All right, so what we're going to do to demonstrate IP seconds to pull up the
same
topology, it should look a little familiar, we just ran through this with GRE,
we set up
a tunnel between routers three and four. So now we're going to do is get that
tunnel back
online, and then we want to secure it, because again, there's all these insec
urities, not
just from an encryption perspective where routers one and two can see all of
the packets
in plain text, but there's also the issue of do I really know I'm connecting to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in plain text, but there's also the issue of do I really know I'm connecting to
router
four if I'm router three and vice versa. And so let's go ahead and log in to
our lab environment
here and start to perform our configuration. Now we have to start by getting
our three
and R four connected again. And this is always good practice, it's not going to
take us too
long to get this tunnel up and running, we're going to create the tunnel
interface, give
it an IP address, this is dot 34.3. And this is last 24 from router three's
perspective.
The source is going to be 13.3. The destination is going to be 24.4. And then I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The source is going to be 13.3. The destination is going to be 24.4. And then I
'm going to
go ahead and enable EIGRP with a network statement to look for neighbors out
this specific interface.
So that's all we need to do for router three. Let's go ahead and do this same
configuration
on router four. And we're going to go through this pretty quickly. It's just
getting the
IP address on there. And then the tunnel source and destination we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IP address on there. And then the tunnel source and destination we're going to
flip. And then
once again, we're going to get on to our EIGRP process and enter a network
statement for
10 dot zero dot 34, this time dot four. And we should see a GRP come up pretty
much immediately.
And there it is. So now if I try to ping from router five over to router six, I
'm going
to get on the router five, say ping six dot six dot six dot six dot six, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to get on the router five, say ping six dot six dot six dot six dot six, we
might as well
do source five dot five dot five dot five. And that shows that we can ping from
this loop
back interface here, paying off a router five to the loop back hanging off of
router six.
So this tunnel interface is working well. And we know that because routers one
and two
as we've demonstrated before, they can't ping these destination addresses. They
have
no idea where the destination is. They don't have to because they're only
looking at the
outer header. So now we need to secure this connection. So let's go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
outer header. So now we need to secure this connection. So let's go ahead and
start from
scratch here with router three. And we're going to go ahead and do the same
thing with router
four. But let's get started here on router three. So remember the process we
need to
go through, we're going to start with IKEV one configuration, which is using
crypto isocamp
policy. And this is where we can assign that priority value or the lower
priorities better.
I'm just going to go ahead and say policy 10 here, head enter. And at this
point, we're
ready to perform our haggle. So I like that phrase. Either way, we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ready to perform our haggle. So I like that phrase. Either way, we're going to
say hash
here, we can look at this again, MD five and SHA one, these are pretty well
deprecated
at this point, we should probably be looking at SHA 256 or greater. So we'll
just go ahead
and say, SHA 256. And then authentication options. We can see that we've got
RSA options,
but I'm just going to say pre share here, this is going to allow me to use a
pre shared
key, which we will have to define later. So we have to remember to go back and
do that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do that.
So we're just saying use a pre shared key for right now. Now we're going to
specify
the group. So I do group question mark, and we start to see the different DIFI
home and
groups that are available. This is where we've said that group 14 is the
minimum recommended
these days. But if I do advanced to 15 and 16, we're using larger bit keys here
. So we
don't want to go with one, two or five, those are not considered to be secure
anymore. So
I'm just going to go ahead and say group 16. And from here, we'll say lifetime,
just kind WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just kind
of going through our haggle letters here. So lifetime in seconds, 86,400. Yeah,
that
is 24 hours. That's how many seconds are in a day. And so we could specify that
. In
fact, we could also do something like, you know, 3600 to specify an hour. Now
let's just
go ahead and do that here lifetime 3600. And then encryption would be the last
thing
we have to specify. And this is where again, our phase one options don't, we're
not given
a whole lot here, just AES does and triple does now AES. I mean, if we do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a whole lot here, just AES does and triple does now AES. I mean, if we do
question mark
here, we see we do actually have additional options. It's not like we have to
use the
original AES. If we do hit enter here, we'll take the default of 128 bit keys,
but AES
192 and 256, these are considered to be very secure. So I'm going to go ahead
and do AES
256 here and exit out. Now we're not done because we said we have one more
thing we
have to remember to go back and do and that's configure the pre shared key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have to remember to go back and do and that's configure the pre shared key.
