WEBVTT

1
00:00.000 --> 00:02.600
So now with our Cisco router ready to go,

2
00:02.600 --> 00:06.280
it's time for us to configure the T0 gateway here in NSX

3
00:06.280 --> 00:09.720
to be ready and willing and able to use these protocols

4
00:09.720 --> 00:13.720
for the initial tunnel and these protocols for the APSect tunnel.

5
00:13.720 --> 00:14.960
And if we get everything correct,

6
00:14.960 --> 00:18.160
we'll have a nice beautiful IPsec site-site tunnel

7
00:18.160 --> 00:21.960
that we can then start using between 1033-0 over here

8
00:21.960 --> 00:23.800
off of the NSX side of the house

9
00:23.800 --> 00:27.280
and devices over here on the 1080 network behind the router.

10
00:27.280 --> 00:30.280
So to configure the IPsec VPN here in the NSX manager,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.280 --> 00:30.280
So to configure the IPsec VPN here in the NSX manager,

11
00:30.280 --> 00:31.480
we're going to go to networking.

12
00:31.480 --> 00:33.280
And then on the left, under network services,

13
00:33.280 --> 00:34.880
we're going to click on VPN.

14
00:34.880 --> 00:35.880
So that's where we are.

15
00:35.880 --> 00:37.960
I'm going to go ahead and collapse that left-hand side,

16
00:37.960 --> 00:39.680
give us a little bit more room here.

17
00:39.680 --> 00:42.960
And you'll notice here under VPN, we have several options.

18
00:42.960 --> 00:44.400
We have profiles.

19
00:44.400 --> 00:45.760
And this is where we can set the profiles.

20
00:45.760 --> 00:47.960
Basically, you think of it like the set of what we want to do

21
00:47.960 --> 00:52.480
for the initial tunnel, the ICke profiles, the IPsec profiles,

22
00:52.480 --> 00:55.560
and there's also one for dead peer detection profiles.

23
00:55.560 --> 00:56.880
Should we choose to use it?

24
00:56.880 --> 00:59.280
So one of our options is we could go ahead and specify

25
00:59.280 --> 01:02.160
all these parameters here one by one for each of the ICke
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.280 --> 01:02.160
all these parameters here one by one for each of the ICke

26
01:02.160 --> 01:05.480
and IPsec profiles, or we could actually walk through

27
01:05.480 --> 01:08.880
the configuration and then on demand, go ahead and simply

28
01:08.880 --> 01:10.600
create the profiles that we need.

29
01:10.600 --> 01:14.880
We also are going to need an endpoint for the local T0 gateway.

30
01:14.880 --> 01:17.800
So once again, we could click on add local endpoint right here

31
01:17.800 --> 01:20.600
and do it, or we could just do it as part of the process

32
01:20.600 --> 01:22.080
on demand as we need it.

33
01:22.080 --> 01:25.080
So let's start off on the very far left with VPN services

34
01:25.080 --> 01:26.840
and we'll click on add service.

35
01:26.840 --> 01:29.480
From the dropdown, we have our options of IPsec,

36
01:29.480 --> 01:32.920
L2VPN server, L2VPN client, and for this set of videos
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.480 --> 01:32.920
L2VPN server, L2VPN client, and for this set of videos

37
01:32.920 --> 01:36.600
in the skill, we're focused on IPsec site site tunnels.

38
01:36.600 --> 01:38.960
So we're going to create an IPsec VPN service.

39
01:38.960 --> 01:42.600
So let's call this lab IPsec VPN service.

40
01:42.600 --> 01:44.840
That way when we see it, we know exactly what it is.

41
01:44.840 --> 01:47.240
And for the gateway we want to associate this with,

42
01:47.240 --> 01:49.680
we only have one that's our red tier zero gateway.

43
01:49.680 --> 01:50.720
So we'll select that.

44
01:50.720 --> 01:53.480
And then I'm going to go ahead and leave everything else

45
01:53.480 --> 01:54.760
at their defaults.

46
01:54.760 --> 01:56.240
So we'll click on save.

47
01:56.240 --> 01:59.520
And now we effectively have this service, this VPN service

48
01:59.520 --> 02:02.720
for IPsec that's associated with our red tier zero gateway,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.520 --> 02:02.720
for IPsec that's associated with our red tier zero gateway,

49
02:02.720 --> 02:04.800
but there's not a lot going on with it yet.

50
02:04.800 --> 02:07.480
Including we don't have any specific IPsec sessions

51
02:07.480 --> 02:10.560
associated with the service, for example, the IPsec session

52
02:10.560 --> 02:13.560
that we want to set up between this tier zero gateway

53
02:13.560 --> 02:14.920
and the external router.

