WEBVTT 1 00:00.000 --> 00:09.200 So the first thing we want to do in this scale is to add our V bond and our V 2 00:09.200 --> 00:10.760 smart controller 3 00:10.760 --> 00:12.960 into V manage. 4 00:12.960 --> 00:19.150 And part of that process is going to also be to issue valid client certificates 5 00:19.150 --> 00:19.720 , not 6 00:19.720 --> 00:25.560 just to the V bond and the V smart, but V manage needs one as well. 7 00:25.560 --> 00:30.540 Just because V manage is the root certificate authority doesn't mean that it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 7 00:25.560 --> 00:30.540 Just because V manage is the root certificate authority doesn't mean that it 8 00:30.540 --> 00:31.160 doesn't still 9 00:31.160 --> 00:35.520 need a client certificate in the SD WAN environment. 10 00:35.520 --> 00:40.240 So we'll be copying those certificates back and forth between our devices. 11 00:40.240 --> 00:46.210 So as we jump into this, it would be a really good idea if you have some form 12 00:46.210 --> 00:47.920 of an SCP client 13 00:47.920 --> 00:53.800 installed on your PC or Mac as you're jumping in to this scale. 14 00:53.800 --> 01:00.230 Personally, I use secure CRT, but there are of course many other both command WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 14 00:53.800 --> 01:00.230 Personally, I use secure CRT, but there are of course many other both command 15 01:00.230 --> 01:01.040 line and 16 01:01.040 --> 01:07.120 graphical SCP programs available for all of your different platforms. 17 01:07.120 --> 01:14.090 So let's go ahead and jump in and get started by adding our devices into the 18 01:14.090 --> 01:15.200 manage. 19 01:15.200 --> 01:21.480 So starting from our SD WAN dashboard, let's go to our SD WAN menu. 20 01:21.480 --> 01:25.720 We'll choose configuration devices. 21 01:25.720 --> 01:30.000 Then here on the devices page, we will choose controllers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 01:30.000 --> 01:35.680 As we can see, the V manage controller is already in place and we can see 23 01:35.680 --> 01:36.760 things such 24 01:36.760 --> 01:43.420 as its host name, its system IP address, the site ID that it belongs to, we see 25 01:43.420 --> 01:43.920 that 26 01:43.920 --> 01:46.280 it's in sync and so on. 27 01:46.280 --> 01:50.320 So we have some good information here listed about this existing controller. 28 01:50.320 --> 01:53.880 But now we need to add our V bond server. 29 01:53.880 --> 01:56.520 So let's go down here to add controller. 30 01:56.520 --> 02:02.720 We will choose V bond and we need to put in the V bond servers information. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:56.520 --> 02:02.720 We will choose V bond and we need to put in the V bond servers information. 31 02:02.720 --> 02:07.280 So first this address is 10.100.10.216. 32 02:07.280 --> 02:12.520 The username to log in is admin and we'll put in our password. 33 02:12.520 --> 02:18.160 At this point, it generally seems to work better if you turn off the generate 34 02:18.160 --> 02:19.080 CSR here. 35 02:19.080 --> 02:23.000 We'll do the certificate request in a little bit. 36 02:23.000 --> 02:27.450 So let's go ahead and hit add and we can see that it added the V bond 37 02:27.450 --> 02:28.600 controller to our 38 02:28.600 --> 02:30.000 list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 02:30.000 --> 02:34.590 Also note that at this moment, there's not a whole lot of information here on 40 02:34.590 --> 02:35.280 the V bond 41 02:35.280 --> 02:40.240 controller because it hasn't actually communicated with it yet. 42 02:40.240 --> 02:46.800 While we're waiting, let's go ahead and add our V smart controller. 43 02:46.800 --> 02:52.200 Its address is 10.100.10.217. 44 02:52.200 --> 02:54.440 Username again is admin. 45 02:54.440 --> 02:56.720 We'll put in our password. 