WEBVTT

1
00:00.000 --> 00:07.370
So now that we have IP reachability between our devices, the next step of

2
00:07.370 --> 00:13.360
course is to add our different controllers and our validator to the SD WAN

3
00:13.360 --> 00:14.000
manager.

4
00:14.000 --> 00:18.000
Now in order to do that, we are going to need client certificates.

5
00:18.000 --> 00:22.000
So a few things about certificates as we jump in here.

6
00:22.000 --> 00:27.000
First, we have to have all our devices trust the root certificate authority.

7
00:27.000 --> 00:32.220
In order to do that, we are going to configure a root certificate authority on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:27.000 --> 00:32.220
In order to do that, we are going to configure a root certificate authority on

8
00:32.220 --> 00:37.470
our manager server and we are going to configure that as a trusted root on all

9
00:37.470 --> 00:39.000
of the other devices.

10
00:39.000 --> 00:44.820
Now that is something that we have done in a previous skill and nothing about

11
00:44.820 --> 00:48.000
that changes on this version of code.

12
00:48.000 --> 00:53.710
Therefore, we are not going to review that in this video. The reference for

13
00:53.710 --> 00:57.000
that video is in the text above this video.

14
00:57.000 --> 01:01.000
So if you do need to go back and review that, please do so.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:57.000 --> 01:01.000
So if you do need to go back and review that, please do so.

15
01:01.000 --> 01:06.000
But understand that the root certificates have already been issued off camera.

16
01:06.000 --> 01:10.000
In this video, we are going to issue the client certificates.

17
01:10.000 --> 01:13.000
Now we have done this before as well.

18
01:13.000 --> 01:17.000
However, it does change slightly in this version of code.

19
01:17.000 --> 01:21.620
So I'm going to go through it on just one device, but understand that while I'm

20
01:21.620 --> 01:27.150
showing that one device, I've configured it for all of our devices as we move

21
01:27.150 --> 01:28.000
through.

22
01:28.000 --> 01:33.840
So let's go ahead and jump in and get started getting all of these devices
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
01:28.000 --> 01:33.840
So let's go ahead and jump in and get started getting all of these devices

23
01:33.840 --> 01:37.000
connected in to our SD WAN manager.

24
01:37.000 --> 01:41.340
So before we can really start configuring our certificates and adding our

25
01:41.340 --> 01:46.230
devices, there are a few things we have to configure here on SD WAN manager

26
01:46.230 --> 01:47.000
itself.

27
01:47.000 --> 01:52.770
So the first thing we want to do is go down here to administration, go to

28
01:52.770 --> 01:58.000
settings, then on the settings menu, let's scroll down to system.

29
01:58.000 --> 02:02.480
And the first thing we want to do is go to organization name and put in our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:58.000 --> 02:02.480
And the first thing we want to do is go to organization name and put in our

30
02:02.480 --> 02:04.000
organization name.

31
02:04.000 --> 02:08.000
Again, this needs to be the same name that you've used everywhere else.

32
02:08.000 --> 02:09.000
We'll hit save.

33
02:09.000 --> 02:14.000
It wants us to verify our password and we'll hit OK.

34
02:14.000 --> 02:16.000
So that was successful.

35
02:16.000 --> 02:20.910
Next, we need to click on validator right below organization name and put in

36
02:20.910 --> 02:24.000
the address of our validator.

37
02:24.000 --> 02:29.000
In our environment, it's 10 dot 100 dot 10 dot 216.

38
02:29.000 --> 02:33.000
We'll leave the default port number and we'll hit save.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
02:29.000 --> 02:33.000
We'll leave the default port number and we'll hit save.

39
02:33.000 --> 02:35.000
Once again, that's successful.

40
02:35.000 --> 02:39.760
Next, we need to come down here under trust and privacy and go to the

41
02:39.760 --> 02:43.000
controller certificate authorization.

42
02:43.000 --> 02:49.000
Here, what we want to do is change this to enterprise root certificate.

43
02:49.000 --> 02:51.000
We'll say proceed.

44
02:51.000 --> 02:56.420
And here we need to put in the text for the certificate that we created during

45
02:56.420 --> 02:59.000
the root certificate creation process.

46
02:59.000 --> 03:03.000
You can either select a file or put the text in directly.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:59.000 --> 03:03.000
You can either select a file or put the text in directly.

47
03:03.000 --> 03:08.000
I actually have the text in my clipboard, so I'll just paste it in.

48
03:08.000 --> 03:10.000
And I'll hit import and save.

49
03:10.000 --> 03:15.900
Now that that's successful, now we can start adding our devices into SD WAN

50
03:15.900 --> 03:17.000
manager.

51
03:17.000 --> 03:20.000
So now we want to go to configuration.

52
03:20.000 --> 03:25.000
We'll go to devices and we'll click control components.

53
03:25.000 --> 03:28.000
Here, we'll start by adding our validator.