54
02:14.920 --> 02:16.520
So right here, still in editing mode,

55
02:16.520 --> 02:18.840
we could click under sessions, we could click on set,

56
02:18.840 --> 02:20.720
and effectively it'll give us the opportunity

57
02:20.720 --> 02:22.600
to create the IPsec session information.

58
02:22.600 --> 02:24.800
And then as we proceed, we'll also be able to specify

59
02:24.800 --> 02:26.880
the profiles and the endpoints as well,

60
02:26.880 --> 02:28.560
all from within this interface.

61
02:28.560 --> 02:30.080
So once we're done here, we'll go back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.560 --> 02:30.080
So once we're done here, we'll go back

62
02:30.080 --> 02:31.480
and take a look at the individual components.

63
02:31.480 --> 02:33.880
So under sessions, let's click on set.

64
02:33.880 --> 02:35.400
Again, we're still in edit mode.

65
02:35.400 --> 02:38.040
And we'll click right here and add IPsec session.

66
02:38.040 --> 02:39.640
And it's going to be policy based.

67
02:39.640 --> 02:42.360
And let's call this IPsec session to Cisco.

68
02:42.360 --> 02:45.120
And then for the local endpoint, if you hit the dropdown,

69
02:45.120 --> 02:47.520
there are no local endpoints yet, but we could go ahead

70
02:47.520 --> 02:50.720
and click on the three dots and simply create one right here.

71
02:50.720 --> 02:55.800
So for this local endpoint, let's call this red key zero endpoint.

72
02:55.800 --> 02:58.120
And then for this endpoint, let's use the IP address

73
02:58.120 --> 03:01.000
that we're going to be terminating the IPsec tunnel on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.120 --> 03:01.000
that we're going to be terminating the IPsec tunnel on.

74
03:01.000 --> 03:05.840
And that is on the tier zero gateway 78.0.0.60.

75
03:05.840 --> 03:07.400
That's the virtual IP address.

76
03:07.400 --> 03:10.080
If we're using certificates, we could specify our certificate

77
03:10.080 --> 03:12.080
for us for excuse pre shared keys.

78
03:12.080 --> 03:13.680
And then down here for the local ID,

79
03:13.680 --> 03:15.720
if we're going to use a local ID that's different

80
03:15.720 --> 03:18.600
than the IP address that we're using to peer with,

81
03:18.600 --> 03:20.760
we could go ahead and specify a different value down here.

82
03:20.760 --> 03:24.160
Now, for our site site tunnel, the local ID

83
03:24.160 --> 03:26.120
is going to be the same as the IP address

84
03:26.120 --> 03:28.600
and the similar concept over at the Cisco router.

85
03:28.600 --> 03:31.880
So the local ID is going to be 78.0060 here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:28.600 --> 03:31.880
So the local ID is going to be 78.0060 here

86
03:31.880 --> 03:33.120
and then click on save.

87
03:33.120 --> 03:35.360
So here for this IPsec session,

88
03:35.360 --> 03:37.600
we now specify the local endpoint.

89
03:37.600 --> 03:40.200
The remote IP address is going to be our Cisco router

90
03:40.200 --> 03:43.720
reachable address, which is 78.0.0.10.

91
03:43.720 --> 03:46.400
Then for the authentication mode, if we're using pre shared keys,

92
03:46.400 --> 03:48.840
we select PSK for pre shared key

93
03:48.840 --> 03:51.200
and then it's asking us to enter the pre shared key.

94
03:51.200 --> 03:54.960
So over at the Cisco side, we used Cisco 123.

95
03:54.960 --> 03:57.200
So here at our NSX tier zero gateway,

96
03:57.200 --> 03:58.760
I'm going to put in the same key

97
03:58.760 --> 04:01.480
that I use over at the Cisco router.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:58.760 --> 04:01.480
that I use over at the Cisco router.

98
04:01.480 --> 04:02.840
And that way if the keys match,

99
04:02.840 --> 04:05.600
they'll successfully complete the authentication

100
04:05.600 --> 04:07.080
of the iKphase one tunnel.

101
04:07.080 --> 04:09.200
So I've just put in that password, let's take a peek,

102
04:09.200 --> 04:11.720
Cisco exclamation mark two three fantastic.

103
04:11.720 --> 04:14.000
That's the same password I put over at the Cisco router.

104
04:14.000 --> 04:15.720
And then for the remote ID,

105
04:15.720 --> 04:17.880
if you're using a different IP address

106
04:17.880 --> 04:20.040
than the remote IP you're connecting to,

107
04:20.040 --> 04:21.520
you could put the remote ID here.

