WEBVTT

1
00:00.000 --> 00:08.130
So for this challenge, we're tasked with deploying a redundant IP-sec VPN

2
00:08.130 --> 00:09.080
between OnPrem

3
00:09.080 --> 00:12.960
R2 and GCPR2.

4
00:12.960 --> 00:18.550
Now since this configuration is going to be almost identical on both sides, of

5
00:18.550 --> 00:19.240
course,

6
00:19.240 --> 00:26.090
addresses and such will be inverted and so on, I actually have GCPR2 already

7
00:26.090 --> 00:27.520
configured.

8
00:27.520 --> 00:32.560
That configuration is supplied in the code window below this video, but we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:27.520 --> 00:32.560
That configuration is supplied in the code window below this video, but we're

9
00:32.560 --> 00:32.840
just going

10
00:32.840 --> 00:38.280
to walk through the configuration and verification here on OnPrem R2.

11
00:38.280 --> 00:42.320
So that said, let's go ahead and jump in with our configuration.

12
00:42.320 --> 00:45.480
The first thing we need, of course, is our key ring.

13
00:45.480 --> 00:47.680
And I'm just going to go ahead and paste this in.

14
00:47.680 --> 00:49.720
We're just going to give the key ring a name.

15
00:49.720 --> 00:52.760
We're going to configure a peer, put in its address.

16
00:52.760 --> 00:58.640
This of course would be the outside public address of GCPR2.

17
00:58.640 --> 01:03.640
Then we put in our two pre-shared keys for local and remote.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:58.640 --> 01:03.640
Then we put in our two pre-shared keys for local and remote.

18
01:03.640 --> 01:09.480
Next we'll go ahead and get rid of the default like V2 policy and proposal.

19
01:09.480 --> 01:12.040
And then of course, we'll put in our own.

20
01:12.040 --> 01:14.840
So just like before, we give it a name.

21
01:14.840 --> 01:16.400
We set up our encryption.

22
01:16.400 --> 01:20.800
We set up our PRF and we set up our Diffie Helmand group.

23
01:20.800 --> 01:26.600
Our consistency will go ahead and set up the fragmentation for Ike version 2.

24
01:26.600 --> 01:30.400
And then next, of course, we're going to configure our policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:26.600 --> 01:30.400
And then next, of course, we're going to configure our policy.

25
01:30.400 --> 01:35.780
So again, we give the policy a name and we tie it to the local address and we

26
01:35.780 --> 01:36.080
attach

27
01:36.080 --> 01:40.240
the proposal like V2 proposal GCP.

28
01:40.240 --> 01:45.660
Our final Ike V2 component is the profile and we see here, of course, we give

29
01:45.660 --> 01:46.560
the profile

30
01:46.560 --> 01:47.800
a name.

31
01:47.800 --> 01:50.320
Then we tell it to match our local interface.

32
01:50.320 --> 01:52.800
We tell it to match the remote identity.

33
01:52.800 --> 01:59.120
This of course is the private or inside address that's given to GCPR2.

34
01:59.120 --> 02:01.680
We also identify our local address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:59.120 --> 02:01.680
We also identify our local address.

35
02:01.680 --> 02:05.800
We set up our local and remote authentication to be pre-shared.

36
02:05.800 --> 02:10.600
We tie in our key ring and then we set up our dead peer detection.

37
02:10.600 --> 02:13.000
Moving on to the IPsec components.

38
02:13.000 --> 02:20.440
We'll make our IPsec transform set using ESP GCM256 and setting it to a tunnel.

39
02:20.440 --> 02:25.370
And then we create our IPsec profile, tying our transform set, our perfect

40
02:25.370 --> 02:26.520
forward secrecy

41
02:26.520 --> 02:30.680
group and our Ike V2 profile together.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
02:26.520 --> 02:30.680
group and our Ike V2 profile together.

42
02:30.680 --> 02:33.960
This is then, of course, going to be applied to the tunnel.

43
02:33.960 --> 02:36.960
Our next step, of course, is to create said tunnel.

44
02:36.960 --> 02:38.840
So we'll go ahead and put this in.

45
02:38.840 --> 02:43.080
Now a few notes on this. First, I did interface tunnel 2.

46
02:43.080 --> 02:49.240
This is really the first tunnel on on prem R2 and GCPR2.

47
02:49.240 --> 02:54.540
However, I decided to call it tunnel 2 just because it's the second tunnel

48
02:54.540 --> 02:55.280
between the

49
02:55.280 --> 02:58.760
on prem environment and the GCP environment.

50
02:58.760 --> 03:01.280
You could have also just made this tunnel 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:58.760 --> 03:01.280
You could have also just made this tunnel 1.

51
03:01.280 --> 03:03.400
That would have been fine as well.

