WEBVTT

1
00:00.000 --> 00:06.560
One of the things we're going to need for our SD-WAN environment to function

2
00:06.560 --> 00:07.640
properly

3
00:07.640 --> 00:10.160
is valid certificates.

4
00:10.160 --> 00:14.130
These certificates are going to be used to form the control tunnels and do

5
00:14.130 --> 00:15.080
authentication

6
00:15.080 --> 00:17.080
between the devices.

7
00:17.080 --> 00:22.040
Now in a live or production SD-WAN environment, this would normally be

8
00:22.040 --> 00:23.640
certificates issued

9
00:23.640 --> 00:27.000
by a proper certificate authority.

10
00:27.000 --> 00:32.250
Usually one recognized by Cisco, they have a list of those certificate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.000 --> 00:32.250
Usually one recognized by Cisco, they have a list of those certificate

11
00:32.250 --> 00:33.440
providers on their

12
00:33.440 --> 00:35.600
website that they support.

13
00:35.600 --> 00:40.380
However, in a lab environment, it may be useful just to create our own root

14
00:40.380 --> 00:42.080
certificate authority

15
00:42.080 --> 00:44.820
and issue our own certificates.

16
00:44.820 --> 00:48.890
If you already have a certificate authority that you want to use for your lab

17
00:48.890 --> 00:49.840
environment,

18
00:49.840 --> 00:52.840
you could actually simply skip this video.

19
00:52.840 --> 00:57.220
Move on to the next one where we begin adding controllers and issuing the

20
00:57.220 --> 00:58.400
certificates.

21
00:58.400 --> 01:01.830
But what we're going to do in this video is we're going to actually set up our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.400 --> 01:01.830
But what we're going to do in this video is we're going to actually set up our

22
01:01.830 --> 01:02.320
VManage

23
01:02.320 --> 01:07.060
server as a certificate authority for the other devices.

24
01:07.060 --> 01:10.730
So let's go ahead and take a look at how to do that so we can have our lab

25
01:10.730 --> 01:11.580
environment

26
01:11.580 --> 01:15.480
completely self-contained.

27
01:15.480 --> 01:19.770
So starting off here on VManage, the first thing we're going to need to do is

28
01:19.770 --> 01:20.240
go into

29
01:20.240 --> 01:22.100
the Linux show.

30
01:22.100 --> 01:25.840
So we'll say V shell, this will put us into the Linux shell.

31
01:25.840 --> 01:31.640
If we do a PWD, we can see that we're currently in the home admin folder and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:25.840 --> 01:31.640
If we do a PWD, we can see that we're currently in the home admin folder and

32
01:31.640 --> 01:32.460
that's fine.

33
01:32.460 --> 01:34.320
We can do all of our work here.

34
01:34.320 --> 01:37.610
If you want to put things in a different folder, that's of course perfectly

35
01:37.610 --> 01:39.060
fine as well.

36
01:39.060 --> 01:43.970
If we do an LS to see the contents of this folder, it simply has this dot pub

37
01:43.970 --> 01:44.580
file in

38
01:44.580 --> 01:47.840
it, which is not really our current concern.

39
01:47.840 --> 01:52.430
All we want to do is make a certificate and to do this, we're going to start

40
01:52.430 --> 01:53.140
with using

41
01:53.140 --> 01:57.500
open SSL to generate an RSA key.

42
01:57.500 --> 02:00.500
So we'll start with open SSL.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:57.500 --> 02:00.500
So we'll start with open SSL.

43
02:00.500 --> 02:04.900
We'll tell it to generate an RSA key for the output.

44
02:04.900 --> 02:10.840
We will put it in a file called CA dot key simply for certificate authority and

45
02:10.840 --> 02:11.420
we'll

46
02:11.420 --> 02:14.180
make it 2048 bets.

47
02:14.180 --> 02:17.180
That's perfectly fine for what we're trying to accomplish.