108
04:21.520 --> 04:22.880
If you don't put any value here,

109
04:22.880 --> 04:25.400
it's just assumes that the remote ID is the same

110
04:25.400 --> 04:27.240
as the remote peers IP address.

111
04:27.240 --> 04:28.320
So I'm going to leave that blank.

112
04:28.320 --> 04:31.240
And if we scroll down, here's where we can specify
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:28.320 --> 04:31.240
And if we scroll down, here's where we can specify

113
04:31.240 --> 04:32.520
other advanced properties,

114
04:32.520 --> 04:34.360
the individual profiles we want to use

115
04:34.360 --> 04:37.120
for the initial control tunnel, the iKtunnel,

116
04:37.120 --> 04:39.800
as well as the protocols we want to use for the IPsec tunnel.

117
04:39.800 --> 04:41.560
So if we want to view what these values are,

118
04:41.560 --> 04:44.360
we can click on the three dots and click on view.

119
04:44.360 --> 04:45.600
And then showing us the details,

120
04:45.600 --> 04:47.160
which don't match up with what we want.

121
04:47.160 --> 04:48.760
So AES is good,

122
04:48.760 --> 04:51.160
Shot to 56 is good, Group 14 is good,

123
04:51.160 --> 04:54.120
but we don't want iK version two, I want iK version one.

124
04:54.120 --> 04:56.160
So I'm going to go ahead and close that.

125
04:56.160 --> 04:58.120
And I am not going to use that profile.

126
04:58.120 --> 05:00.760
Let's go ahead and just create a new iK profile right here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:58.120 --> 05:00.760
Let's go ahead and just create a new iK profile right here

127
05:00.760 --> 05:03.800
by clicking on the three dots and clicking on create new.

128
05:03.800 --> 05:05.800
We'll call this our iK profile.

129
05:05.800 --> 05:07.480
And for the version, we're using version one.

130
05:07.480 --> 05:09.600
And you might say, Keith, why is that?

131
05:09.600 --> 05:11.040
Well, at the Cisco side,

132
05:11.040 --> 05:13.840
it's about half the configuration to use iK version one.

133
05:13.840 --> 05:16.440
And that's currently what we have over on that Cisco router.

134
05:16.440 --> 05:19.560
So I just want to match what we're currently doing over there

135
05:19.560 --> 05:23.000
so that we can create a successful initial iK tunnel.

136
05:23.000 --> 05:25.080
And then for the encryption AES 128,

137
05:25.080 --> 05:26.840
for the hashing Shot to 56,

138
05:26.840 --> 05:28.720
Diffie-Hellman Group 14, that all looks great.

139
05:28.720 --> 05:31.120
And for the lifetime, 86,400 seconds,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:28.720 --> 05:31.120
And for the lifetime, 86,400 seconds,

140
05:31.120 --> 05:32.320
that looks great too.

141
05:32.320 --> 05:33.560
And we'll click on save.

142
05:33.560 --> 05:36.040
So the details for our initial tunnel are set.

143
05:36.040 --> 05:37.440
So for the IPsec tunnel,

144
05:37.440 --> 05:40.320
let's click on the three dots and click on view.

145
05:40.320 --> 05:43.440
And here we're close, but we have PFS as one of the things

146
05:43.440 --> 05:44.480
that would cause us a problem

147
05:44.480 --> 05:46.080
because over at the Cisco side,

148
05:46.080 --> 05:47.600
I did not enable PFS.

149
05:47.600 --> 05:49.120
So we'll click on close there.

150
05:49.120 --> 05:50.520
I'll say, I don't want to use that one.

151
05:50.520 --> 05:52.720
And let's create a new IPsec profile

152
05:52.720 --> 05:55.240
that matches what our Cisco device is currently set up for.

153
05:55.240 --> 05:56.640
So we'll click on create new,

154
05:56.640 --> 05:58.960
we'll call this lab IPsec profile.

155
05:58.960 --> 06:02.880
And for the encryption, we'll use AES 128.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:58.960 --> 06:02.880
And for the encryption, we'll use AES 128.

156
06:02.880 --> 06:06.040
And we could specify more than just one encryption algorithm here.

157
06:06.040 --> 06:08.560
And that would become part of what this device,

158
06:08.560 --> 06:11.480
this tier zero gateway is willing to negotiate.