54
03:28.000 --> 03:34.000
The validator's address is 10 dot 100 dot 10 dot 216.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
03:28.000 --> 03:34.000
The validator's address is 10 dot 100 dot 10 dot 216.

55
03:34.000 --> 03:39.500
We'll put in our credentials and for the generate CSR, we'll leave this no for

56
03:39.500 --> 03:40.000
now.

57
03:40.000 --> 03:42.000
We'll generate those in a moment.

58
03:42.000 --> 03:47.550
We'll hit add and we'll do the same thing to add our two controllers, except of

59
03:47.550 --> 03:50.000
course, we'll hit add controller.

60
03:50.000 --> 03:52.000
Our first one is 217.

61
03:52.000 --> 03:56.810
The protocol in port, we can leave their defaults and again, we will not

62
03:56.810 --> 03:58.000
generate the CSR.

63
03:58.000 --> 04:01.000
And then we'll add our second controller.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
03:58.000 --> 04:01.000
And then we'll add our second controller.

64
04:01.000 --> 04:07.000
So now we have our V bond, our V manage, and both of our V smarts.

65
04:07.000 --> 04:09.000
Here on our list of control components.

66
04:09.000 --> 04:14.680
And of course, notice for the controller type Cisco is still referring to these

67
04:14.680 --> 04:18.000
at least right now by their older names.

68
04:18.000 --> 04:23.000
But what we need to do is create the certificate request for each one of these.

69
04:23.000 --> 04:26.000
So now let's go over to configuration.

70
04:26.000 --> 04:30.000
We'll go to certificates, control components.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
04:30.000 --> 04:35.000
Then on our action menu, we'll choose to generate a CSR.

72
04:35.000 --> 04:39.000
We'll say yes, it'll generate the CSR.

73
04:39.000 --> 04:41.000
We'll simply say to download it.

74
04:41.000 --> 04:43.000
It'll download the file.

75
04:43.000 --> 04:49.100
And just so we know which file is for which device will rename these as needed

76
04:49.100 --> 04:51.000
as we download them.

77
04:51.000 --> 04:55.540
So we'll just rename this file to validator one, and then we'll do the exact

78
04:55.540 --> 04:58.000
same thing for the other three devices.

79
04:58.000 --> 05:02.000
So now you can see we have all four devices downloaded here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
04:58.000 --> 05:02.000
So now you can see we have all four devices downloaded here.

80
05:02.000 --> 05:07.000
Next thing we have to do is upload these to our certificate authority.

81
05:07.000 --> 05:13.000
So to upload these, we will use scp. So I'm just going to use PowerShell.

82
05:13.000 --> 05:18.000
So if we look at PowerShell here, we have all four of our files as we should.

83
05:18.000 --> 05:21.000
Let's upload those to our server.

84
05:21.000 --> 05:24.000
We'll accept the fingerprint and we'll put in our password.

85
05:24.000 --> 05:29.730
So there we go. Just like that, we have all four files copied up to our manage

86
05:29.730 --> 05:31.000
one server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
05:29.730 --> 05:31.000
one server.

87
05:31.000 --> 05:35.000
Now let's jump into the console and issue the client certificates.

88
05:35.000 --> 05:39.000
So here on manager one, we'll go into V show.

89
05:39.000 --> 05:45.000
If we do an LS, we can see the four certificate requests that we just uploaded.

90
05:45.000 --> 05:50.000
So now we'll just issue our certificates based on these requests.

91
05:50.000 --> 05:55.780
So here's the command to use open SSL to issue an X 509 certificate based on

92
05:55.780 --> 05:58.000
the certificate request.

93
05:58.000 --> 06:02.530
Of course, there's a few things you could change here, such as the number of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
05:58.000 --> 06:02.530
Of course, there's a few things you could change here, such as the number of

94
06:02.530 --> 06:04.000
days it's valid for.

95
06:04.000 --> 06:08.000
Generally speaking, this will be fine for generating our certificate.

96
06:08.000 --> 06:11.000
We'll do this for all four files.

97
06:11.000 --> 06:15.510
We'll do our LS again and we can see here that now we have all four

98
06:15.510 --> 06:17.000
certificates.

99
06:17.000 --> 06:21.000
Now all we have to do is copy those back to our PC.

100
06:21.000 --> 06:24.000
So let's go back to PowerShell.

101
06:24.000 --> 06:29.000
And here in PowerShell, we'll simply copy the files back to this device.

102
06:29.000 --> 06:33.520
So now that the copies are done, we can look at our directory and see all the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
06:29.000 --> 06:33.520
So now that the copies are done, we can look at our directory and see all the

103
06:33.520 --> 06:36.000
files or we can get a little more specific.

104
06:36.000 --> 06:40.340
And if we look at our directory of just the dot CRTs, we see that we have all

105
06:40.340 --> 06:43.000
four CRT files here on the workstation.

