WEBVTT

1
00:00.000 --> 00:03.100
In this video, we're going to begin the configuration here on site 3

2
00:03.100 --> 00:06.900
by making sure we have a VPN service enabled at the T0 gateway.

3
00:06.900 --> 00:09.400
And because of the previous tunnel we have set up

4
00:09.400 --> 00:12.300
between this tier 0 gateway and a third-party router,

5
00:12.300 --> 00:15.200
we're already going to have a VPN service enabled for this tier 0 gateway.

6
00:15.200 --> 00:16.000
So that part's done.

7
00:16.000 --> 00:20.700
However, what isn't going to be done yet is the actual VPN session information

8
00:20.700 --> 00:23.900
that we're going to use between site 3 and site 4.

9
00:23.900 --> 00:27.000
So let's head over to site 3 and begin our configuration.

10
00:27.000 --> 00:31.460
So here at the NSX manager for site 3, let's start off by going to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.000 --> 00:31.460
So here at the NSX manager for site 3, let's start off by going to the

11
00:31.460 --> 00:32.500
networking tab.

12
00:32.500 --> 00:36.200
And then with networking selected right here on the left under network services

13
00:36.200 --> 00:36.200
,

14
00:36.200 --> 00:38.300
let's go down and click on VPN.

15
00:38.300 --> 00:41.500
So with VPN selected right here, I'm going to go ahead and collapse this left

16
00:41.500 --> 00:42.000
hand column

17
00:42.000 --> 00:45.200
to give us a little bit more room here in this main page.

18
00:45.200 --> 00:50.700
And if we expand this current VPN service, it is an IPsec service type.

19
00:50.700 --> 00:55.500
And effectively, this means that the ability to use IPsec VPNs is enabled

20
00:55.500 --> 00:58.900
on our tier 0 gateway, which is where it's currently applied.

21
00:58.900 --> 01:02.600
So if we're to go back to our topology and then here for our tier 0 gateway,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:58.900 --> 01:02.600
So if we're to go back to our topology and then here for our tier 0 gateway,

22
01:02.600 --> 01:06.800
if we hover over services, it's going to indicate that we have VPN services

23
01:06.800 --> 01:07.400
enabled.

24
01:07.400 --> 01:08.200
Fantastic.

25
01:08.200 --> 01:11.200
All right, so let's go back to the VPN section.

26
01:11.200 --> 01:13.600
I'll collapse the left hand side one more time.

27
01:13.600 --> 01:17.100
And because we already have this VPN service for IPsec enabled,

28
01:17.100 --> 01:21.900
we can then proceed to the second tab here and create our new IPsec session

29
01:21.900 --> 01:23.900
that we're going to use over to site 4.

30
01:23.900 --> 01:29.000
So this current session is for the IPsec site to site policy based VPN session

31
01:29.000 --> 01:32.200
that we have between site 3 and our external router.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:29.000 --> 01:32.200
that we have between site 3 and our external router.

32
01:32.200 --> 01:36.010
And what we want to do is create another one, but this time for us between site

33
01:36.010 --> 01:36.400
3

34
01:36.400 --> 01:37.400
and site 4.

35
01:37.400 --> 01:41.410
So to create a brand new IPsec session, we'll simply click right here and add

36
01:41.410 --> 01:42.600
IPsec session.

37
01:42.600 --> 01:45.800
And that's asking us to we want policy based where we're going to specify

38
01:45.800 --> 01:49.820
explicitly the source and destination networks to protect like we did

39
01:49.820 --> 01:50.400
previously

40
01:50.400 --> 01:53.300
or this time we want to go ahead and do route based.

41
01:53.300 --> 01:56.400
And the biggest difference here with route based is that as part of the

42
01:56.400 --> 01:57.100
configuration

43
01:57.100 --> 02:00.000
we are going to put in right here, where says tunnel interface,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:00.000 --> 02:04.600
we're going to specify the tunnel interface address we want to use at site 3,

45
02:04.600 --> 02:08.800
which in our case, since I'm right here, let's go ahead and put it in 1034.34

46
02:08.800 --> 02:09.500
dot

47
02:09.500 --> 02:11.300
and let's take a look at our notes.

