WEBVTT

1
00:00.000 --> 00:02.920
So now with our basic connectivity at the T0 set,

2
00:02.920 --> 00:05.080
so we have connectivity to the 78 network,

3
00:05.080 --> 00:08.240
let's spend a moment here at the Cisco router and make sure

4
00:08.240 --> 00:10.320
its configs are good to go as well.

5
00:10.320 --> 00:12.640
So here is that external Cisco router.

6
00:12.640 --> 00:15.750
Let me just do a couple of quick checks to verify what it currently has in

7
00:15.750 --> 00:15.960
place.

8
00:15.960 --> 00:18.320
Let's do a show IP interface brief.

9
00:18.320 --> 00:20.080
Just take a look at what IP addresses it has.

10
00:20.080 --> 00:23.640
So here is the interface connected to VLAN78.

11
00:23.640 --> 00:26.120
It has the IP address of 780010.

12
00:26.120 --> 00:28.000
So right from here is the basic check,

13
00:28.000 --> 00:31.120
we can do a ping to 78.0.60.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.000 --> 00:31.120
we can do a ping to 78.0.60.

14
00:31.120 --> 00:34.440
That's the virtual IP address at the T0 gateway.

15
00:34.440 --> 00:37.680
That's a very good sign just to make sure we're on the same layer 2 broadcast

16
00:37.680 --> 00:38.080
domain

17
00:38.080 --> 00:40.480
with compatible IP addressing based on our plan.

18
00:40.480 --> 00:43.320
So to expedite the process here on the Cisco router,

19
00:43.320 --> 00:45.040
if you need more training on Cisco,

20
00:45.040 --> 00:48.320
please check out our other courses and skills at CBT Nuggets.

21
00:48.320 --> 00:52.120
But for now, let me go ahead and share with you what I'm going to put in,

22
00:52.120 --> 00:54.240
and then we'll take a look at some of the highlights.

23
00:54.240 --> 00:56.600
To do that, I am going to cut and paste.

24
00:56.600 --> 01:00.720
I'm using secure CRT, so it's going to give me an option of checking out all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:56.600 --> 01:00.720
I'm using secure CRT, so it's going to give me an option of checking out all

25
01:00.720 --> 01:01.120
the commands

26
01:01.120 --> 01:02.120
we're about to paste in.

27
01:02.120 --> 01:03.000
And here they are.

28
01:03.000 --> 01:04.840
So here are some highlights.

29
01:04.840 --> 01:09.310
I'm making a loopback interface just so we have some reachable target on this

30
01:09.310 --> 01:10.000
Cisco router.

31
01:10.000 --> 01:14.600
So it'll have an IP address of 10, 8, 0, 10 on a loopback interface.

32
01:14.600 --> 01:18.560
And then I'll represent a reachable device here on this 10, 8, 0 network.

33
01:18.560 --> 01:20.960
So for the loopback interface is 10, 8, 0, 10.

34
01:20.960 --> 01:25.520
And then here I'm setting up the details for effectively the control tunnel

35
01:25.520 --> 01:27.080
for IP sec.

36
01:27.080 --> 01:29.000
So I'm going to be using Ike version one.

37
01:29.000 --> 01:32.480
And as a result, this is also called the Ike phase one tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.000 --> 01:32.480
And as a result, this is also called the Ike phase one tunnel.

38
01:32.480 --> 01:37.640
And there is our encryption that we want to negotiate using AES 128.

39
01:37.640 --> 01:40.240
Here's our hashing of shop 256.

40
01:40.240 --> 01:42.760
This specifies we want to use a pre shared key.

41
01:42.760 --> 01:45.320
This specifies when I use Diffie Helma group 14.

42
01:45.320 --> 01:49.670
And this specifies for a lifetime that we want to use one day, which is 86,400

43
01:49.670 --> 01:50.080
seconds.

44
01:50.080 --> 01:52.400
And then assuming we negotiate that OK,

45
01:52.400 --> 01:55.760
here is the key that I'm willing to use with another peer.

46
01:55.760 --> 01:57.320
So this is a wild card.

47
01:57.320 --> 02:02.240
So effectively this device, this router will use this pre shared key with any
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.320 --> 02:02.240
So effectively this device, this router will use this pre shared key with any

48
02:02.240 --> 02:02.920
other device

49
02:02.920 --> 02:05.400
during Ike phase one who negotiates with it.