48
02:17.180 --> 02:21.520
So this will generate, as you can see, the RSA private key, we're then going to

49
02:21.520 --> 02:22.120
use that

50
02:22.120 --> 02:24.800
key to generate a certificate.

51
02:24.800 --> 02:27.920
So once again, it's open SSL.

52
02:27.920 --> 02:34.680
We're going to make a request for a new X 509 certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:27.920 --> 02:34.680
We're going to make a request for a new X 509 certificate.

53
02:34.680 --> 02:37.040
You can choose how many days is going to be valid for.

54
02:37.040 --> 02:38.560
We'll say three sixty five.

55
02:38.560 --> 02:41.000
We'll just make it valid for a year.

56
02:41.000 --> 02:47.030
Again, for the key, we're going to use the key we just created, so CA dot key,

57
02:47.030 --> 02:47.560
and then

58
02:47.560 --> 02:51.440
for the output is going to be our certificate.

59
02:51.440 --> 02:54.360
So we'll do CA dot cert.

60
02:54.360 --> 02:58.390
We'll hit enter and it's going to start asking us some questions about our

61
02:58.390 --> 02:59.380
certificate.

62
02:59.380 --> 03:03.180
Now of course, you'll want to put in your valid information here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:59.380 --> 03:03.180
Now of course, you'll want to put in your valid information here.

63
03:03.180 --> 03:08.760
In my case, I happen to be in the US for the state or Providence.

64
03:08.760 --> 03:12.360
I'm in Florida for the locality or name.

65
03:12.360 --> 03:15.120
I usually use like the local airport code.

66
03:15.120 --> 03:18.840
In my case, it's MCO for Orlando Airport.

67
03:18.840 --> 03:21.640
You could also just put in Orlando.

68
03:21.640 --> 03:26.560
Then for the organization name, you have to put this in as you did everywhere

69
03:26.560 --> 03:27.120
else so

70
03:27.120 --> 03:28.320
far.

71
03:28.320 --> 03:35.080
So in my case, that's a any underscore SD dash.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:28.320 --> 03:35.080
So in my case, that's a any underscore SD dash.

72
03:35.080 --> 03:38.520
For the organizational unit name, again, you can use whatever you like.

73
03:38.520 --> 03:43.000
I'm just going to say that this is for our when for the common name.

74
03:43.000 --> 03:48.760
I'm simply going to say lab dot local and for the email address, I'll just say

75
03:48.760 --> 03:49.240
admin

76
03:49.240 --> 03:52.360
at lab dot local.

77
03:52.360 --> 03:58.580
Once that's complete, if we do an LS, we can see that we now have this CA dot

78
03:58.580 --> 03:59.520
cert.

79
03:59.520 --> 04:02.560
So we have now created our certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.520 --> 04:02.560
So we have now created our certificate.

80
04:02.560 --> 04:07.880
So the next thing we have to do is get this certificate out to other devices,

81
04:07.880 --> 04:08.960
specifically

82
04:08.960 --> 04:11.960
so far, our other controllers.

83
04:11.960 --> 04:15.440
So we're going to use SCP for this secure copy.

84
04:15.440 --> 04:18.440
We want to copy the CA dot cert.

85
04:18.440 --> 04:24.490
We're going to copy that as the admin account at and then the address of the

86
04:24.490 --> 04:26.040
other devices.

87
04:26.040 --> 04:30.680
So first we have to 16, which is the V bond server and we'll put a colon after
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:26.040 --> 04:30.680
So first we have to 16, which is the V bond server and we'll put a colon after

88
04:30.680 --> 04:31.280
this.

89
04:31.280 --> 04:35.880
We're going to copy it right into the root of the home folder.

90
04:35.880 --> 04:38.800
So once again, that'll be user admin.

91
04:38.800 --> 04:40.040
So we'll hit enter.