46 02:56.720 --> 03:00.740 We'll leave the default protocol because that's what we're using and we'll turn WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 02:56.720 --> 03:00.740 We'll leave the default protocol because that's what we're using and we'll turn 47 03:00.740 --> 03:01.600 off the generate 48 03:01.600 --> 03:03.340 CSR. 49 03:03.340 --> 03:07.640 We can see that V smart has now been added to our list. 50 03:07.640 --> 03:12.280 So now that we've added the controllers, it's time to generate the certificates 51 03:12.280 --> 03:12.280 . 52 03:12.280 --> 03:17.960 So let's go over to our menu, under configuration and we'll choose certificates 53 03:17.960 --> 03:18.120 . 54 03:18.120 --> 03:22.080 Once again, we'll choose controllers off of this top menu. 55 03:22.080 --> 03:26.920 Now we have our controllers listed here and notice at the moment, they all say 56 03:26.920 --> 03:27.960 no certificate 57 03:27.960 --> 03:29.320 installed. 58 03:29.320 --> 03:32.520 So what we need to do is generate the CSR. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 03:29.320 --> 03:32.520 So what we need to do is generate the CSR. 59 03:32.520 --> 03:34.520 So we'll go over here, we'll just go in order. 60 03:34.520 --> 03:36.120 So we'll start with our V bond server. 61 03:36.120 --> 03:42.240 We'll go over to this extended menu and we will say to generate a CSR. 62 03:42.240 --> 03:44.720 Once this is done, we'll say download. 63 03:44.720 --> 03:47.640 It will save it to our downloads folder. 64 03:47.640 --> 03:52.090 And then if we go look at our download folder, what we'll see here is that it 65 03:52.090 --> 03:52.920 did not name 66 03:52.920 --> 03:54.680 it appropriately. 67 03:54.680 --> 03:58.690 It simply named it undefined because it hasn't actually pulled that device's 68 03:58.690 --> 04:00.080 host name. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 03:58.690 --> 04:00.080 host name. 69 04:00.080 --> 04:04.830 So what we should do here, it's of course not required, but we should rename it 70 04:04.830 --> 04:04.840 so 71 04:04.840 --> 04:08.320 that we have the correct name and we know which certificate goes with which 72 04:08.320 --> 04:08.840 device. 73 04:08.840 --> 04:14.070 So let's go back to be managed, we'll close this, then we'll click on this for 74 04:14.070 --> 04:15.160 be managed. 75 04:15.160 --> 04:19.440 Once again, generate the CSR, download it. 76 04:19.440 --> 04:21.960 Now this one, it knew the host name. 77 04:21.960 --> 04:26.820 So if we look at our downloads folder, notice this one, it named correctly 78 04:26.820 --> 04:27.720 because again, 79 04:27.720 --> 04:29.920 it knows the host name. 80 04:29.920 --> 04:38.960 So let's finally do this for our vSmart controller. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 04:29.920 --> 04:38.960 So let's finally do this for our vSmart controller. 81 04:38.960 --> 04:42.160 And once again, we'll go rename it. 82 04:42.160 --> 04:46.600 Remember that we renamed this to vSmart one in our previous skill. 83 04:46.600 --> 04:49.840 So now we have all of our CSR's created. 84 04:49.840 --> 04:55.270 The next step is going to be to upload these to our certificate authority, 85 04:55.270 --> 04:56.360 which in this 86 04:56.360 --> 04:58.880 case is the manage. 87 04:58.880 --> 05:02.760 So this is where we're going to use our command line utility here on the PC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 04:58.880 --> 05:02.760 So this is where we're going to use our command line utility here on the PC. 88 05:02.760 --> 05:07.680 I'm going to be using Microsoft PowerShell with secure CRT. 89 05:07.680 --> 05:11.000 So this of course is going to start in my home folder. 90 05:11.000 --> 05:14.880 We need to see the into downloads. 