48
02:11.300 --> 02:15.200
And we want to use on this logical tunnel interface over here at site 3.

49
02:15.200 --> 02:18.400
We want to use 1034 34 dot 33.

50
02:18.400 --> 02:22.300
So let's continue with our configuration for the virtual tunnel interface

51
02:22.300 --> 02:22.700
address

52
02:22.700 --> 02:27.400
right here on the T zero gateway at site 3 as part of our IPsec session

53
02:27.400 --> 02:28.500
configuration

54
02:28.500 --> 02:31.100
that we're doing in preparation to connect over to site 4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:28.500 --> 02:31.100
that we're doing in preparation to connect over to site 4.

55
02:31.100 --> 02:37.200
So here we'll put 1034 34 dot 33 with a 24 bit mask and that looks good based

56
02:37.200 --> 02:38.300
on our plan.

57
02:38.300 --> 02:41.400
And then for the name, I'm going to go ahead and call the name of this IPsec

58
02:41.400 --> 02:41.700
session

59
02:41.700 --> 02:42.700
we're creating.

60
02:42.700 --> 02:47.200
I'm going to go ahead and call it to site 4, meaning this is coming from site 3

61
02:47.200 --> 02:48.700
going to site 4

62
02:48.700 --> 02:51.900
and it's route based based on what we selected when we did the drop down.

63
02:51.900 --> 02:56.200
And then for the VPN service, we only have one VPN service enabled on this tier

64
02:56.200 --> 02:56.900
zero gateway.

65
02:56.900 --> 02:59.700
And that is this one called lab IPsec VPN service.

66
02:59.700 --> 03:04.360
So now we're going to be using that one VPN service as the parent, if you will,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:59.700 --> 03:04.360
So now we're going to be using that one VPN service as the parent, if you will,

67
03:04.360 --> 03:05.100
for these two

68
03:05.100 --> 03:09.190
IPsec sessions, the one to our Cisco external router and this new one that we

69
03:09.190 --> 03:10.700
're creating right now.

70
03:10.700 --> 03:14.410
Next, it's asking us what the local endpoint address and for our local endpoint

71
03:14.410 --> 03:14.900
address,

72
03:14.900 --> 03:19.290
we're going to be using the IP address on site 3, the one that's connecting out

73
03:19.290 --> 03:21.000
through 23 dot 1 dot 2 dot 30.

74
03:21.000 --> 03:25.740
So at the moment, if we use a drop down, we don't have that local endpoint set

75
03:25.740 --> 03:26.000
up.

76
03:26.000 --> 03:30.330
So what we could do is we could cancel all this, go up to local endpoints and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
03:26.000 --> 03:30.330
So what we could do is we could cancel all this, go up to local endpoints and

77
03:30.330 --> 03:34.500
create it or click on the three dots right here and simply create that new

78
03:34.500 --> 03:37.700
endpoint and use the address 23 dot 1 dot 2 dot 30.

79
03:37.700 --> 03:39.500
So we'll click on the three dots.

80
03:39.500 --> 03:42.600
We'll go ahead from the drop down, click on create new right there.

81
03:42.600 --> 03:46.220
And then I'm going to go ahead and I'm going to name this 23 dot 1 dot 2 dot 30

82
03:46.220 --> 03:46.500
.

83
03:46.500 --> 03:50.500
That way, when I see this endpoint, I'll know exactly what's in it.

84
03:50.500 --> 03:52.200
And so that's going to be the name of it.

85
03:52.200 --> 03:55.800
And then for the IP address, it's going to be 23 dot 1 dot 2 dot 30.

86
03:55.800 --> 04:00.200
And then for the local ID right here, it defaults to the IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:55.800 --> 04:00.200
And then for the local ID right here, it defaults to the IP address.

87
04:00.200 --> 04:03.900
If you put nothing there, but just for grins, I'm going to put it here as well.

88
04:03.900 --> 04:08.960
So now the local endpoint address called 23 dot 1 dot 2 to 30 is using the IP

89
04:08.960 --> 04:13.900
address and local ID of 23 dot 1 dot 2 dot 30, which is perfect for what we

90
04:13.900 --> 04:15.300
want to do over at site 3.