159
06:11.480 --> 06:14.440
So because I know the other side is only doing AES 128,

160
06:14.440 --> 06:15.840
I'll specify that for the encryption,

161
06:15.840 --> 06:17.720
for the IPsec tunnel, for the hashing,

162
06:17.720 --> 06:20.840
I'm using SHA-256 and I'm not using PFS,

163
06:20.840 --> 06:22.400
I'm gonna turn it off here as well.

164
06:22.400 --> 06:25.000
And for the lifetime, hopefully the lifetime

165
06:25.000 --> 06:26.760
on the other side is gonna be compatible with that.

166
06:26.760 --> 06:28.920
I think it might be, we'll find out here in a minute

167
06:28.920 --> 06:30.160
and we'll click on save.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:28.920 --> 06:30.160
and we'll click on save.

168
06:30.160 --> 06:33.960
So now we have our iq profile, our IPsec profile,

169
06:33.960 --> 06:36.880
and for dead peer detection, let's take a look at that.

170
06:36.880 --> 06:38.520
So we'll click on view.

171
06:38.520 --> 06:39.560
So a dead peer detection,

172
06:39.560 --> 06:41.720
this will be says this side is gonna send a little probe

173
06:41.720 --> 06:44.560
every 60 seconds, just to verify that the tunnel is up

174
06:44.560 --> 06:47.080
and active, I'm gonna go ahead and leave that on.

175
06:47.080 --> 06:48.920
So we'll go ahead and leave that profile.

176
06:48.920 --> 06:50.200
Now, before we leave the config,

177
06:50.200 --> 06:52.400
we also need to specify the subnets

178
06:52.400 --> 06:53.280
that we're trying to protect.

179
06:53.280 --> 06:55.440
So here it says, what are the local networks

180
06:55.440 --> 06:56.720
and the remote networks?

181
06:56.720 --> 06:58.440
So let's take a look at our topology.

182
06:58.440 --> 07:00.080
So here in our topology, the local network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

182
06:58.440 --> 07:00.080
So here in our topology, the local network

183
07:00.080 --> 07:02.120
from the perspective of this T zero gateway

184
07:02.120 --> 07:05.600
is 1033 zero going to 1080.

185
07:05.600 --> 07:07.960
So we'd wanna specify those two networks as the local

186
07:07.960 --> 07:10.000
from the T zero side and the remote.

187
07:10.000 --> 07:13.800
So for the local networks, it is 10.33.0

188
07:13.800 --> 07:15.280
with a 24-bit mask.

189
07:15.280 --> 07:17.120
And for the remote network that we wanna protect,

190
07:17.120 --> 07:21.600
it is 10.8.0 with a 24-bit mask.

191
07:21.600 --> 07:22.960
So that's one of the negatives of doing

192
07:22.960 --> 07:24.520
policy-based IPsec VPNs,

193
07:24.520 --> 07:27.120
because if you add additional networks,

194
07:27.120 --> 07:29.680
you also would need to come back to your VPN configuration

195
07:29.680 --> 07:32.200
and specify that you also wanna provide protection
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

195
07:29.680 --> 07:32.200
and specify that you also wanna provide protection

196
07:32.200 --> 07:33.200
for those networks.

197
07:33.200 --> 07:36.480
Or you could also have each site using, for example,

198
07:36.480 --> 07:38.520
a block of the 10 network address space,

199
07:38.520 --> 07:43.520
like 10, 1/16 for site one and 10, 2/16 for site two

200
07:43.520 --> 07:46.600
and have summary addresses, that would also work.

201
07:46.600 --> 07:48.760
So for our demo, we wanna protect traffic

202
07:48.760 --> 07:50.080
between these two networks.

203
07:50.080 --> 07:52.880
So we'll specify those here, we'll scroll down

204
07:52.880 --> 07:55.800
and click on save and click on close.

205
07:55.800 --> 07:57.760
And let's go into the CLI at the router.

206
07:57.760 --> 07:59.880
So back at the Cisco router,

207
07:59.880 --> 08:02.040
because I had the debug on, check it out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

207
07:59.880 --> 08:02.040
because I had the debug on, check it out.

208
08:02.040 --> 08:04.520
If we scroll up here, here is in the process

209
08:04.520 --> 08:07.440
of doing the negotiation for the initial Ike tunnel.

210
08:07.440 --> 08:09.520
And here it says Ike phase one complete.

211
08:09.520 --> 08:11.000
So that was successful.

212
08:11.000 --> 08:13.000
And if we scroll down, it then went to work

213
08:13.000 --> 08:15.960
in setting up and negotiating the actual IPsec tunnel.

214
08:15.960 --> 08:18.840
So an Ike version one, and this message right here

215
08:18.840 --> 08:22.320
with the phase two complete indicates that that is all done.

