WEBVTT

1
00:00.000 --> 00:04.570
So for our game plan for the IPsec site site VPN, one of the things I noticed

2
00:04.570 --> 00:09.310
is that if we have two gateways inside of NSX, for example, one at site one and

3
00:09.310 --> 00:12.990
one at site two, and we use a lot of the defaults, it's just going to work a

4
00:12.990 --> 00:17.000
lot of the times right out of the box because of all the defaults that are in

5
00:17.000 --> 00:17.000
place.

6
00:17.000 --> 00:19.000
So I thought to mix it up just a little bit.

7
00:19.000 --> 00:20.000
We're going to build for our demo.

8
00:20.000 --> 00:24.150
We're going to build an IPsec site site tunnel between a tier zero gateway as

9
00:24.150 --> 00:27.000
part of NSX and an external third party router.

10
00:27.000 --> 00:31.000
Because that way we'll have to be very specific about what we choose to use,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.000 --> 00:31.000
Because that way we'll have to be very specific about what we choose to use,

11
00:31.000 --> 00:34.000
then make sure it matches over here at the external router.

12
00:34.000 --> 00:35.000
So we're going to have an initial tunnel.

13
00:35.000 --> 00:36.000
That's our control tunnel.

14
00:36.000 --> 00:40.070
So in IKEA version one, that'd be called the IKEA phase one tunnel and IKEA

15
00:40.070 --> 00:42.000
version two, this is simply called the IKEA tunnel.

16
00:42.000 --> 00:45.540
Think of it again, like the control tunnel between the gateway here on the left

17
00:45.540 --> 00:47.000
and the router on the right.

18
00:47.000 --> 00:50.000
And then we're also going to need the details for the actual IPsec tunnel,

19
00:50.000 --> 00:52.000
which I will put in this pink color here.

20
00:52.000 --> 00:54.000
And I'll call that tunnel B.

21
00:54.000 --> 00:56.000
And that is the IPsec tunnel.

22
00:56.000 --> 00:59.670
Also in our previous topologies, I was sitting this up, getting ready for a

23
00:59.670 --> 01:04.000
demo and I realized, oh no, I've got a limited export version of NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.670 --> 01:04.000
demo and I realized, oh no, I've got a limited export version of NSX.

24
01:04.000 --> 01:07.000
And as a result, you can't set up the IPsec.

25
01:07.000 --> 01:10.470
So I rebuilt a new topology and that's what we're going to be using for this

26
01:10.470 --> 01:11.000
demo.

27
01:11.000 --> 01:16.000
So as part of NSX, I've got a tier zero gateway right here and I have it in red

28
01:16.000 --> 01:21.000
because it's my lab three red to help keep my labs different from each other.

29
01:21.000 --> 01:25.000
And we're going to be working with the T zero gateway and for connectivity,

30
01:25.000 --> 01:28.700
instead of using the real public internet, I'm going to go ahead and just use a

31
01:28.700 --> 01:33.000
VLAN that's in my networked environment for the connectivity back and forth
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:28.700 --> 01:33.000
VLAN that's in my networked environment for the connectivity back and forth

32
01:33.000 --> 01:37.000
between the T zero gateway over here and the Cisco router over here.

33
01:37.000 --> 01:41.770
And if we're setting up a IPsec tunnel between two NSX gateways, for example,

34
01:41.770 --> 01:45.360
one at site one and one on site two, oftentimes we can use a lot of the

35
01:45.360 --> 01:46.000
defaults.

36
01:46.000 --> 01:49.840
So for the demo, by setting up an IPsec tunnel between a tier zero gateway and

37
01:49.840 --> 01:54.630
a third party device, it's going to give us the opportunity to be very granular

38
01:54.630 --> 01:59.520
and intentional on what we're using for the initial like tunnel and also for

39
01:59.520 --> 02:00.000
the IPsec tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
02:00.000 --> 02:03.880
So for the glue that's going to tie it all together, I'm going to be using VLAN

41
02:03.880 --> 02:08.250
78 in my lab topology, and that's the addressing space of 7800 with the 24 bit

42
02:08.250 --> 02:09.000
mask.

43
02:09.000 --> 02:13.080
And then over here at tier zero will set up edge one with dot 61 edge to a

44
02:13.080 --> 02:17.780
thought 62 and a virtual IP address of dot 60 here at the T zero as it connects

45
02:17.780 --> 02:20.000
to that external network segment.

46
02:20.000 --> 02:24.020
That'll also be a great refresher on setting up external connectivity for a T

47
02:24.020 --> 02:28.640
zero gateway. And then over here on the right hand side I've got a Cisco router

48
02:28.640 --> 02:32.000
that I will logically place on the 78 VLAN as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:28.640 --> 02:32.000
that I will logically place on the 78 VLAN as well.

49
02:32.000 --> 02:35.730
And it'll have the IP address ending in dot 10. So the two endpoints of the

50
02:35.730 --> 02:39.470
tunnel don't have to be on the same subnet. But for convenience in my lab, I'm

51
02:39.470 --> 02:42.000
going to put them on the same subnet subnet 7800.

52
02:42.000 --> 02:46.130
In a production environment, if we're using the internet, these need to be two

53
02:46.130 --> 02:49.000
reachable IP addresses over the public internet.