91
04:15.300 --> 04:17.500
So with those in place, we'll click on safe.

92
04:17.500 --> 04:20.100
So we've got the name of this IP succession.

93
04:20.100 --> 04:21.200
It's route based.

94
04:21.200 --> 04:24.690
Here's the parent VPN service that we're going to be using on the tier zero

95
04:24.690 --> 04:25.400
gateway.

96
04:25.400 --> 04:29.300
Here's the local endpoint name, which also points to 23 dot 1 dot 2 dot 30.

97
04:29.300 --> 04:31.900
And now it's asking us about the remote IP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:29.300 --> 04:31.900
And now it's asking us about the remote IP.

98
04:31.900 --> 04:36.180
So for the remote IP, we want to point to the device or the entity that we're

99
04:36.180 --> 04:37.200
going to be peering with.

100
04:37.200 --> 04:41.610
So in our case, that's going to be site for at the global reachable address of

101
04:41.610 --> 04:43.800
24 dot 1 dot 2 dot 40.

102
04:43.800 --> 04:45.600
And we verified we could ping that earlier.

103
04:45.600 --> 04:50.120
So for the remote IP address from the perspective of site 3, the remote IP is

104
04:50.120 --> 04:53.000
going to be 24 dot 1 dot 2 dot 40.

105
04:53.000 --> 04:58.200
So we'll put that in as the remote IP 24 dot 1 dot 2 dot 40.

106
04:58.200 --> 05:02.460
And then for the authentication, we're going to be using PSK, which is acronym
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:58.200 --> 05:02.460
And then for the authentication, we're going to be using PSK, which is acronym

107
05:02.460 --> 05:03.800
for pre shared key.

108
05:03.800 --> 05:06.830
So if we select pre shared key as the authentication mode, we then want to go

109
05:06.830 --> 05:09.300
ahead and put in the pre shared key that we want to use.

110
05:09.300 --> 05:10.500
So I'll do that right here.

111
05:10.500 --> 05:13.460
So I've typed in a pre shared key when click on the little eyeball there to see

112
05:13.460 --> 05:14.100
what it is.

113
05:14.100 --> 05:16.500
So I'm going to use that as the pre shared key.

114
05:16.500 --> 05:20.000
And when we go over to site for, I'll use the same pre shared key.

115
05:20.000 --> 05:21.200
So we've got the name.

116
05:21.200 --> 05:22.100
It's route based.

117
05:22.100 --> 05:23.700
There's the parent VPN service.

118
05:23.700 --> 05:24.900
There's our local endpoint.

119
05:24.900 --> 05:26.500
There's the remote IP.

120
05:26.500 --> 05:28.200
Here's the pre shared key.

121
05:28.200 --> 05:31.980
Here's the IP address we want to use on our end of the logical tunnel that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:28.200 --> 05:31.980
Here's the IP address we want to use on our end of the logical tunnel that we

122
05:31.980 --> 05:35.200
're also going to be building between us and site for.

123
05:35.200 --> 05:38.810
And then for the remote ID, it's going to default to the IP address that we're

124
05:38.810 --> 05:39.900
using for the remote ID.

125
05:39.900 --> 05:42.800
But if you wanted to, you could also specify here as well.

126
05:42.800 --> 05:44.100
It's not required, but you can.

127
05:44.100 --> 05:48.350
And sometimes if you have lots of different VPN tunnels, it's not a bad idea to

128
05:48.350 --> 05:53.400
hard code everything and that we can be very clear about which ID and which IPs

129
05:53.400 --> 05:55.500
you're using with which neighbors and which peers.

130
05:55.500 --> 05:58.700
So then as we scroll down, we have a set of advanced properties.

131
05:58.700 --> 06:01.830
And that's where we can specify right here under advanced properties what we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:58.700 --> 06:01.830
And that's where we can specify right here under advanced properties what we

132
06:01.830 --> 06:06.020
want to use for the Ike profiles for the initial Ike tunnel and for the IP sec

133
06:06.020 --> 06:09.720
profile, which is for the IP sec tunnel as well as the dead peer detection

134
06:09.720 --> 06:10.400
profiles.