50
02:05.400 --> 02:09.080
So we'll make sure when we configure the tier zero gateway and NSX,

51
02:09.080 --> 02:10.680
we'll use that same pre shared key.

52
02:10.680 --> 02:15.680
And then here I add the details for on the Cisco side, our IP sec tunnel using

53
02:15.680 --> 02:17.080
AES 128

54
02:17.080 --> 02:18.760
and shop 256.

55
02:18.760 --> 02:21.520
And then here's how I'm specifying the interesting traffic.

56
02:21.520 --> 02:24.640
So from the router's perspective, we want to encrypt traffic.

57
02:24.640 --> 02:28.880
If it's coming from the 1080 network going to the 1033 zero network.

58
02:28.880 --> 02:32.080
So to help reinforce what that looks like, we're telling this router right here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:28.880 --> 02:32.080
So to help reinforce what that looks like, we're telling this router right here

59
02:32.080 --> 02:32.080
,

60
02:32.080 --> 02:34.280
the traffic from 1080 anything.

61
02:34.280 --> 02:39.040
If it's destined for 1033 zero, that's effectively the policy that it should

62
02:39.040 --> 02:39.480
use

63
02:39.480 --> 02:44.040
to send that traffic over the IP sec tunnel encrypted, where the receiver,

64
02:44.040 --> 02:47.960
the T zero gateway can decrypt it, and then continue forwarding it down to the

65
02:47.960 --> 02:48.000
VM.

66
02:48.000 --> 02:50.840
And then with like phase one, I'm going to be using this crypto map

67
02:50.840 --> 02:52.400
to link everything together.

68
02:52.400 --> 02:55.120
So our crypto map is saying, if the traffic matches that pattern,

69
02:55.120 --> 03:00.360
1080 going to 1033 zero from the router's perspective, go ahead and set your
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:55.120 --> 03:00.360
1080 going to 1033 zero from the router's perspective, go ahead and set your

70
03:00.360 --> 03:00.760
peer

71
03:00.760 --> 03:05.320
to 708060, which is the virtual IP address we just configured on the T zero

72
03:05.320 --> 03:06.120
gateway.

73
03:06.120 --> 03:09.520
We're going to specify the details for IP sec tunnel, which is the details we

74
03:09.520 --> 03:09.800
set up

75
03:09.800 --> 03:11.840
here in this transform set.

76
03:11.840 --> 03:15.480
And this command right here applies that crypto map to this interface.

77
03:15.480 --> 03:18.040
So I'm removing it in case we have to do it a couple of times.

78
03:18.040 --> 03:20.120
And then I'm going to go ahead and put it back on right here.

79
03:20.120 --> 03:24.120
And then I have a route on this router that says, hey, to get to the 1033

80
03:24.120 --> 03:24.680
network

81
03:24.680 --> 03:29.160
over behind the T zero gateway, send it over to 708060.

82
03:29.160 --> 03:33.950
So based on that routing, that would trigger off the initiation of the IKE
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:29.160 --> 03:33.950
So based on that routing, that would trigger off the initiation of the IKE

83
03:33.950 --> 03:35.000
phase one tunnel

84
03:35.000 --> 03:37.960
and assuming that goes well, it would then create the IP sec tunnel.

85
03:37.960 --> 03:40.840
So from the router's perspective, it would look like this if it's all

86
03:40.840 --> 03:41.400
successful.

87
03:41.400 --> 03:44.600
And again, that's also presuming that we configure everything correctly over

88
03:44.600 --> 03:45.320
here

89
03:45.320 --> 03:46.600
at the T zero gateway.

90
03:46.600 --> 03:50.440
So those are all the commands I'm about to push into this router right now.

91
03:50.440 --> 03:52.520
So I'll go ahead and click on paste.

92
03:52.520 --> 03:53.720
And there they go.

93
03:53.720 --> 03:56.680
All those commands are now applied to this router.

94
03:56.680 --> 03:59.800
And just for some basic connectivity testing, if you did a ping

95
03:59.800 --> 04:05.540
over to the virtual IP address of 78 dot 0 dot 0 dot 60, we should be able to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:59.800 --> 04:05.540
over to the virtual IP address of 78 dot 0 dot 0 dot 60, we should be able to

96
04:05.540 --> 04:06.200
get a response.

