set that.

41
01:59.440 --> 02:03.320
We also of course need to set the tunnel source.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:59.440 --> 02:03.320
We also of course need to set the tunnel source.

42
02:03.320 --> 02:07.490
Since this is a point to point tunnel and not a point to multi point tunnel, we

43
02:07.490 --> 02:08.120
also need

44
02:08.120 --> 02:10.080
to set the destination.

45
02:10.080 --> 02:16.800
Now the destination will be the public outside address as assigned to this

46
02:16.800 --> 02:18.120
router by Google

47
02:18.120 --> 02:19.400
Cloud.

48
02:19.400 --> 02:24.480
So this is the same address that we use to SSH into that router.

49
02:24.480 --> 02:30.600
Now on iOS XE, the default mode for a tunnel is to be a GRE tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:24.480 --> 02:30.600
Now on iOS XE, the default mode for a tunnel is to be a GRE tunnel.

50
02:30.600 --> 02:32.640
We want it to be IP sec.

51
02:32.640 --> 02:37.200
So we're going to say tunnel mode is IP sec and then the IPv4 here is listing

52
02:37.200 --> 02:38.840
the transport.

53
02:38.840 --> 02:43.000
So we'll be sending IP sec over IPv4.

54
02:43.000 --> 02:47.400
Of course as soon as the tunnel mode is IP sec, you also have to tell it how to

55
02:47.400 --> 02:47.720
then

56
02:47.720 --> 02:49.680
protect that traffic.

57
02:49.680 --> 02:55.300
So we say tunnel protection, IP sec, then we call to the profile and of course

58
02:55.300 --> 02:55.840
this is

59
02:55.840 --> 03:01.430
going to be the IP sec profile, the same profile we created in the previous
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:55.840 --> 03:01.430
going to be the IP sec profile, the same profile we created in the previous

60
03:01.430 --> 03:02.440
section.

61
03:02.440 --> 03:06.920
So that should take care of the configuration for on prem R1.

62
03:06.920 --> 03:10.600
Next of course, we're going to go do GCP R1.

63
03:10.600 --> 03:13.560
There's only going to really be three things here that change.

64
03:13.560 --> 03:18.880
First, of course, the description would be different.

65
03:18.880 --> 03:21.360
Second, the IP address is going to end in dot 1 instead of dot 2.

66
03:21.360 --> 03:25.790
And of course, the tunnel destination would be the outside public address of

67
03:25.790 --> 03:26.680
your headquarters

68
03:26.680 --> 03:27.760
location.

69
03:27.760 --> 03:30.160
So let's go ahead and configure that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:27.760 --> 03:30.160
So let's go ahead and configure that.

70
03:30.160 --> 03:32.640
So we'll just paste in the configuration.

71
03:32.640 --> 03:35.800
Once this is configured, we can do some verification.

72
03:35.800 --> 03:40.560
We'll just jump back over to on prem R1 for the verification.

73
03:40.560 --> 03:43.840
So first, we can do a show IP interface brief.

74
03:43.840 --> 03:49.160
What we see here is that our tunnel one interface has in fact come up.

75
03:49.160 --> 03:52.480
So our status and our protocol are both up.

76
03:52.480 --> 03:56.230
And if it's actually functioning properly, we should be able to ping the other

77
03:56.230 --> 03:56.720
side.

78
03:56.720 --> 04:05.840
So let's ping the 169.254.41.1, which is of course the address on GCP R1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:56.720 --> 04:05.840
So let's ping the 169.254.41.1, which is of course the address on GCP R1.

79
04:05.840 --> 04:11.760
We see here that this is successful. Therefore, our tunnel is up and functional

80
04:11.760 --> 04:13.880
between GCP R1

81
04:13.880 --> 04:17.000
and on prem R1.

82
04:17.000 --> 04:23.920
So in this video, we got our IPsec VPN up and working properly between on prem

83
04:23.920 --> 04:25.600
R1 and GCP

84
04:25.600 --> 04:26.600
R1.

85
04:26.600 --> 04:30.750
Now keep in mind, you could of course have used different parameters for the IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
04:26.600 --> 04:30.750
Now keep in mind, you could of course have used different parameters for the IP

86
04:30.750 --> 04:31.360
sec tunnel

87
04:31.360 --> 04:32.600
and so on.

88
04:32.600 --> 04:36.560
But overall, this is how we get the tunnel up and operational.

89
04:36.560 --> 04:40.070
We also of course ping to the other side to make sure that it's actually

90
04:40.070 --> 04:41.880
forwarding traffic.

91
04:41.880 --> 04:46.570
Now in order to get the subnets on each side to be able to communicate, we're

92
04:46.570 --> 04:47.120
of course

93
04:47.120 --> 04:50.360
going to have to implement some form of routing.

94
04:50.360 --> 04:51.840
It could be static routing.

95
04:51.840 --> 04:55.160
It could be pretty much any dynamic routing protocol.

96
04:55.160 --> 04:57.160
We're going to be using OSPF.

97
04:57.160 --> 04:59.240
That's what we're going to set up in the next video.

98
04:59.240 --> 05:08.520
[BLANK_AUDIO]
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
04:59.240 --> 05:08.520
[BLANK_AUDIO]