91 05:14.880 --> 05:21.920 If we do a DIR, here we see this is where the certificate request files are for 92 05:21.920 --> 05:22.640 VBond, 93 05:22.640 --> 05:25.800 VManage and VSmart one. 94 05:25.800 --> 05:31.040 However, VManage still needs a client certificate, even though it's the root WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 94 05:25.800 --> 05:31.040 However, VManage still needs a client certificate, even though it's the root 95 05:31.040 --> 05:32.080 authority. 96 05:32.080 --> 05:36.240 So let's copy all three of these to the VManage server. 97 05:36.240 --> 05:40.360 So we'll do scp, we'll start with VManage. 98 05:40.360 --> 05:46.320 We're going to copy that to the management address of VManage. 99 05:46.320 --> 05:48.800 We'll copy that to the root folder. 100 05:48.800 --> 05:52.440 We'll say yes, we accept the fingerprint for the password. 101 05:52.440 --> 05:56.640 We put in our password and it copies the file. 102 05:56.640 --> 06:03.920 Now we need to do the exact same command for VBond and for VSmart one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 102 05:56.640 --> 06:03.920 Now we need to do the exact same command for VBond and for VSmart one. 103 06:03.920 --> 06:08.570 Once all of these files are up there, now we have to connect over to VManage to 104 06:08.570 --> 06:09.280 actually 105 06:09.280 --> 06:11.520 issue the client certificates. 106 06:11.520 --> 06:17.360 So here on VManage, let's go into VShell, let's do an LS. 107 06:17.360 --> 06:23.900 And here we can see that we have our three CSR files from VBond, VManage and V 108 06:23.900 --> 06:25.040 Smart one. 109 06:25.040 --> 06:29.600 So the next thing we need to do is actually issue these certificates. 110 06:29.600 --> 06:35.280 So this is going to be open SSL for an X509 certificate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 110 06:29.600 --> 06:35.280 So this is going to be open SSL for an X509 certificate. 111 06:35.280 --> 06:44.720 We're putting in a request and the input file is going to be VManage.CSR. 112 06:44.720 --> 06:48.880 With a certificate authority, we're going to use CA.CRT. 113 06:48.880 --> 06:54.240 So we're signing it with our own certificate for the CA key. 114 06:54.240 --> 06:57.000 We attach our private key file. 115 06:57.000 --> 07:02.740 We'll also do a CA create serial and then we'll put in our output file is going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 06:57.000 --> 07:02.740 We'll also do a CA create serial and then we'll put in our output file is going 116 07:02.740 --> 07:03.120 to be 117 07:03.120 --> 07:06.240 VManage.CRT. 118 07:06.240 --> 07:12.280 We'll set our days to 365 and we'll sign it with SHA256. 119 07:12.280 --> 07:14.000 We'll hit enter. 120 07:14.000 --> 07:15.200 Let's verify that it worked. 121 07:15.200 --> 07:21.560 Let's do an LS and we see here that we now have our VManage.CRT. 122 07:21.560 --> 07:25.480 So let's do the same thing for the other requests. 123 07:25.480 --> 07:26.880 So we'll just hit up. 124 07:26.880 --> 07:30.180 We will have to change of course a few things on here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 124 07:26.880 --> 07:30.180 We will have to change of course a few things on here. 125 07:30.180 --> 07:36.160 The output here will be VBond and the request VBond. 126 07:36.160 --> 07:39.720 Other than that, it should be the same. 127 07:39.720 --> 07:45.760 And one last time, VSmart1 and VSmart1. 128 07:45.760 --> 07:48.360 Once again, just to verify, we'll do an LS. 129 07:48.360 --> 07:56.160 And what we see is we have the VBond CRT, the VManage CRT and the VSmart1 CRT. 130 07:56.160 --> 08:01.680 So now what we want to do is copy these files back to our PC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 130 07:56.160 --> 08:01.680 So now what we want to do is copy these files back to our PC. 131 08:01.680 --> 08:04.760 So let's go back to our PowerShell. 