92
04:40.040 --> 04:44.970
It's going to ask us since this is the first time we've used SSH or SCP if we

93
04:44.970 --> 04:46.480
want to accept

94
04:46.480 --> 04:51.830
this key fingerprint for the shot to 56 authentication, we're, of course, going

95
04:51.830 --> 04:52.920
to say yes.

96
04:52.920 --> 04:54.680
And I'll ask us for our password.

97
04:54.680 --> 04:59.080
So we put that in and we can see here it copied the file.

98
04:59.080 --> 05:04.200
We want to do the same thing, but also to 217.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
04:59.080 --> 05:04.200
We want to do the same thing, but also to 217.

99
05:04.200 --> 05:06.120
Once again, it's our first communication.

100
05:06.120 --> 05:14.260
So we have to accept the shot to 56 key, put in our password and it copies the

101
05:14.260 --> 05:14.320
file.

102
05:14.320 --> 05:19.610
Now of course, just having the certificate and having it copied to the other

103
05:19.610 --> 05:20.240
devices

104
05:20.240 --> 05:22.280
doesn't do us a lot of good.

105
05:22.280 --> 05:27.660
The next thing we have to do is actually install this root CA certificate on

106
05:27.660 --> 05:29.320
all the devices.

107
05:29.320 --> 05:32.040
So let's go ahead and do that next.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
05:29.320 --> 05:32.040
So let's go ahead and do that next.

108
05:32.040 --> 05:36.220
In order to do this, we actually have to exit out of V shell.

109
05:36.220 --> 05:42.680
This goes on the standard V managed CLI and the command is request.

110
05:42.680 --> 05:46.680
And there's a lot of different things we can do here, but the one we're looking

111
05:46.680 --> 05:47.240
for is

112
05:47.240 --> 05:49.880
the root cert chain.

113
05:49.880 --> 05:55.360
So we'll just say root cert chain and what we want to do is install it.

114
05:55.360 --> 05:58.480
And again, we already know where the file is located.

115
05:58.480 --> 06:05.400
It's under home, admin, and the file name is CA dot CRT.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
05:58.480 --> 06:05.400
It's under home, admin, and the file name is CA dot CRT.

116
06:05.400 --> 06:09.400
So we can see here it successfully installed the root chain.

117
06:09.400 --> 06:14.000
Now of course, we have to do this on V bond and be smart as well.

118
06:14.000 --> 06:16.920
So let's jump over to V bond.

119
06:16.920 --> 06:19.120
Of course, it's the exact same command.

120
06:19.120 --> 06:21.320
It should be in the exact same folder.

121
06:21.320 --> 06:23.800
If not, of course, we'll get an error.

122
06:23.800 --> 06:26.480
But as we can see, this was successful.

123
06:26.480 --> 06:30.770
And finally over here on V smart, we'll do the exact same thing installing the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
06:26.480 --> 06:30.770
And finally over here on V smart, we'll do the exact same thing installing the

124
06:30.770 --> 06:32.720
root certificate.

125
06:32.720 --> 06:38.400
Now the next thing we have to do is install this into V managed itself.

126
06:38.400 --> 06:41.160
And this one is a little bit trickier.

127
06:41.160 --> 06:45.370
The first thing we want to do is open the graphical interface and ensure that

128
06:45.370 --> 06:45.720
we are

129
06:45.720 --> 06:50.640
authenticated in Firefox to V managed.

130
06:50.640 --> 06:55.600
So the first thing we do is of course log in to the SD WAN interface.

131
06:55.600 --> 06:59.480
Then what we want to do is go to a very specific URL.

132
06:59.480 --> 07:03.480
I will put a generic version of this URL below this video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:59.480 --> 07:03.480
I will put a generic version of this URL below this video.

133
07:03.480 --> 07:07.560
However, what we're going to do is go to a specific URL.

134
07:07.560 --> 07:12.800
So we'll just open a new page here and we'll navigate to this URL.

135
07:12.800 --> 07:17.520
If this works correctly, we should see that it ran a JSON script.