52
03:03.400 --> 03:05.280
Then of course, I set the description.

53
03:05.280 --> 03:07.440
We give it an IP address.

54
03:07.440 --> 03:12.000
We're going to make this 42 in the third octet just because again, it's acting

55
03:12.000 --> 03:12.240
like

56
03:12.240 --> 03:15.200
site 4 and this is tunnel 2.

57
03:15.200 --> 03:19.150
And then just like we did earlier, this is going to be a dot 2 on one side and

58
03:19.150 --> 03:19.560
the other

59
03:19.560 --> 03:22.600
side is already configured for dot 1.

60
03:22.600 --> 03:24.720
Then we set our Mtu.

61
03:24.720 --> 03:28.520
We set our TCP maximum segment size to be 40 bytes lower.

62
03:28.520 --> 03:33.240
We set up our tunnel source, our tunnel destination, our tunnel mode to be IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
03:28.520 --> 03:33.240
We set up our tunnel source, our tunnel destination, our tunnel mode to be IP

63
03:33.240 --> 03:35.400
sec over IPv4.

64
03:35.400 --> 03:41.000
And then of course, we attach our tunnel protection profile for IPsec.

65
03:41.000 --> 03:44.760
Now we could verify that our interface and everything is up at this point.

66
03:44.760 --> 03:48.360
But having a little bit of confidence that it's working, let's go ahead and put

67
03:48.360 --> 03:48.640
in our

68
03:48.640 --> 03:54.000
OSPF configuration and then we'll do all of our verification at the same time.

69
03:54.000 --> 03:56.480
So we'll put in our OSPF configuration.

70
03:56.480 --> 04:02.280
Again, simply setting the router ID, creating a loopback interface and enabling
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:56.480 --> 04:02.280
Again, simply setting the router ID, creating a loopback interface and enabling

71
04:02.280 --> 04:02.680
OSPF on

72
04:02.680 --> 04:07.840
that loopback on Gigabit 2 and on the tunnel 2 that we just created.

73
04:07.840 --> 04:12.040
So now for our verification, let's do a show IP interface brief.

74
04:12.040 --> 04:17.360
We see that our tunnel 2 interface is in fact up up, so that looks good.

75
04:17.360 --> 04:20.600
Let's go right to a show IP OSPF neighbors.

76
04:20.600 --> 04:26.990
Now we see here that our neighbor ship to GCPR2 is up over the tunnel 2

77
04:26.990 --> 04:28.200
interface.

78
04:28.200 --> 04:33.380
But also note that we have a neighbor ship now over our Gigabit 2 interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
04:28.200 --> 04:33.380
But also note that we have a neighbor ship now over our Gigabit 2 interface

79
04:33.380 --> 04:33.800
because we've

80
04:33.800 --> 04:38.160
also created neighbors over the client segments.

81
04:38.160 --> 04:41.800
So in this case, it's a neighbor ship to on-prem R1.

82
04:41.800 --> 04:44.320
And that's perfectly fine if we didn't want that.

83
04:44.320 --> 04:49.040
We could of course make them passive interfaces if we desired.

84
04:49.040 --> 04:53.000
Finally we'll do a show IP route filter it for OSPF.

85
04:53.000 --> 04:57.410
And of course we're learning a few routes here from OSPF, particularly since we

86
04:57.410 --> 04:57.760
have

87
04:57.760 --> 05:02.680
that neighbor ship up with on-prem R1 over our Gigabit 2 interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:57.760 --> 05:02.680
that neighbor ship up with on-prem R1 over our Gigabit 2 interface.

88
05:02.680 --> 05:06.780
So I would simply say that the most important piece here to realize is that we

89
05:06.780 --> 05:07.360
're learning

90
05:07.360 --> 05:12.840
the 10.40-10.0/24 over tunnel 2.

91
05:12.840 --> 05:19.480
That's the redundant connection to the GCP segment on the far side.

92
05:19.480 --> 05:24.080
So with all of this working, that actually completes this challenge.

93
05:24.080 --> 05:26.280
And therefore this skill.

94
05:26.280 --> 05:30.920
If you find you were unable to complete any of this to complete the challenge,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
05:26.280 --> 05:30.920
If you find you were unable to complete any of this to complete the challenge,

95
05:30.920 --> 05:31.160
I would

96
05:31.160 --> 05:35.800
encourage you to go review the appropriate sections in the skill above.

97
05:35.800 --> 05:42.680
Otherwise, congratulations on completing Configure iOS XE Site to Site VPN in G

98
05:42.680 --> 05:43.280
CP.

99
05:43.280 --> 05:47.240
I hope this has been informative for you and I'd like to thank you for viewing.

100
05:47.240 --> 05:57.240
[BLANK_AUDIO]