WEBVTT

1
00:00.000 --> 00:08.440
So, before we can even think of pushing our device template down to our devices

2
00:08.440 --> 00:08.680
, we need

3
00:08.680 --> 00:14.650
to make sure that afterwards those devices will still be able to talk to VMan

4
00:14.650 --> 00:15.300
age.

5
00:15.300 --> 00:19.560
That of course means that we have to configure our VPN zero.

6
00:19.560 --> 00:22.440
And that's exactly what we're going to do in this video.

7
00:22.440 --> 00:25.280
Now, a couple things to keep in mind.

8
00:25.280 --> 00:31.640
First, we are using VLAN 100 for VPN zero in our environment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:25.280 --> 00:31.640
First, we are using VLAN 100 for VPN zero in our environment.

9
00:31.640 --> 00:36.640
And that's being trunked to the router, which means we have to configure a sub-

10
00:36.640 --> 00:37.440
interface

11
00:37.440 --> 00:42.320
for VLAN 100 and put our IP address on that.

12
00:42.320 --> 00:45.800
Then of course, we have to configure it to support tunnels.

13
00:45.800 --> 00:49.930
And just in case we need it later, although we don't need it right now, we'll

14
00:49.930 --> 00:50.440
go ahead

15
00:50.440 --> 00:54.160
and enable OSPF on that interface as well.

16
00:54.160 --> 01:01.760
So let's go ahead and jump in to get started with configuration of VPN zero.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:54.160 --> 01:01.760
So let's go ahead and jump in to get started with configuration of VPN zero.

17
01:01.760 --> 01:07.040
So starting off here on our templates page, let's go ahead and edit our current

18
01:07.040 --> 01:07.600
device

19
01:07.600 --> 01:09.360
template.

20
01:09.360 --> 01:15.100
We'll scroll down to our VPN zero section and under VPN zero, we'll click on

21
01:15.100 --> 01:16.680
the dropdown

22
01:16.680 --> 01:19.280
and we'll create a new template.

23
01:19.280 --> 01:24.200
For our template name, I'm simply going to call this VPN underscore zero.

24
01:24.200 --> 01:28.160
For the description, we'll also make this VPN zero.

25
01:28.160 --> 01:31.240
And then we begin our overall configuration.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
01:28.160 --> 01:31.240
And then we begin our overall configuration.

26
01:31.240 --> 01:35.200
So the first thing, of course, is that the VPN should be set to zero, which we

27
01:35.200 --> 01:35.600
can see

28
01:35.600 --> 01:37.800
here that it already is.

29
01:37.800 --> 01:42.270
And if we scroll down over the rest of the things we can configure, such as DNS

30
01:42.270 --> 01:43.560
, advertising,

31
01:43.560 --> 01:50.250
OMP, putting in an IPV for route, an IPV six route, setting up services and

32
01:50.250 --> 01:52.040
service routes,

33
01:52.040 --> 01:58.440
GRE routes, IP sec routes, configuring that or route leaking.

34
01:58.440 --> 02:02.860
These are not things we need to configure right now, just to get this up and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:58.440 --> 02:02.860
These are not things we need to configure right now, just to get this up and

35
02:02.860 --> 02:03.120
running.

36
02:03.120 --> 02:06.200
So all we really need to do is create this general template.

37
02:06.200 --> 02:10.120
Let's go ahead and hit save, scroll down again.

38
02:10.120 --> 02:15.750
And now what we want to do is start configuring the other things that we need

39
02:15.750 --> 02:17.040
under VPN zero.

40
02:17.040 --> 02:23.250
So over here, under additional Cisco VPN zero templates, we actually want to

41
02:23.250 --> 02:23.880
add a Cisco

42
02:23.880 --> 02:26.520
OSPF template.

43
02:26.520 --> 02:29.360
Then we're going to choose our template.

