WEBVTT 1 00:00.000 --> 00:08.270 So, before we can even think of pushing our device template down to our devices 2 00:08.270 --> 00:08.520 , we need 3 00:08.520 --> 00:14.500 to make sure that afterwards those devices will still be able to talk to VMan 4 00:14.500 --> 00:15.160 age. 5 00:15.160 --> 00:19.400 That of course means that we have to configure our VPN zero. 6 00:19.400 --> 00:22.160 And that's exactly what we're going to do in this video. 7 00:22.160 --> 00:25.000 Now, a couple things to keep in mind. 8 00:25.000 --> 00:31.480 First, we are using VLAN 100 for VPN zero in our environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:25.000 --> 00:31.480 First, we are using VLAN 100 for VPN zero in our environment. 9 00:31.480 --> 00:36.480 And that's being trunked to the router, which means we have to configure a sub- 10 00:36.480 --> 00:37.280 interface 11 00:37.280 --> 00:42.160 for VLAN 100 and put our IP address on that. 12 00:42.160 --> 00:45.640 Then of course, we have to configure it to support tunnels. 13 00:45.640 --> 00:49.770 And just in case we need it later, although we don't need it right now, we'll 14 00:49.770 --> 00:50.280 go ahead 15 00:50.280 --> 00:54.000 and enable OSPF on that interface as well. 16 00:54.000 --> 01:01.280 So let's go ahead and jump in and get started with configuration of VPN zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 16 00:54.000 --> 01:01.280 So let's go ahead and jump in and get started with configuration of VPN zero. 17 01:01.280 --> 01:04.160 So here we'll start off looking at our device template. 18 01:04.160 --> 01:08.080 Remember, we get here by going to configuration templates. 19 01:08.080 --> 01:12.950 Now to create our VPN zero template, we're going to want to edit this device 20 01:12.950 --> 01:13.880 template. 21 01:13.880 --> 01:18.960 So to edit this, we'll simply come over here to the action menu, choose edit. 22 01:18.960 --> 01:25.600 Then we'll scroll down to VPN zero and under VPN zero, we'll click on the drop 23 01:25.600 --> 01:26.040 down and 24 01:26.040 --> 01:28.520 we'll create a new template. 25 01:28.520 --> 01:32.760 We'll scroll back to the top for our template name. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 01:28.520 --> 01:32.760 We'll scroll back to the top for our template name. 26 01:32.760 --> 01:34.640 We'll make it VPN zero. 27 01:34.640 --> 01:38.920 We'll make the description VPN zero as well. 28 01:38.920 --> 01:45.380 Now notice, since we did this under the VPN zero section, notice that here 29 01:45.380 --> 01:46.600 under the VPN, 30 01:46.600 --> 01:49.880 it actually already has the number zero. 31 01:49.880 --> 01:54.800 When we get to creating service VPNs later, you'll see we have to fill this out 32 01:54.800 --> 01:54.920 . 33 01:54.920 --> 01:59.770 But since it knows that we did this under the VPN zero configuration, it just 34 01:59.770 --> 02:00.360 put this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 34 01:59.770 --> 02:00.360 put this 35 02:00.360 --> 02:02.520 in here already. 36 02:02.520 --> 02:05.920 So this is all we really need to configure in this part. 37 02:05.920 --> 02:08.040 Let's go ahead and hit save. 38 02:08.040 --> 02:11.160 But then we need to come back to VPN zero again. 39 02:11.160 --> 02:14.720 And now we're going to add an OSPF template. 40 02:14.720 --> 02:18.280 So over here on the left, let's choose our dropdown. 41 02:18.280 --> 02:22.640 We'll choose create template for the template name. 42 02:22.640 --> 02:26.040 We'll name this OSPF VPN zero. 43 02:26.040 --> 02:32.360 And for the description, we'll just do OSPF for VPN zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 43 02:26.040 --> 02:32.360 And for the description, we'll just do OSPF for VPN zero. 44 02:32.360 --> 02:36.110 Now there's clearly a lot of things here we can configure, but the one thing we 45 02:36.110 --> 02:36.280 have 46 02:36.280 --> 02:39.560 to configure is the area. 47 02:39.560 --> 02:43.060 Just as another quick note, one thing I've noticed does not work particularly 48 02:43.060 --> 02:43.560 well on 49 02:43.560 --> 02:48.060 this version of code is if you click on these headers, which is supposed to 50 02:48.060 --> 02:48.920 jump you down 51 02:48.920 --> 02:54.960 the page to those sections, this doesn't seem to work extremely well either. 