This command
starts with crypto as well. A lot of these commands do. And this is going to be
crypto
isocamp key. And then I specify the key name. So I'm just going to call this CB
T key. And
then I do have to specify the IP address or the host name of the device that
this is
going to map to. So I can specify address. And I can just say 0.0.0.0 here. And
it would
apply it to anyone that I want to communicate with. Or I can target the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
apply it to anyone that I want to communicate with. Or I can target the
specific IP address
and keep in mind, this would be the physical underlay IP address, not the other
side of
the tunnel. So in my case, router four, that would be this gig to zero
interface here,
which is using 10.0.24.4. So I'm going to hit enter. So again, I said camp,
when we see
isocamp, we are thinking I could be one phase one. That is what isocamps, you
know, in iOS
X, see, that's what isocamp is referring to. So all of those configurations are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
X, see, that's what isocamp is referring to. So all of those configurations are
done.
And that will help us to configure our phase one tunnel. We're now ready to
configure
our phase two tunnel. So we're going to use again, crypto, I'll start with
crypto still.
But now we're going to start specifying IP sec, because remember, when we talk
about
phase two tunnels, we're usually calling those IP sec tunnels. Those are just
ways that we
can kind of keep in mind what we're doing as we're configuring it, because
otherwise it
can configure or can feel like it's just a jumbled mess of configurations. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can configure or can feel like it's just a jumbled mess of configurations. And
the last
thing we want is just having a hard time keeping track of what commands do what
. So isocamp
phase one, IP sec would be phase two. So crypto IP sec. And I'm going to
configure that transform
set. I have to give it a name. I'm just going to call this lab underscore TS
for transform
set. And that was okay. And this is where I always want to hit enter and start
to do
my configurations. I mentioned this earlier, if we hit question mark here, this
is going
to start to show us what we have to do to configure the transform set. Remember WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to start to show us what we have to do to configure the transform set. Remember
, the
transform set is how I configure either my ESP or AH headers. And then I have
to decide
if what my authentication mechanism is going to be and what my encryption
mechanism is
going to be if I'm using ESP might expect for me again to hit enter here and
just configure
those options. But that's not how this works. I have to hit question mark and
see that these
are all the options that are listed. Furthermore, I have to identify two of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are all the options that are listed. Furthermore, I have to identify two of
these if I'm using
ESP one for authentication and one for encryption. So I can look at this and
say, well, I could
run AH. And if I want to run AH, maybe I'd want to run with MD five or SHA or
SHA 256,
384 512. We see all of those options. HMAC by the way is a reference to that
message integrity,
the making sure that none of the bits have been changed and swapped around. So
this is
my authentication mechanism. And this is my message integrity option. So we see WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
my authentication mechanism. And this is my message integrity option. So we see
it's
the same option for all of these. So authentication header provides two levels
of security, whereas
ESP is meant to provide all three. So I'm going to go ahead and choose an ESP
option.
Let's go and start with our encryption. And we do see we have more options here
. I can
specify AES. Don't use triple desert or or does here. But we also have some
additional
options specifically GCM and GMAC. When we're talking about GCM Galois, that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
options specifically GCM and GMAC. When we're talking about GCM Galois, that's
just a different
mechanism for encryption that we could consider. We can also still just go with
AES. And we'll
see also if I run a question mark here, I can still specify the amount of bits
I want
to use for AES. So let's go ahead and specify 256 and hit question mark again.
And we see
that we are not done. We still have to specify the mechanism that we want to
use for our
authentication. So I'm going to go ahead and choose, let's just do SHA 256, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authentication. So I'm going to go ahead and choose, let's just do SHA 256,
which of
course includes the message integrity check as well. And now finally, we see
that we can
be done. We don't need to specify any AH options, we can just hit enter. And we
have
now told this transform set, not only what header to use, but also what
encryption type
we want to use as well as what authentication type. So just a little bit odd in
my opinion,
how that configuration comes together. But it is important that we recognize WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
how that configuration comes together. But it is important that we recognize
that that
is how it works. Now we run a question mark here, we'll see there's not a whole
lot of
options, but we do have this mode command and mode is what allows us to specify
that transport
versus tunnel. And I do like that it specifies here that transport is for
payload encapsulation
only, whereas tunnel is for the entire data gram. So I'm just going to say mode
tunnel,
make it more secure. And now I can exit out of the transform set. So remember
what we said
with that diagram, I don't just create a transform set and apply it to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with that diagram, I don't just create a transform set and apply it to the
interface, I actually
have to apply it to an IP sec profile. So I'm going to use that crypto IP sec
command again,
crypto IP sec, and then profile. And now I'll just give this a name like lab
underscore
PR. This time I do hit enter. And with my options in here primarily I'm going
to be
looking at this set here at the bottom. So I say set. And then I specify that I
want
to set my transform set of lab underscore TS. So that's all we're going to do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to set my transform set of lab underscore TS. So that's all we're going to do
again, it's
sort of a one to one relationship unless we need some of these additional
options. But
those are certainly going to go beyond the scope of a prime, you know, a common
IP sec
configuration. So lastly, we need to apply it to the tunnel interface. So
interface tunnel
zero. And now we need to do two things here, first of all specify that the
tunnel mode
is now running in IP sec for IP four. And we'll see that we can add this for IP
four or IP
B six, but I do have to specify. And then I can add the protection mechanism. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
B six, but I do have to specify. And then I can add the protection mechanism.