44
02:29.360 --> 02:32.880
And of course, there aren't any, we'll have to hit create.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:29.360 --> 02:32.880
And of course, there aren't any, we'll have to hit create.

45
02:32.880 --> 02:38.010
So for our OSPF template name, since we're going to do this differently for

46
02:38.010 --> 02:38.860
different

47
02:38.860 --> 02:42.720
VPNs, we're not going to use the same template name.

48
02:42.720 --> 02:47.460
This will be OSPF for VPN zero.

49
02:47.460 --> 02:54.120
And that's exactly what we'll set the description to OSPF for VPN zero.

50
02:54.120 --> 02:59.350
Now one of the main things we're going to have to do is come down here to area,

51
02:59.350 --> 02:59.660
click

52
02:59.660 --> 03:01.900
on new area.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:59.660 --> 03:01.900
on new area.

53
03:01.900 --> 03:04.980
We're going to simply configure this as area zero.

54
03:04.980 --> 03:08.340
So this will be a global setting area zero.

55
03:08.340 --> 03:12.280
If we wanted, we can set the area type here.

56
03:12.280 --> 03:18.140
So if I change this to global, we could choose either a stub or a not so stubby

57
03:18.140 --> 03:20.260
or NSSA area,

58
03:20.260 --> 03:22.860
but we want this to be a normal area.

59
03:22.860 --> 03:24.740
So we're actually not going to change this.

60
03:24.740 --> 03:27.220
We'll leave this at the default.

61
03:27.220 --> 03:30.820
But what we do want to do is add an interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
03:27.220 --> 03:30.820
But what we do want to do is add an interface.

62
03:30.820 --> 03:35.060
So let's click on add interface, add interface.

63
03:35.060 --> 03:41.780
The interface name is going to be gigabit ethernet 2.100.

64
03:41.780 --> 03:45.860
And while we're here, let's go ahead and change the hello interval.

65
03:45.860 --> 03:49.780
So we'll globally set the hello to one second.

66
03:49.780 --> 03:54.020
We'll set the dead interval to four seconds.

67
03:54.020 --> 03:58.200
And then since there's only going to be two devices on this subnet, let's go to

68
03:58.200 --> 03:58.820
advanced

69
03:58.820 --> 04:06.100
options and under the OSPF network type, let's change this to point to point.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:58.820 --> 04:06.100
options and under the OSPF network type, let's change this to point to point.

70
04:06.100 --> 04:08.260
We'll go ahead and hit add.

71
04:08.260 --> 04:12.180
And we can see under interface, it now has one interface.

72
04:12.180 --> 04:17.820
Then we have to hit add again to add the overall area with its interface.

73
04:17.820 --> 04:19.460
So we hit add.

74
04:19.460 --> 04:25.380
And then we can see here under area that it just adds this one line adding OSPF

75
04:25.380 --> 04:27.300
area zero.

76
04:27.300 --> 04:30.100
So we need to configure in here for right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
04:27.300 --> 04:30.100
So we need to configure in here for right now.

77
04:30.100 --> 04:35.380
So let's go ahead and hit save, scroll back down to our VPN zero.

78
04:35.380 --> 04:41.220
And the next thing we want to do is configure our Cisco VPN interface ethernet.

79
04:41.220 --> 04:45.860
Now notice it has already added one of these to the section.

80
04:45.860 --> 04:48.260
So we can simply edit the one that's here.

81
04:48.260 --> 04:50.340
We'll click on the dropdown.

82
04:50.340 --> 04:52.740
We'll create a new template for this.

83
04:52.740 --> 04:57.340
And this is going to be the template for the gigabit 2.100 interface.

84
04:57.340 --> 05:02.660
So for the template name, I'm just going to name it after the interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:57.340 --> 05:02.660
So for the template name, I'm just going to name it after the interface.

85
05:02.660 --> 05:07.140
So for the template, we'll just call it gigabit ethernet 2.100.