52 02:54.960 --> 02:57.520 So we'll just have to scroll down. 53 02:57.520 --> 02:59.720 So we'll scroll down here to area. 54 02:59.720 --> 03:03.040 And what we want to do is configure a new area. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 54 02:59.720 --> 03:03.040 And what we want to do is configure a new area. 55 03:03.040 --> 03:06.080 So we'll say new area for the area number. 56 03:06.080 --> 03:08.480 This is going to be area zero. 57 03:08.480 --> 03:12.080 And if we want, we can change the area type here. 58 03:12.080 --> 03:14.280 We'll just set this to global for a moment. 59 03:14.280 --> 03:18.810 And you can see here that we can choose this can either be a stub or a not so 60 03:18.810 --> 03:20.600 stubby area, 61 03:20.600 --> 03:23.720 otherwise known as an NSSA. 62 03:23.720 --> 03:24.840 Now we're not going to change this. 63 03:24.840 --> 03:26.760 We're going to leave it as a normal area. 64 03:26.760 --> 03:29.800 So we'll just change this back to default. 65 03:29.800 --> 03:35.600 What we do need to do, however, is either add an interface or a range. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 65 03:29.800 --> 03:35.600 What we do need to do, however, is either add an interface or a range. 66 03:35.600 --> 03:40.300 Now these are two different ways of controlling which interfaces OSPF is going 67 03:40.300 --> 03:41.160 to be enabled 68 03:41.160 --> 03:47.320 on range allows you to put in a subnet range, essentially, and any interfaces 69 03:47.320 --> 03:47.960 within that 70 03:47.960 --> 03:51.320 range of addresses will then run OSPF. 71 03:51.320 --> 03:55.320 In a way, this is sort of the legacy way of configuring OSPF. 72 03:55.320 --> 03:59.580 The more modern and I would argue the better way because it gives you more 73 03:59.580 --> 04:00.440 control is to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 73 03:59.580 --> 04:00.440 control is to 74 04:00.440 --> 04:02.160 do it on the interface. 75 04:02.160 --> 04:05.000 So we're going to go ahead and add an interface here. 76 04:05.000 --> 04:09.360 We'll say add interface for the interface name. 77 04:09.360 --> 04:11.280 This is going to be gigabit ethernet. 78 04:11.280 --> 04:13.880 So you can just click on the gigabit part. 79 04:13.880 --> 04:19.080 Then this is going to be interface gigabit two and sub interface 100. 80 04:19.080 --> 04:23.400 Now it's true we haven't created that interface yet, but we will be. 81 04:23.400 --> 04:26.800 Let's also go ahead and tweak our hello and dead timers. 82 04:26.800 --> 04:30.120 So let's set our hello timer to one second. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 82 04:26.800 --> 04:30.120 So let's set our hello timer to one second. 83 04:30.120 --> 04:34.240 Let's set our dead timer to four seconds. 84 04:34.240 --> 04:37.640 And then let's go ahead and add this interface. 85 04:37.640 --> 04:40.780 Now something else that can be a little bit tricky here when you're dealing 86 04:40.780 --> 04:41.280 with this 87 04:41.280 --> 04:42.840 interface. 88 04:42.840 --> 04:45.560 So we now have our area number. 89 04:45.560 --> 04:47.440 We have our interface in here. 90 04:47.440 --> 04:52.670 This all looks good, but none of this applies until you actually come over here 91 04:52.670 --> 04:54.680 and hit add. 92 04:54.680 --> 04:59.000 When we hit this add, this is what it's supposed to look like. 93 04:59.000 --> 05:03.480 There's supposed to be a single line entry here for each area. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 04:59.000 --> 05:03.480 There's supposed to be a single line entry here for each area. 94 05:03.480 --> 05:08.510 Now of course we can under the action side over here, we can of course either 95 05:08.510 --> 05:09.120 edit or 96 05:09.120 --> 05:12.000 delete this area if we want to. 97 05:12.000 --> 05:14.720 However, this is what it should look like. 98 05:14.720 --> 05:18.160 So that completes our OSPF template. 99 05:18.160 --> 05:20.360 Let's go ahead and hit save. 100 05:20.360 --> 05:26.040 Then we have to configure our interface specifically that gigabit two dot 100. 101 05:26.040 --> 05:32.160 So now here under this Cisco VPN interface, we'll create a new template for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 101 05:26.040 --> 05:32.160 So now here under this Cisco VPN interface, we'll create a new template for the 102 05:32.160 --> 05:32.800 template 103 05:32.800 --> 05:34.360 name. 104 05:34.360 --> 05:39.000 We'll simply name it gigabit ethernet two dot 100 for the description. 105 05:39.000 --> 05:43.000 We'll simply say GE two dot 100 configuration. 106 05:43.000 --> 05:46.320 Now there are a couple of course important things we need to do here. 107 05:46.320 --> 05:51.960 First, like on most Cisco routers, we need to bring this interface up. 108 05:51.960 --> 05:56.660 It's a little bit grayed out right now, but notice under shutdown, it's 109 05:56.660 --> 05:57.720 currently set 110 05:57.720 --> 05:59.280 to yes. 111 05:59.280 --> 06:05.260 We need to change this, so we want to change this to a global setting and say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 111 05:59.280 --> 06:05.260 We need to change this, so we want to change this to a global setting and say 112 06:05.260 --> 06:05.640 no. 113 06:05.640 --> 06:10.200 That's of course the equivalent on the command line of doing a no shut. 114 06:10.200 --> 06:14.000 We also have to tell it what interface to use. 115 06:14.000 --> 06:17.120 Now of course, as we start typing, it'll give us the options. 116 06:17.120 --> 06:22.340 So you can either keep typing or you can just click on gigabit ethernet and 117 06:22.340 --> 06:23.120 then add the 118 06:23.120 --> 06:26.920 interface number in this case two dot 100. 119 06:26.920 --> 06:31.800 Now in this case, the description is optional, but it is best practice. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 06:26.920 --> 06:31.800 Now in this case, the description is optional, but it is best practice. 120 06:31.800 --> 06:35.040 So let's go ahead and give it a description. 121 06:35.040 --> 06:39.040 We'll simply call it the inside VPN zero interface. 122 06:39.040 --> 06:42.360 Now of course, an interface doesn't do as much good unless we configure a 123 06:42.360 --> 06:43.720 protocol on it. 124 06:43.720 --> 06:49.280 So if we scroll down a little bit further, we find the IPV for configuration. 125 06:49.280 --> 06:53.440 Now like most routers, we're going to want this to have a static address. 126 06:53.440 --> 06:58.910 So we'll leave this set to static, but for the address, we do need to give it 127 06:58.910 --> 07:00.120 an address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 06:58.910 --> 07:00.120 an address. 128 07:00.120 --> 07:03.910 So what we want to do is click on this drop down and we're going to set this to 129 07:03.910 --> 07:04.440 device 130 07:04.440 --> 07:06.240 specific. 131 07:06.240 --> 07:09.840 Now when we set it to device specific, it's going to make this key. 132 07:09.840 --> 07:15.940 The current key is set to VPN underscore IF underscore IPV for underscore 133 07:15.940 --> 07:17.000 address. 134 07:17.000 --> 07:20.360 Now it may not make sense right now. 135 07:20.360 --> 07:26.340 But when we go to deploy this onto our devices, it's going to make us fill in 136 07:26.340 --> 07:27.280 any fields that 137 07:27.280 --> 07:29.920 are set to device specific. 