135
06:10.400 --> 06:13.960
So if we use the defaults here and those defaults for the same over on the

136
06:13.960 --> 06:16.300
other side, they should be totally compatible.

137
06:16.300 --> 06:19.620
So if we want to view the details in these profiles, we can go ahead and click

138
06:19.620 --> 06:21.400
on the three dots and click on view.

139
06:21.400 --> 06:27.860
So the default Ike profile is using Ike version two encryption AES 128 for the

140
06:27.860 --> 06:32.150
hashing shot to 56 and for Diffie, Hellman Diffie, Hellman group 14 and a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
06:27.860 --> 06:32.150
hashing shot to 56 and for Diffie, Hellman Diffie, Hellman group 14 and a

141
06:32.150 --> 06:34.500
lifetime of 86,400 seconds.

142
06:34.500 --> 06:38.760
So if we didn't want to use these values for the negotiations of the initial

143
06:38.760 --> 06:43.200
Ike tunnel, we could go ahead and create our own Ike profile and then use it.

144
06:43.200 --> 06:46.400
So I'm going to use this default one here for the Ike profile for IP sec

145
06:46.400 --> 06:47.100
profiles.

146
06:47.100 --> 06:49.800
I'm going to use the default there as well. Let's go ahead and view it.

147
06:49.800 --> 06:52.800
It's going to be using AES 128 for the IP sec tunnel.

148
06:52.800 --> 06:57.490
It's not using any hashing by default as shown right here and it's using PFS

149
06:57.490 --> 07:01.800
perfect forward secrecy and for calculating the king material for that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
06:57.490 --> 07:01.800
perfect forward secrecy and for calculating the king material for that.

150
07:01.800 --> 07:05.530
It's using Diffie, Hellman group 14 for the IP sec tunnel and the lifetime is

151
07:05.530 --> 07:06.700
3600 seconds.

152
07:06.700 --> 07:09.550
So as long as this is the same information that we're going to be using over at

153
07:09.550 --> 07:11.500
site four, it's going to be totally compatible.

154
07:11.500 --> 07:14.300
So I'm going to click on close and we're going to use those two.

155
07:14.300 --> 07:17.600
We'll also use the default dead peer detection profile as well.

156
07:17.600 --> 07:21.520
So with all those values in place, we'll simply click on save and then we'll

157
07:21.520 --> 07:25.990
click on a refresh here and we should expect this to not succeed because the

158
07:25.990 --> 07:27.700
other side is not yet configured.

159
07:27.700 --> 07:31.700
So it takes two to tingo when doing IPsec site site VPN tunnels.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
07:27.700 --> 07:31.700
So it takes two to tingo when doing IPsec site site VPN tunnels.

160
07:31.700 --> 07:35.280
So again, here's the details that we just set up and based on our game plan, I

161
07:35.280 --> 07:40.610
think we now have site three as far as the IP sec VPN session information set

162
07:40.610 --> 07:41.900
up correctly.

163
07:41.900 --> 07:45.950
So with that set up, our next step is to go ahead and do a very similar

164
07:45.950 --> 07:49.600
configuration over at site four except for site four.

165
07:49.600 --> 07:53.630
It's local ID and IP address will be 24 dot 1 dot 2 dot 40 and from its

166
07:53.630 --> 07:58.000
perspective, the remote ID would be 23 dot 1 dot 2 dot 30.

167
07:58.000 --> 08:02.020
And for this logical network, we're building between site for and site three in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
07:58.000 --> 08:02.020
And for this logical network, we're building between site for and site three in

168
08:02.020 --> 08:06.930
the next video as we configure site for, we'll be using the IP address 103434

169
08:06.930 --> 08:07.900
dot 44.

170
08:07.900 --> 08:11.910
All right, so with that in mind, join me in the next video as we begin our

171
08:11.910 --> 08:13.600
configuration on site for.

172
08:13.600 --> 08:29.740
[no audio]