216
08:22.320 --> 08:27.360
So if we did a show crypto ISA-CAMP SA detail here

217
08:27.360 --> 08:29.840
at the Cisco side, this is showing us the details

218
08:29.840 --> 08:31.720
for the actual Ike phase one tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

218
08:29.840 --> 08:31.720
for the actual Ike phase one tunnel

219
08:31.720 --> 08:34.280
with AES for the encryption, shot 56,

220
08:34.280 --> 08:36.920
pre shared key, Diffie-Hellman 14.

221
08:36.920 --> 08:38.240
And if we wanna look at the details

222
08:38.240 --> 08:40.880
for the actual IPsec security association,

223
08:40.880 --> 08:45.120
we can do a show crypto IPsec SA press enter.

224
08:45.120 --> 08:46.120
And that shows the details

225
08:46.120 --> 08:48.640
about the IPsec security association,

226
08:48.640 --> 08:50.440
including the networks that are being protected.

227
08:50.440 --> 08:53.120
So traffic from 1080 from the Cisco side,

228
08:53.120 --> 08:56.000
going to 1033-0 for outbound traffic

229
08:56.000 --> 08:57.880
is gonna be protected by IPsec.

230
08:57.880 --> 09:00.160
And at the moment, as far as the IPsec tunnel goes,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

230
08:57.880 --> 09:00.160
And at the moment, as far as the IPsec tunnel goes,

231
09:00.160 --> 09:02.960
we haven't had any packets encrypted or decrypted

232
09:02.960 --> 09:04.280
over the IPsec tunnel.

233
09:04.280 --> 09:06.800
And that's because we haven't had any user traffic yet.

234
09:06.800 --> 09:09.440
So if we did a show crypto engine connections active,

235
09:09.440 --> 09:11.200
that's confirming our security association.

236
09:11.200 --> 09:14.680
So the Ike here is the initial Ike phase one tunnel

237
09:14.680 --> 09:15.760
or the control tunnel.

238
09:15.760 --> 09:18.520
And then the other two here are the IPsec security associations.

239
09:18.520 --> 09:20.120
And there's actually two of them,

240
09:20.120 --> 09:21.360
they're going in each direction.

241
09:21.360 --> 09:24.520
So one going from the router to the gateway

242
09:24.520 --> 09:26.880
and the other one going from the gateway to the router.

243
09:26.880 --> 09:29.560
And that's what's being represented right here.

244
09:29.560 --> 09:31.080
And back at the NSX manager
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

244
09:29.560 --> 09:31.080
And back at the NSX manager

245
09:31.080 --> 09:33.520
with the networking tab selected and VPN on the left,

246
09:33.520 --> 09:36.680
if we click here on IPsec sessions and expand that

247
09:36.680 --> 09:37.800
here it's showing success.

248
09:37.800 --> 09:38.680
That's a very good sign.

249
09:38.680 --> 09:41.280
If we click right here on view statistics

250
09:41.280 --> 09:43.120
from the NSX gateway perspective,

251
09:43.120 --> 09:45.520
this is showing us how much traffic has been encrypted

252
09:45.520 --> 09:47.440
and decrypted over the IPsec tunnel.

253
09:47.440 --> 09:49.200
So at the moment, because you don't have any user

254
09:49.200 --> 09:51.720
setting traffic, these values are all zero.

255
09:51.720 --> 09:53.440
So we'll click on close there.

256
09:53.440 --> 09:56.280
Now the next question is, I suppose, is it really working?

257
09:56.280 --> 09:58.040
Now we looked at it from the Cisco side,

258
09:58.040 --> 10:01.040
we looked at it from the T0 NSX gateway side
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

258
09:58.040 --> 10:01.040
we looked at it from the T0 NSX gateway side

259
10:01.040 --> 10:02.800
and they both said, hey, it's up.

260
10:02.800 --> 10:05.040
But they also said there's zero packets

261
10:05.040 --> 10:06.760
that have been encrypted and decrypted

262
10:06.760 --> 10:08.080
going over the IPsec tunnel.

263
10:08.080 --> 10:11.080
So the next logical step then is to verify

264
10:11.080 --> 10:14.920
with some live traffic trying to go from 1033.0

265
10:14.920 --> 10:18.240
over to 10A0 to verify that it's actually going

266
10:18.240 --> 10:19.680
over the tunnel protected.

267
10:19.680 --> 10:22.320
And that's exactly what you and I get to do and verify

268
10:22.320 --> 10:23.440
in the next video.

269
10:23.440 --> 10:25.480
So I'll see you there in just a moment.