136
07:17.520 --> 07:23.350
And in the output here, we should see that the sync root search chain is now

137
07:23.350 --> 07:23.760
done.

138
07:23.760 --> 07:25.880
So this worked correctly.

139
07:25.880 --> 07:30.750
So now we should have the certificate installed and we can now manage this in V
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
07:25.880 --> 07:30.750
So now we should have the certificate installed and we can now manage this in V

140
07:30.750 --> 07:31.600
managed.

141
07:31.600 --> 07:34.880
So let's go back to the normal V managed GUI.

142
07:34.880 --> 07:37.840
And here we can click on our hamburger menu.

143
07:37.840 --> 07:40.280
We can go to administration.

144
07:40.280 --> 07:43.080
We can go to root CA management.

145
07:43.080 --> 07:49.160
And here we see that our common name lab.local certificate has been installed.

146
07:49.160 --> 07:53.450
And we see all the different information that we put in there, such as the

147
07:53.450 --> 07:55.080
admin at lab.local,

148
07:55.080 --> 07:58.160
the CN is lab.local and so on.

149
07:58.160 --> 08:04.560
So we can see that it has in fact installed our certificate here as a root CA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:58.160 --> 08:04.560
So we can see that it has in fact installed our certificate here as a root CA.

150
08:04.560 --> 08:07.860
Now that that's complete, there's a few more settings we need to change to

151
08:07.860 --> 08:08.560
complete our

152
08:08.560 --> 08:10.240
environment.

153
08:10.240 --> 08:16.160
Once again, we click on the menu under administration settings this time.

154
08:16.160 --> 08:18.420
We need to change a few things.

155
08:18.420 --> 08:22.320
The first thing we want to change is the organization name.

156
08:22.320 --> 08:27.680
So this very top line where it says not configured, we're going to hit edit.

157
08:27.680 --> 08:32.800
And we're going to put in our organization name again, very important that this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
08:27.680 --> 08:32.800
And we're going to put in our organization name again, very important that this

158
08:32.800 --> 08:32.920
matches.

159
08:32.920 --> 08:39.640
So again, in our case, it's a and underscore SD dash when we will confirm that

160
08:39.640 --> 08:40.400
and we'll

161
08:40.400 --> 08:42.040
hit save.

162
08:42.040 --> 08:45.960
The next thing we want to configure is the V bond server.

163
08:45.960 --> 08:47.400
So this is the second line here.

164
08:47.400 --> 08:52.320
We'll go ahead and hit edit and we'll put in its address in my environment.

165
08:52.320 --> 08:56.360
This is 10 dot 100 dot 10 dot to 16.

166
08:56.360 --> 08:58.240
Then we'll save that.

167
08:58.240 --> 09:03.940
And the final thing we need to change is this controller certificate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
08:58.240 --> 09:03.940
And the final thing we need to change is this controller certificate

168
09:03.940 --> 09:05.600
authorization.

169
09:05.600 --> 09:08.680
So once again, we'll hit edit by default.

170
09:08.680 --> 09:14.360
You see that it's set to Cisco, which is of course their recommendation.

171
09:14.360 --> 09:20.120
In our case, we want to change this to use the enterprise root certificate.

172
09:20.120 --> 09:21.760
It says, are you sure you want to do this?

173
09:21.760 --> 09:24.120
We're going to say to proceed.

174
09:24.120 --> 09:27.040
And now it wants the certificate.

175
09:27.040 --> 09:28.520
Now there's two things we could do here.

176
09:28.520 --> 09:33.000
We could copy and paste or we see way over here on the right.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
09:28.520 --> 09:33.000
We could copy and paste or we see way over here on the right.

177
09:33.000 --> 09:35.560
There's a choice to select a file.

178
09:35.560 --> 09:39.280
Well, ultimately, we're going to need this certificate for a couple of

179
09:39.280 --> 09:40.320
different things.