106
06:43.000 --> 06:49.000
So now we can go back and upload these into SD WAN manager.

107
06:49.000 --> 06:54.600
So back here in SD WAN manager, all we have to do is come down here to install

108
06:54.600 --> 06:56.000
certificate.

109
06:56.000 --> 07:01.810
We'll select files and then out of our downloads folder, we'll simply choose
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
06:56.000 --> 07:01.810
We'll select files and then out of our downloads folder, we'll simply choose

110
07:01.810 --> 07:04.000
each of the CRT files.

111
07:04.000 --> 07:07.000
We'll hit open, install.

112
07:07.000 --> 07:10.000
This will take just a couple seconds.

113
07:10.000 --> 07:15.000
Once it's successful here, we'll just hit back in the browser.

114
07:15.000 --> 07:19.080
And we can see here that our first device actually has the certificate

115
07:19.080 --> 07:20.000
installed.

116
07:20.000 --> 07:24.000
Now let's do the same for the other three certificates.

117
07:24.000 --> 07:29.000
So now as you can see, we have all four certificates installed.

118
07:29.000 --> 07:36.700
Now let's verify by going back over to configuration, devices, control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
07:29.000 --> 07:36.700
Now let's verify by going back over to configuration, devices, control

119
07:36.700 --> 07:38.000
components.

120
07:38.000 --> 07:43.000
Now one interesting thing is a certificate status is not shown here by default.

121
07:43.000 --> 07:47.840
However, if we click on this little gear over here, we can actually choose to

122
07:47.840 --> 07:52.000
turn on certificate status, hit apply.

123
07:52.000 --> 07:57.000
And now we have a column here for certificate status and notice that they all

124
07:57.000 --> 07:58.000
say installed.

125
07:58.000 --> 08:04.000
We're not quite done though because the device status is not in sync.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
07:58.000 --> 08:04.000
We're not quite done though because the device status is not in sync.

126
08:04.000 --> 08:09.000
And that's because our VPN zero is not yet tunneling.

127
08:09.000 --> 08:15.000
So now we have to go to each of our devices and turn on tunneling for VPN zero.

128
08:15.000 --> 08:21.230
Now to configure VPN zero, manager one, controller one and controller two are

129
08:21.230 --> 08:25.000
exactly the same validated one is slightly different.

130
08:25.000 --> 08:28.000
So let's take care of our three devices first.

131
08:28.000 --> 08:34.120
All we have to do here is going to configuration mode VPN zero for the ethernet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
08:28.000 --> 08:34.120
All we have to do here is going to configuration mode VPN zero for the ethernet

132
08:34.120 --> 08:37.000
zero interface and just say tunnel interface.

133
08:37.000 --> 08:40.000
Then we do our commit and quit.

134
08:40.000 --> 08:42.000
We'll do the same thing for our controllers.

135
08:42.000 --> 08:48.230
So that takes care of controller one, controller two, and now over to the valid

136
08:48.230 --> 08:49.000
ator.

137
08:49.000 --> 08:51.000
The validator is slightly different.

138
08:51.000 --> 08:56.670
Of course, the interface is different because it's gigabit zero zero, and you

139
08:56.670 --> 09:00.000
have to say encapsulation IP sec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
09:00.000 --> 09:03.000
But other than that, it's pretty much the same configuration.

141
09:03.000 --> 09:09.000
Once all this is done, now let's go back over to SD WAN manager.

142
09:09.000 --> 09:13.800
So if we give this just a second and then hit refresh over here on the top

143
09:13.800 --> 09:15.000
right corner.

144
09:15.000 --> 09:20.000
We can see that now all of our devices are in sync.

145
09:20.000 --> 09:25.000
We can also verify this by going to monitor overview.

146
09:25.000 --> 09:31.160
And we should now see that we have one validator two controllers and one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
09:25.000 --> 09:31.160
And we should now see that we have one validator two controllers and one

147
09:31.160 --> 09:34.000
manager in our environment.

148
09:34.000 --> 09:38.000
So everything is up and running as it should be.

149
09:38.000 --> 09:44.950
So in this video, we got our validator and our controllers connected into SD W

150
09:44.950 --> 09:46.000
AN manager.

151
09:46.000 --> 09:52.700
And we got the client certificates issued for all four devices, including SD W

152
09:52.700 --> 09:55.000
AN manager itself.

153
09:55.000 --> 09:59.020
Because even though it is the certificate authority, well, it does still need a

154
09:59.020 --> 10:00.000
client certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
10:00.000 --> 10:05.770
So now that all of these are communicating properly, our VPN zero is converted

156
10:05.770 --> 10:08.000
to a tunnel as it should be.

157
10:08.000 --> 10:13.000
Our final step is going to be to bring in the SD WAN edges.

158
10:13.000 --> 10:17.000
So let's go ahead and jump into that in the next video.