86
05:07.140 --> 05:13.780
For the description, we could just say something like GE 2.100 configuration.

87
05:13.780 --> 05:16.860
And then let's take a look at the things we need to change.

88
05:16.860 --> 05:19.460
First thing we have to do is bring the interface up.

89
05:19.460 --> 05:24.900
So we're going to change shutdown to global and say no.

90
05:24.900 --> 05:28.180
That's the equivalent of doing a no shut on the interface.

91
05:28.180 --> 05:32.640
The next thing we have to do is give it an actual interface name gigabit ether
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:28.180 --> 05:32.640
The next thing we have to do is give it an actual interface name gigabit ether

92
05:32.640 --> 05:34.940
net 2.100.

93
05:34.940 --> 05:38.860
This has to match what's physically on the device.

94
05:38.860 --> 05:43.130
The template name of course could have been anything, but this has to actually

95
05:43.130 --> 05:43.620
match the

96
05:43.620 --> 05:47.660
interface that either we're using or that we want created.

97
05:47.660 --> 05:51.620
In this case, of course, we're creating the sub interface.

98
05:51.620 --> 05:57.970
And by the way, whatever sub interface we put on here, in this case, dot 100 SD

99
05:57.970 --> 05:58.260
when

100
05:58.260 --> 06:03.820
will automatically make that a VLAN encapsulation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:58.260 --> 06:03.820
will automatically make that a VLAN encapsulation.

101
06:03.820 --> 06:09.860
So we will automatically do the dot 1Q 100 on that interface.

102
06:09.860 --> 06:13.620
Next we could set a description if we want, we will.

103
06:13.620 --> 06:20.100
Let's call this the inside VPN zero interface.

104
06:20.100 --> 06:23.500
Next let's scroll down to our addressing.

105
06:23.500 --> 06:27.720
So we can see that by default, this is set to static, which means we are going

106
06:27.720 --> 06:28.220
to have

107
06:28.220 --> 06:30.460
to provide an IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
06:28.220 --> 06:30.460
to provide an IP address.

108
06:30.460 --> 06:33.540
Now again, we can't really do this globally.

109
06:33.540 --> 06:37.340
We're going to apply this to router one and router two.

110
06:37.340 --> 06:41.660
And each one of those are going to need a separate IP address.

111
06:41.660 --> 06:46.070
So in this case, we're going to go to device specific and we can see here it's

112
06:46.070 --> 06:47.020
automatically

113
06:47.020 --> 06:49.940
going to put in a key name.

114
06:49.940 --> 06:53.430
But the problem is when we go to fill these in later, we really going to need

115
06:53.430 --> 06:54.180
to know what

116
06:54.180 --> 06:55.980
interface it's for.

117
06:55.980 --> 07:00.260
So we're probably going to want to change this default key name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
06:55.980 --> 07:00.260
So we're probably going to want to change this default key name.

118
07:00.260 --> 07:07.460
So I would just put G two dot 100 underscore for gigabit ethernet two dot 100.

119
07:07.460 --> 07:11.180
That way we know which address we're filling in later.

120
07:11.180 --> 07:15.370
And we just click on device specific and we can see over here to the right, it

121
07:15.370 --> 07:15.900
's telling

122
07:15.900 --> 07:19.900
us what that key name is going to be.

123
07:19.900 --> 07:25.400
The other thing we need to do since this is for VPN zero down here under tunnel

124
07:25.400 --> 07:26.860
interface,

125
07:26.860 --> 07:30.260
globally, we want to turn this on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
07:26.860 --> 07:30.260
globally, we want to turn this on.

126
07:30.260 --> 07:33.560
If we scroll down a little bit more, we can see that it puts a lot of different

127
07:33.560 --> 07:33.980
things

128
07:33.980 --> 07:34.980
in here.

129
07:34.980 --> 07:36.380
We can then configure.

130
07:36.380 --> 07:39.420
These are all okay as their defaults.