180
09:40.320 --> 09:44.360
So it would probably make sense at this point to make a file.

181
09:44.360 --> 09:46.560
So here's what I would do.

182
09:46.560 --> 09:51.800
Let's go back over to V manage back here on V manage.

183
09:51.800 --> 09:55.360
Once again, let's go into V shell.

184
09:55.360 --> 09:58.240
Remember, this is where a certificate is.

185
09:58.240 --> 10:03.320
So let's just do a more on CA dot cert.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
09:58.240 --> 10:03.320
So let's just do a more on CA dot cert.

186
10:03.320 --> 10:08.600
And what we want to do is take this entire certificate and we're simply going

187
10:08.600 --> 10:10.040
to copy it.

188
10:10.040 --> 10:14.160
Then let's go over to something like notepad.

189
10:14.160 --> 10:17.480
I'm going to be using notepad plus plus personally.

190
10:17.480 --> 10:21.440
I've already created a file called CA dot cert.

191
10:21.440 --> 10:26.400
I have it in my downloads folder along with our Viptel file.

192
10:26.400 --> 10:28.800
That way everything's just together.

193
10:28.800 --> 10:32.220
But what we're going to do is we're going to paste this in and then we're going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
10:28.800 --> 10:32.220
But what we're going to do is we're going to paste this in and then we're going

194
10:32.220 --> 10:32.600
to save

195
10:32.600 --> 10:33.600
it.

196
10:33.600 --> 10:37.120
Again, if you made a new file, just save it as of course.

197
10:37.120 --> 10:40.320
So now we have this file called CA dot cert.

198
10:40.320 --> 10:43.080
And again, it's in my download folder.

199
10:43.080 --> 10:46.160
So now let's go back over to V manage.

200
10:46.160 --> 10:50.720
Now what we could do is simply just paste the certificate in here.

201
10:50.720 --> 10:54.880
Since we already have it in our clipboard or we could select the file that we

202
10:54.880 --> 10:55.720
just created

203
10:55.720 --> 10:57.920
off of our local desktop.

204
10:57.920 --> 11:01.470
Since it's already in the clipboard right now, I'll just go ahead and paste it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
10:57.920 --> 11:01.470
Since it's already in the clipboard right now, I'll just go ahead and paste it

205
11:01.470 --> 11:01.720
and then

206
11:01.720 --> 11:04.640
we'll say import and save.

207
11:04.640 --> 11:08.300
That'll take just a few moments and then it'll come back and we can see that

208
11:08.300 --> 11:08.720
now the

209
11:08.720 --> 11:14.640
controller certificate authorization is now set to enterprise.

210
11:14.640 --> 11:19.410
So that takes care of the fundamentals of getting our SD win environment up and

211
11:19.410 --> 11:19.760
ready

212
11:19.760 --> 11:21.200
to operate.

213
11:21.200 --> 11:23.880
And more importantly, we have everything up.

214
11:23.880 --> 11:25.480
Everything's reachable.

215
11:25.480 --> 11:28.120
We can get into our V manage interface.

216
11:28.120 --> 11:32.800
We have our certificate authority ready to issue and sign certificates.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

216
11:28.120 --> 11:32.800
We have our certificate authority ready to issue and sign certificates.

217
11:32.800 --> 11:38.480
And we have our initial configuration in the V manage graphical interface right

218
11:38.480 --> 11:39.160
here where

219
11:39.160 --> 11:43.530
we went ahead and configured things like our organizational name and our V bond

220
11:43.530 --> 11:44.080
address

221
11:44.080 --> 11:46.680
as well as our certificate authority.

222
11:46.680 --> 11:51.430
So that's what we need to cover in this skill that leaves us with nothing less

223
11:51.430 --> 11:52.080
than the

224
11:52.080 --> 11:55.400
challenge, which is exactly what we're going to do next.

225
11:55.400 --> 12:05.400
[BLANK_AUDIO]