Now notice
as soon as I applied IP sec to this tunnel, that the tunnel is saying, okay,
well, I'm
running IP sec, but the other side sure isn't, I need to establish an Ike phase
one tunnel,
I need to establish an Ike phase two tunnel in order to get this online until I
do that
this tunnel interface is down, which means I've lost my ERP connection. So
something to
keep in mind there. So ERP in a way is going to tell us whether this tunnel is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
keep in mind there. So ERP in a way is going to tell us whether this tunnel is
working
because if it's running great, if it's not running, then that means the tunnel
is still
down. So tunnel mode IP sec, we also have to specify the protection. What are
we doing
here? Protection IP sec profile and then my lab profile. So the lab profile
maps back
to the transform set. The transform set gives me my phase two information
specifically,
the AES and SHA for encryption authentication, as well as the tunnel mode. All WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the AES and SHA for encryption authentication, as well as the tunnel mode. All
right. So
now we see isocamp is on. So that's good. And we have completed configuration
on our
three. So now we have to do it again on our four. And we could fast forward
through this,
but you know what, I think there's value in seeing it from start to finish
without all
of the question marks. Let's just go ahead and see what this configuration
looks like.
And we'll see it's not that bad when we go through straight through it. So
again, all
these commands are starting with crypto. We're going to start with isocamp
because isocamp
is our phase one tunnel. And again, I'm going to specify policy 10. And then I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is our phase one tunnel. And again, I'm going to specify policy 10. And then I
specify my
hash. So my hash could be SHA 256. And then I can specify my authentication as
being
pre shared key, which we still have to configure later. Group 16, lifetime 3600
we've said.
And then encryption. And then we'll say AES 256. And so that's it. That's not
too bad.
I do still have to again specify the pre shared key. So I'm going to use crypto WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I do still have to again specify the pre shared key. So I'm going to use crypto
again. I see
camp again, because it's still phase one tunnel. And then I specify my key was
CBT key, I believe.
And then the address is the what's on the other side. So this would be
targeting router
three. So that's it. That's it for phase one, not too bad. Phase two is going
to involve
crypto. But now instead of isocamp, it's IP sec. And then the transform set.
And I name
it. And then when I do a question mark, this is where I can get my options. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it. And then when I do a question mark, this is where I can get my options. So
I'm going
to specify ESP AES 256. I believe that's what we did, right 256. Yeah. And then
we're
going to also specify ESP dash. And we'll do SHA 256 dash, a Mac, H Mac. And
then tunnel
mode, not tunnel mode. That would be on the interface. Here we're just going to
specify
mode tunnels backwards. All right, so we got the transform set. No problem. Now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mode tunnels backwards. All right, so we got the transform set. No problem. Now
we're going
to do crypto IP sec profile, give it a name lab PR. And now I set the transform
set lab
TS. And lastly, we get onto the tunnel interface. And we do those two important
commands, tunnel
mode, IP sec, IP for IP V four, and then tunnel protection, IP sec profile. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mode, IP sec, IP for IP V four, and then tunnel protection, IP sec profile. And
then lab PR.
All right, so it's on. Hopefully we see EIGRP come back up or come online. We
're going
to double check real quick for Oh, yep, there it is. It's already up. All right
, good. I
couldn't remember for sure if I set 256 here. It looks like we did. Okay, good.
All right.
So yeah, JRP is online. I look at our five, and we can ping across to our six
once again.
So that is how we do it. We do have some verification commands that we can run. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that is how we do it. We do have some verification commands that we can run.
We can do show crypto,
for example, there's a lot of show crypto commands, isocamp would be a good way
to validate
Ike configuration. So I can do isocamp policy and see all of the settings that
we just set.
I can do also do show crypto IP sec, SA as a stands for security association.
So I can
see a lot of information about this tunnel communication that's happening here
and start
to digest that. And so other than that, yeah, we've got a tunnel running, we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to digest that. And so other than that, yeah, we've got a tunnel running, we've
got our routing
protocol running inside of the tunnel. And it is now secured using all of the
principles
we've talked about with IP sec.