All right, so quick reminder of what this IPsec key,
rekey timer is all about.
So we know that we have our controller
and it is the control plane of our connection.
And then we have IPsec here managing the data plane.
So with Graceful Restart,
Graceful Restart is monitoring these connections here.
So if for any reason we lose
one of the control plane connections,
we're happy to leave our data plane online
for that default timer.
And that default timer is 12 hours.
So that's a really long time,
but because of the architecture
of the control plane and data plane separation,
we say that that's okay.
But here's the problem.
This IPsec key or timer is going,
and occasionally we must do something called rekeying,
which means that we need to generate new keys
in order to stay secure.
That timer is going to, at some point,
tick down in a normal operation.
We just tick down and we say,
okay, it's time for a new key.
And that key process is managed by the SD-WAN controller.
So what we want to prevent is this rekey
happening at the same time as our Graceful Restart.
So what can we do about that?
Well, what Cisco's recommendation is
is to make this again twice as long
so that the odds are very low
that this rekey timer happens
in the middle of our Graceful Restart timer.
So we want to make this not happen
in the middle of a Graceful Restart.
So if a Graceful Restart starts,
even if it goes 12 hours,
if the rekey timer is, by default, 12 hours,
then we should be good.
But what if we increase this?
What if we decide, you know what,
we want to make our Graceful Restart timer 24 hours.
Well, now we need to make the rekey timer 48 hours.
And as we've seen briefly, Cisco requires this.
We saw the CLI configuration fail.
Now we're going to go take a look
at the graphical user interface as well
and see whether it works there.
So let's go ahead and pull up Manager
and take a look at that.
So we're looking at our feature templates.
Let's scroll to the bottom here.
And we've got this changes for OMP that we pushed.
Let's go ahead and edit this again.
And this time we're going to increase
that Graceful Restart timer.
So I'm going to scroll all the way
up to Basic Configuration here.
Change the Graceful Restart timer.
Notice I intentionally made this less than what it was
because that way it wouldn't impact
or create a need for us to change the IPSec timer.
But what happens if I do make this much higher?
What if I just make it even 50,000?
So I'm going to say Update here.
And that's going to push the configuration change down.
So far, so good.
We're going to configure the devices,
say that that's perfectly fine.
And first of all, it's making sure
that the configuration looks good.
And that's probably going to pass.
There's nothing we did that's wrong here yet.
We just changed the configuration
for the Graceful Restart timer.
That validation was fine.
But now it's trying to push this down to the devices.
And let's see what happens here.
Ah, yes, it failed.
Now, at first glance, we might say,
oh, what, why is it failing to attach?
It gives us no details.
Well, all the way over here on the right under Action,
I can click this link and have it pop out.
And it's going to tell me exactly why it failed.
It says the unsatisfied must constraint.
It's not a great way of explaining it.
But all of this,
the value for the Graceful Restart timer of 50,000,
and colon, so then IPSec read key timer
should be at least two times the Graceful Restart timer.
So I can't actually make that change at the same time.
I'm going to, or alone, I should say,
at the same time,
I am going to have to create a new template.
So we're going to add template for the 8000V.
And notice right here, Cisco Security.
Under Cisco Security, if I scroll up,
we're going to see under basic configuration,
the rekey timer in seconds.
And notice that it is exactly twice
the Graceful Restart timer, it's 86,400,
which is 24 hours.
So I'm going to change this to global and make it 100,000,
which is double what I just made
the Graceful Restart timer.
I am, by the way, going to have to give this a name.
So let's just call this SecRekey,
rekey timer 2X for the description,
and I'm going to click save.
So from here, I can go to my device template, edit it.
And then right here, under Cisco Security,
it's actually right under Cisco OMP,
but we see Cisco Security.
I'm going to select my rekey timer and click update.
So now I'm going to attempt to push this configuration down.
All right, so that was a success.
Now let's go ahead and push the OMP configuration back down.
When I come out to my feature templates here,
once again, I'm going to look at that same OMP template here.
Edit this.
And when I scroll up and take a look,
we're going to find that the Graceful Restart timer
went back to 40,000.
Remember, when it failed, it decided that it wasn't able
to push that configuration down,
so it reverted the feature template
because it had already been mapped to the device template.
So I'm going to now change this back to 50,000,
which is what I had it at,
and we'll do the exact same thing.
We're going to configure our two devices,
edges 11 and 12, by pushing this configuration down.
Now let's see if this ends up working,
because before it failed for good reason.
We didn't have the value half of the rekey timer,
but now this should be set to exactly the right values
at 50,000 and 100,000.
All right, so yes, indeed, it did succeed.
Let's take a look at the CLI and see what happened.
So we are on edge 11.
I'm going to go ahead and do a show SD-WAN run.
This will give us a look at all of the configuration
for the SD-WAN section of iOS XE.
And I did this so I could scroll up
and we can take a look at our two sections here.
So first of all, OMP, this is the configuration
we just pushed down via the feature template.
And we see under timers
that we have the Graceful Restart timer now set to 50,000.
Fantastic, that's exactly what we wanted.
Now I scroll down a little bit more,
we're going to find the security section.
And we see right here that the rekey setting
under IPsec is 100,000.
And that's exactly what we wanted to do.
So we do see that Cisco is mandating this two to one ratio,
whether it's at the graphical user interface
or is it going to happen at the CLI?
Well, let's go ahead and flip over to edge 13
and configure it.
So let's go ahead and do a show SD-WAN run.
This time I'm going to do a pipe with section security.
And we're going to find here
is that when we are running this configuration
outside of vManage,
that we don't actually have a lot of default configs
in place, meaning that there is no section security
in this command.
I could run a show SD-WAN run
and space all the way down to the bottom,
but it's not going to show up.
It should be right in this section here and it's not.
So that's fine.
It means that it's hiding the default configurations.
Let's go ahead and make a difference
or a change to the default.
So I'm going to do a config dash T
and then get into SD-WAN operation.
First of all, let's go ahead and demonstrate
what happens if we get onto OMP and change the timers.
So I'm going to change the graceful restart timer
to that 50,000 value and let's try to commit.
And exactly the same error shows up.
This graceful restart timer value of 50,000
isn't two times or in our case,
isn't half of IPSec rekey timer.
IPSec rekey timer must be two times the current value
that we just configured.
So I'm going to exit out of OMP mode
and enter into security mode, still under SD-WAN notice.
We're still in the SD-WAN side of the house,
but now we get into security and then IPSec and hit enter.
And now I can say rekey and I can see my values here.
So we've got quite a range that we can configure.
I'm going to do rekey here and specify 100,000.
There we go, make sure we have enough zeros.
And now we will commit the changes
and let's make sure they both took.
So I'm going to do a show SD-WAN run section OMP.
Let's make sure the graceful restart timer took
and it did, it's at 50,000.
And now I can do a show SD-WAN run section security.
Hopefully this time we get a configuration and we do.
So we have our rekey timer set to twice
the graceful restart timer.
And as we see, Cisco allows that configuration
to go through, but it will not allow the configuration
to go through if we don't get that ratio correct.