138 07:29.920 --> 07:34.970 We're going to have multiple interfaces that are going to have IP addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 138 07:29.920 --> 07:34.970 We're going to have multiple interfaces that are going to have IP addresses 139 07:34.970 --> 07:35.800 that are device 140 07:35.800 --> 07:37.280 specific. 141 07:37.280 --> 07:42.680 I can't end up with a bunch of keys at the end that all have the same name. 142 07:42.680 --> 07:47.000 So we need to change this key to something to make it unique. 143 07:47.000 --> 07:53.090 What I usually do is right here, I do another underscore and I say something 144 07:53.090 --> 07:55.240 like GE 2.100. 145 07:55.240 --> 07:59.560 I simply insert the name of the interface into the key. 146 07:59.560 --> 08:01.920 And you can get rid of the rest of this if you wanted to. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 146 07:59.560 --> 08:01.920 And you can get rid of the rest of this if you wanted to. 147 08:01.920 --> 08:03.280 You don't need the rest of the key. 148 08:03.280 --> 08:07.240 You can make it whatever you like, but that's just what I normally do. 149 08:07.240 --> 08:11.520 Then what you do is you move your mouse back over and you choose device 150 08:11.520 --> 08:12.480 specific. 151 08:12.480 --> 08:16.980 And you can see that it's set to device specific and it has that key out to the 152 08:16.980 --> 08:17.720 right over 153 08:17.720 --> 08:18.960 here. 154 08:18.960 --> 08:24.070 The next thing we have to do since this is going to be our VPN zero interface, 155 08:24.070 --> 08:24.560 we need 156 08:24.560 --> 08:29.600 to come down here and tell it that it's going to be a tunnel interface. 157 08:29.600 --> 08:31.800 Notice again, the default is off. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 08:29.600 --> 08:31.800 Notice again, the default is off. 158 08:31.800 --> 08:34.020 We want to turn this on. 159 08:34.020 --> 08:38.800 This is the interface that it's going to be talking to SD way across. 160 08:38.800 --> 08:43.770 So notice that most of the things listed here now have to do with SD WAN 161 08:43.770 --> 08:45.240 specifically, things 162 08:45.240 --> 08:48.160 like the color, the groups, the border. 163 08:48.160 --> 08:50.860 We're not going to change any of these at the moment. 164 08:50.860 --> 08:53.240 We simply need it to be a tunnel. 165 08:53.240 --> 08:56.360 The rest of the defaults are going to be fine for now. 166 08:56.360 --> 09:00.860 The other thing we may want to do and again, this would mostly be because it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 166 08:56.360 --> 09:00.860 The other thing we may want to do and again, this would mostly be because it's 167 09:00.860 --> 09:02.200 a lab environment. 168 09:02.200 --> 09:07.910 But if we scroll down a little bit further, our VPN zero interface, as you can 169 09:07.910 --> 09:08.500 see, only 170 09:08.500 --> 09:10.960 allows certain things by default. 171 09:10.960 --> 09:13.820 I mean, move my mouse out of the way. 172 09:13.820 --> 09:20.990 We can see here that the only things that are on by default are DHCP DNS, ICMP 173 09:20.990 --> 09:22.640 and HTTPS. 174 09:22.640 --> 09:29.780 SSH is an enabled OSPF is an enabled, which we're actually trying to run. 175 09:29.780 --> 09:36.100 So what you could do is just enable the things that you need this being a lab. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 175 09:29.780 --> 09:36.100 So what you could do is just enable the things that you need this being a lab. 176 09:36.100 --> 09:40.600 And we're not trying to focus right now on only allowing the things we need. 177 09:40.600 --> 09:44.280 What I'm going to do is just up here on the allow all. 178 09:44.280 --> 09:47.380 I'm just going to globally turn this on. 179 09:47.380 --> 09:51.810 Now again, I wouldn't recommend this in a production environment, but here in 180 09:51.810 --> 09:52.460 the lab, 181 09:52.460 --> 09:55.540 this is going to be perfectly fine in a production environment. 