132 08:04.760 --> 08:08.640 This time we're doing SCP but we're doing it the other direction. 133 08:08.640 --> 08:16.800 So now it's going to be admin at 192.168.2.215 colon and the file we want to 134 08:16.800 --> 08:19.120 copy, VManage.CRT 135 08:19.120 --> 08:23.760 and we want to copy it to dot which is our current folder. 136 08:23.760 --> 08:29.000 So we should hit enter, put in our password, copies the file. 137 08:29.000 --> 08:34.650 We can do a DIR to make sure and we can see that we do in fact have the VManage WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 137 08:29.000 --> 08:34.650 We can do a DIR to make sure and we can see that we do in fact have the VManage 138 08:34.650 --> 08:35.640 .CRT. 139 08:35.640 --> 08:39.240 Now of course we do the same thing for the other two files. 140 08:39.240 --> 08:45.200 So we'll simply change this to VBond and VSmart1. 141 08:45.200 --> 08:48.920 So now I have these certificates back on my PC. 142 08:48.920 --> 08:53.720 So now that the files are on our PC, let's go back to VManage. 143 08:53.720 --> 08:58.840 So now what we want to do is go over here to the far right and click on install 144 08:58.840 --> 09:00.120 certificate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 144 08:58.840 --> 09:00.120 certificate. 145 09:00.120 --> 09:04.780 When we do this we'll choose select a file and we'll start right here by 146 09:04.780 --> 09:07.960 choosing VManage.CRT, 147 09:07.960 --> 09:11.440 hit open and we hit install. 148 09:11.440 --> 09:13.120 This will take just a couple seconds. 149 09:13.120 --> 09:15.920 We'll wait for the status to go to success. 150 09:15.920 --> 09:20.440 So now that the status is success we can simply hit back in our browser and 151 09:20.440 --> 09:21.320 install the next 152 09:21.320 --> 09:23.080 certificate. 153 09:23.080 --> 09:25.240 Next we'll do VBond. 154 09:25.240 --> 09:28.640 We'll hit open, install. 155 09:28.640 --> 09:30.680 We'll give it just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 155 09:28.640 --> 09:30.680 We'll give it just a moment. 156 09:30.680 --> 09:38.440 Once we have success we'll go back, install certificate and finally we'll do V 157 09:38.440 --> 09:39.880 Smart1. 158 09:39.880 --> 09:42.640 Once we have our success we go back. 159 09:42.640 --> 09:47.600 Notice that now on our list all of our certificates have expiration dates and 160 09:47.600 --> 09:49.040 we have certificate 161 09:49.040 --> 09:52.620 serial numbers for each device. 162 09:52.620 --> 09:56.560 We can also verify this if we go back to our main menu. 163 09:56.560 --> 10:01.960 After configuration we go to devices and back to controllers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 163 09:56.560 --> 10:01.960 After configuration we go to devices and back to controllers. 164 10:01.960 --> 10:05.400 We can expand this column a little bit so we can see what that says. 165 10:05.400 --> 10:10.560 Notice that under certificate status here they are all installed. 166 10:10.560 --> 10:15.350 So now we have our certificates installed on all of our devices signed by our 167 10:15.350 --> 10:16.240 certificate 168 10:16.240 --> 10:18.280 authority. 169 10:18.280 --> 10:23.320 So now that we've added our controllers and we have certificates signed and 170 10:23.320 --> 10:23.960 issued to 171 10:23.960 --> 10:30.330 all three of our controllers, next up is going to be to take our VPN zero and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 10:23.960 --> 10:30.330 all three of our controllers, next up is going to be to take our VPN zero and 172 10:30.330 --> 10:31.320 actually convert 173 10:31.320 --> 10:36.990 that to a tunnel interface because now we have the certificates to do the 174 10:36.990 --> 10:38.480 authentication. 175 10:38.480 --> 10:40.920 So let's go ahead and do that in the next video.