97
04:06.200 --> 04:06.920
Fantastic.

98
04:06.920 --> 04:11.560
And if we did a debug here on the Cisco router, let's do a debug crypto ISOCamp

99
04:11.560 --> 04:11.960
and press

100
04:11.960 --> 04:15.240
center, those show us the nitty gritty detail for everything is trying to

101
04:15.240 --> 04:16.040
negotiate for the

102
04:16.040 --> 04:16.360
tunnel.

103
04:16.360 --> 04:21.480
Now prior to setting it up over at the here's zero gateway, if we did a ping,

104
04:21.480 --> 04:22.120
for example,

105
04:22.120 --> 04:27.550
to 10 dot 33 dot 0 dot 60, and then just confirm an our topologies, that's the

106
04:27.550 --> 04:28.360
IP address I have

107
04:28.360 --> 04:32.040
on the interface here for this T zero gateway as it connects to the segment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:28.360 --> 04:32.040
on the interface here for this T zero gateway as it connects to the segment.

108
04:32.040 --> 04:35.560
Now, if I just ping it, it's going to source it from this interface right here

109
04:35.560 --> 04:36.040
by default.

110
04:36.040 --> 04:39.190
But if I tell the router, hey, source it from the interface where you have the

111
04:39.190 --> 04:39.960
IP address 10

112
04:39.960 --> 04:44.360
eight zero 10, then because it's coming from 10 eight zero and going to 10 33

113
04:44.360 --> 04:45.160
zero,

114
04:45.160 --> 04:49.590
this router is going to try to initiate an Ike phase one tunnel based on how we

115
04:49.590 --> 04:50.600
have it configured.

116
04:50.600 --> 04:54.430
However, because the T zero gateway is not yet configured for Ike and to

117
04:54.430 --> 04:55.400
support that yet,

118
04:55.400 --> 04:56.280
it should all fail.

119
04:56.280 --> 04:59.240
But we'll be able to see it here because we have the debug's in place.

120
04:59.240 --> 05:03.640
So with those debug's in place, let's do a ping to 10 33 0 60 and we'll source
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:59.240 --> 05:03.640
So with those debug's in place, let's do a ping to 10 33 0 60 and we'll source

121
05:03.640 --> 05:04.040
it from our

122
05:04.040 --> 05:10.390
loopback address of 10 dot eight dot zero dot 10. And that should figure the

123
05:10.390 --> 05:11.720
Ike negotiation.

124
05:11.720 --> 05:15.640
So that's what we're seeing right here. And it's failing because the other side

125
05:15.640 --> 05:16.760
is not yet set up.

126
05:16.760 --> 05:21.560
So UDP port 500 is the initial port we use to start the ball rolling with the

127
05:21.560 --> 05:22.840
Ike phase one tunnel.

128
05:22.840 --> 05:26.280
So it failed one of five times and that was going to 205. All right, so we can

129
05:26.280 --> 05:26.680
come back to the

130
05:26.680 --> 05:30.150
CLI later and take a look at this once we get the tier zero gateway set up and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
05:26.680 --> 05:30.150
CLI later and take a look at this once we get the tier zero gateway set up and

131
05:30.150 --> 05:30.840
running.

132
05:30.840 --> 05:34.690
So on this router right now, if we do a show crypto, I secamp essay for

133
05:34.690 --> 05:36.040
security association,

134
05:36.040 --> 05:40.470
here it says no state effectively, it's not working. All right, so with our

135
05:40.470 --> 05:41.400
router configured

136
05:41.400 --> 05:45.530
and ready to go, our next step is to configure the IP set components here on

137
05:45.530 --> 05:46.760
our tier zero gateway

138
05:46.760 --> 05:50.440
to tell it to peer up and be willing to communicate with this router over here

139
05:50.440 --> 05:51.400
on the right to build

140
05:51.400 --> 05:56.440
our IP sector. So we'll continue configuring at T zero in the very next video.

141
05:56.440 --> 05:57.320
So I'll see you there

142
05:57.320 --> 05:58.280
in just a moment.