131
07:39.420 --> 07:43.160
But if we scroll down here to the allow services, we can see that this is

132
07:43.160 --> 07:44.380
essentially like an

133
07:44.380 --> 07:50.390
ACL where we can choose which services are allowed or not allowed on this

134
07:50.390 --> 07:51.660
interface.

135
07:51.660 --> 07:56.340
Since our main focus here is not security, but just getting things working for

136
07:56.340 --> 07:56.940
the sake

137
07:56.940 --> 08:02.610
of our lab, we'll go ahead and change the global setting on this first one to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
07:56.940 --> 08:02.610
of our lab, we'll go ahead and change the global setting on this first one to

138
08:02.610 --> 08:03.460
just allow

139
08:03.460 --> 08:04.460
all.

140
08:04.460 --> 08:08.900
Obviously, in production, you would want to only allow the services that you

141
08:08.900 --> 08:09.820
need here,

142
08:09.820 --> 08:15.140
but we're not interested in getting that specific for the lab environment.

143
08:15.140 --> 08:17.780
This is all we really need to change here.

144
08:17.780 --> 08:23.420
So let's go ahead and hit save, scroll back down to VPN zero.

145
08:23.420 --> 08:29.460
Notice that we now have our Cisco VPN zero template, our OSPF VPN zero template

146
08:29.460 --> 08:30.500
configured
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
08:29.460 --> 08:30.500
configured

147
08:30.500 --> 08:36.060
and our Cisco VPN interface for gigabit 2.100.

148
08:36.060 --> 08:38.540
So now let's go ahead and hit update.

149
08:38.540 --> 08:41.500
That'll save those changes to the template.

150
08:41.500 --> 08:44.840
Also if we go over here to feature templates now, we can see that those

151
08:44.840 --> 08:45.740
templates we just

152
08:45.740 --> 08:52.650
created VPN zero OSPF VPN zero and gigabit ethernet 2.100 have been added to

153
08:52.650 --> 08:53.740
the feature

154
08:53.740 --> 08:55.340
templates.

155
08:55.340 --> 08:59.110
And just so you know how you would do it, if your choice is to create the

156
08:59.110 --> 09:00.180
feature templates
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
08:59.110 --> 09:00.180
feature templates

157
09:00.180 --> 09:04.500
first and then go add them to the device template, you can, like I mentioned

158
09:04.500 --> 09:05.300
before,

159
09:05.300 --> 09:08.660
add them here, you can just click add template.

160
09:08.660 --> 09:11.980
You choose the device that you want to add it for.

161
09:11.980 --> 09:15.340
So we would choose Cisco 8000 V here.

162
09:15.340 --> 09:19.940
And then over on the right, it gives us all the different types of templates.

163
09:19.940 --> 09:24.300
And of course, we would just click on the type that we wanted to create.

164
09:24.300 --> 09:29.800
So again, you can do it either way, I personally prefer just to create them on

165
09:29.800 --> 09:30.740
the fly from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
09:29.800 --> 09:30.740
the fly from

166
09:30.740 --> 09:32.100
the device template.

167
09:32.100 --> 09:36.540
But if you prefer to come here to do it, you can certainly do that as well.

168
09:36.540 --> 09:42.340
So now we have our device template updated for VPN zero.

169
09:42.340 --> 09:47.440
Now since we have VPN zero configured, we could theoretically push this out to

170
09:47.440 --> 09:48.280
the devices

171
09:48.280 --> 09:49.660
at this point.

172
09:49.660 --> 09:55.520
So let's go ahead and set up our VPN 512 first for our out of band management

173
09:55.520 --> 09:55.980
before we go

174
09:55.980 --> 09:58.180
pushing out the configuration.

175
09:58.180 --> 10:00.340
So let's configure that in the next video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
09:58.180 --> 10:00.340
So let's configure that in the next video.

176
10:00.340 --> 10:10.340
[BLANK_AUDIO]