182 09:55.540 --> 10:00.090 You of course normally only want to allow the traffic you actually need, but WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 182 09:55.540 --> 10:00.090 You of course normally only want to allow the traffic you actually need, but 183 10:00.090 --> 10:00.540 that takes 184 10:00.540 --> 10:03.460 care of everything we need to configure for this template. 185 10:03.460 --> 10:05.680 So let's go ahead and hit save. 186 10:05.680 --> 10:10.310 We can scroll back up to VPN zero and just verify that it has the three 187 10:10.310 --> 10:11.440 components we 188 10:11.440 --> 10:12.440 need. 189 10:12.440 --> 10:15.280 It has the overall VPN zero template. 190 10:15.280 --> 10:21.050 We have our template for OSPF and we have our template for our sub interface, 191 10:21.050 --> 10:21.800 gigabit 192 10:21.800 --> 10:26.860 2.100 to be a tunnel to support SD WAN. 193 10:26.860 --> 10:30.210 And one other thing to note, just look over here on the right and look at all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 193 10:26.860 --> 10:30.210 And one other thing to note, just look over here on the right and look at all 194 10:30.210 --> 10:30.620 of these 195 10:30.620 --> 10:35.860 other things that you can add to your VPN zero templates. 196 10:35.860 --> 10:41.700 So if we wanted BGP, or we wanted to create a GRE or an IPsec interface, all of 197 10:41.700 --> 10:42.140 these 198 10:42.140 --> 10:46.900 are other templates that we could add here to VPN zero. 199 10:46.900 --> 10:50.140 But for now, that's all we need to configure in our device template. 200 10:50.140 --> 10:52.640 So let's go ahead and hit update. 201 10:52.640 --> 10:55.160 It'll update the device template. 202 10:55.160 --> 10:58.520 And now we're back to the device template screen. 203 10:58.520 --> 11:03.660 One other final note here, we still don't have any devices attached. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 203 10:58.520 --> 11:03.660 One other final note here, we still don't have any devices attached. 204 11:03.660 --> 11:08.000 We haven't attached our devices yet because the templates not ready. 205 11:08.000 --> 11:12.460 Theoretically, it could be ready now that we've configured VPN zero, but let's 206 11:12.460 --> 11:13.000 go ahead 207 11:13.000 --> 11:17.720 and configure our out of band management first, then we'll apply it. 208 11:17.720 --> 11:23.970 If this was applied to devices, when we hit that update on that last screen, 209 11:23.970 --> 11:24.380 then it 210 11:24.380 --> 11:28.140 would have actually pushed it out to those devices. 211 11:28.140 --> 11:35.020 So in this video, we simply configured our VPN zero and the interface for VPN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 211 11:28.140 --> 11:35.020 So in this video, we simply configured our VPN zero and the interface for VPN 212 11:35.020 --> 11:35.900 zero with 213 11:35.900 --> 11:39.380 OSPF in our device template. 214 11:39.380 --> 11:44.290 Now, theoretically, our device template could be applied at this point since 215 11:44.290 --> 11:45.140 VPN zero, which 216 11:45.140 --> 11:50.520 would allow connectivity back to the SD-WAN environment is configured. 217 11:50.520 --> 11:55.880 But just to make sure, let's configure our VPN 512 before we push this template 218 11:55.880 --> 11:56.120 out to 219 11:56.120 --> 11:57.520 our devices. 220 11:57.520 --> 12:00.080 That's exactly what we're going to do in the next video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 220 11:57.520 --> 12:00.080 That's exactly what we're going to do in the next video.