54
02:49.000 --> 02:53.110
And for the demonstration, let's do policy based IP [garbled] tunnels where we

55
02:53.110 --> 02:57.160
specify exactly which subnets we want to encrypt and ship over the IP [garbled]

56
02:57.160 --> 02:58.000
tunnel.

57
02:58.000 --> 03:02.610
So the two subnets are going to be the 1033 zero over here off the tier zero
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:58.000 --> 03:02.610
So the two subnets are going to be the 1033 zero over here off the tier zero

58
03:02.610 --> 03:07.000
gateway and the 1080 network over here off of the Cisco router.

59
03:07.000 --> 03:11.480
Now, as far as the initial tunnel, let me go ahead and make a note here for

60
03:11.480 --> 03:16.000
tunnel a, which is our control tunnel. Let's use Ike version one.

61
03:16.000 --> 03:20.090
And if that's the case, this is also now called the Ike phase one tunnel. And

62
03:20.090 --> 03:22.780
as far as how we want to configure it, let's go ahead and write the word haggle

63
03:22.780 --> 03:25.000
out and let's fill in the blanks for hashing.

64
03:25.000 --> 03:30.230
Let's use Shaw 256. So there's not a default profile that has that for Ike. We
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:25.000 --> 03:30.230
Let's use Shaw 256. So there's not a default profile that has that for Ike. We

65
03:30.230 --> 03:34.000
'll go ahead and configure that here at the T zero gateway.

66
03:34.000 --> 03:37.100
We'll also do a similar configuration over here at the Cisco router for the

67
03:37.100 --> 03:40.000
authentication. Let's use a pre shared key.

68
03:40.000 --> 03:44.410
And for that key, let's go and use the key of Cisco exclamation mark two, three

69
03:44.410 --> 03:48.630
, and we'll set that same pre shared key on both sides to be used as part of the

70
03:48.630 --> 03:50.000
authentication.

71
03:50.000 --> 03:53.560
And then for the Diffie Hellman, let's use Diffie Hellman group 14. So as long

72
03:53.560 --> 03:57.470
as it's compatible and supported on both sides, Diffie Hellman group 14 should

73
03:57.470 --> 04:02.000
work great for the establishment of shared secret key material that they can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:57.470 --> 04:02.000
work great for the establishment of shared secret key material that they can

74
04:02.000 --> 04:04.000
then use with the encryption algorithm.

75
04:04.000 --> 04:07.920
For the encryption algorithm, let's use a yes, 128 on both sides. And then for

76
04:07.920 --> 04:11.720
the lifetime, let's go ahead and take whatever the default is. And that's one

77
04:11.720 --> 04:15.000
of those properties where it doesn't have to match identically on both sides.

78
04:15.000 --> 04:19.240
They'll adjust to whichever side has the lowest value, presuming all the other

79
04:19.240 --> 04:23.170
parameters are matched up, meaning that they agree on the hashing and the

80
04:23.170 --> 04:27.000
authentication and the Diffie Hellman group and the encryption.

81
04:27.000 --> 04:31.340
And then let's put it a line between the Ike tunnel here and the IP sectional
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
04:27.000 --> 04:31.340
And then let's put it a line between the Ike tunnel here and the IP sectional

82
04:31.340 --> 04:38.000
below. So for IP sec, which is our tunnel B for encryption. Let's use a es 128.

83
04:38.000 --> 04:41.900
So the encryption for the IP sectional does not have to be the same as the

84
04:41.900 --> 04:46.070
initial Ike tunnel. However, in my lab environment, I want to use a very light

85
04:46.070 --> 04:47.000
encryption.

86
04:47.000 --> 04:50.220
And that way, if he starts saying lots and lots of traffic, it won't take a

87
04:50.220 --> 04:53.000
bunch of CPU. And then for the hashing on the IP sec tunnel.

88
04:53.000 --> 04:58.240
Let's go ahead and I'll see you shop 256. Now the benefit of that also the lab,

89
04:58.240 --> 05:02.840
if we match the hashing and the encryption is that it's easier to remember in a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:58.240 --> 05:02.840
if we match the hashing and the encryption is that it's easier to remember in a

90
05:02.840 --> 05:05.000
lab environment, because there are a few parameters.

91
05:05.000 --> 05:09.000
If we get just one of them off on either side, it'll cause the IP sec tunnel to

92
05:09.000 --> 05:13.920
not function. And for the lifetime, let's use the default and also for PFS list

93
05:13.920 --> 05:15.000
not to use PFS.

94
05:15.000 --> 05:18.720
So I'll just specify over here on the T zero side, no perfect forward secrecy

95
05:18.720 --> 05:22.760
for the IP sec tunnel. And over here at the Cisco router, I'll go ahead and

96
05:22.760 --> 05:24.000
also leave off PFS.

97
05:24.000 --> 05:28.140
All right, so let me check my notes here. I'll quick. We have the IP addresses

98
05:28.140 --> 05:33.000
we're going to be pairing with 780060 over here and 780010 over here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:28.140 --> 05:33.000
we're going to be pairing with 780060 over here and 780010 over here.

99
05:33.000 --> 05:37.440
We have our two subnets that we want to protect. So for our game plan, I think

100
05:37.440 --> 05:40.910
we have a pretty good start. So in the next video, let's begin our

101
05:40.910 --> 05:44.000
configuration for starting off at the tier zero gateway.

102
05:44.000 --> 05:47.400
Gateway in NSX.