Hey welcome back in the previous video we took a look at many of the settings
that we need to supply or at least plan on for IP sec for like phase one and
like phase two.
So I thought let's take a moment in this video and let's actually write those
out what we're going to use and that way we go to implement it's not like a
mystery or guessing game as far as what were we can use there again.
We can plan it out here and then we can implement it based on our plan testing
one two three testing one two three.
And to say this little time I've just written out the elements that were in
supply so for encryption this is for the Ike phase one tunnel for encryption. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
supply so for encryption this is for the Ike phase one tunnel for encryption.
Let's use a yes the advanced encryption standard and let's use two fifty six
and if it comes to a point where these routers don't support that we may have
to revisit but I think I'm fairly current IOS supports all these options that
we're going to want to apply for the hashing for the ice phase one tunnel.
Let's use Shaw and let's use this two fifty six flavor now for the hashing we
don't have to use.
Shaw to fifty six because we use the encryption of a yes to fifty six weekend
you know that numbers just applicable to the hashing in this case or to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you know that numbers just applicable to the hashing in this case or to the
encryption that case.
So let's use Shaw to fifty six and for authentication let's use pre shared keys
for a pre shared key let's use this Cisco exclamation mark two three on both
sides and that way when our one initiates a tunnel for Ike phase one with our
two.
If they're both using the appropriate key and they're willing to use that key
we should have a successful authentication for a phase one and if we do then
they'll go ahead and proceed to do Diffy Helen.
So for Diffy Helen let's use Diffy Helen group number five and for the lifetime WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for Diffy Helen let's use Diffy Helen group number five and for the lifetime
instead of using the number of seconds in a full day let's go ahead and make
that shorter and we'll set that to five thousand.
So let's use that on both sides and that's right phase one and for like phase
two let's set up a plan there to all right so here we go for the Ike phase to
the IP sec tunnel details for the ACL the crypto ACL it's referred to with the
traditional IP six site tunnel.
From our ones perspective is can be traffic from ten dot one zero going to ten WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
From our ones perspective is can be traffic from ten dot one zero going to ten
to zero and from our two's perspective traffic from ten to zero going to ten
one zero to specify that in the access control list and then we'll include that
in the crypto map that binds all of this together.
I'll step you through all those details for the encryption let's go ahead and
use AES 128 and for the hashing let's use Shaw and let's use 384.
Now with hashing as far as the IP sec Ike phase to tunnel is literally using
what's called an H Mac which stands for a hash message authentication code WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what's called an H Mac which stands for a hash message authentication code
which is a hash of the data each packets going to get a hash but it also
includes in the algorithm for that.
Some of the secret king material that's only going to be known by our one and
our two so that makes the hashing more secure it also verifies when somebody
receives that one are to receive this as well the only person who could have
created that hash on that packet.
The only is it correct but the only person who the keys involved to do that
would be my good buddy R1 so not only is it data integrity it's also helping to
verify who sent that packet.
So for the peers are to have the peer of fifteen one one one over here are one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the peers are to have the peer of fifteen one one one over here are one
and our one is going to have the peer of twenty five two two two which is the
reachable address here on our two so the peers will be each other based on
their reachable global addresses.
And then for the mode we are going to use tunnel if you don't specify a mode it
will default to tunnel but just to make sure that we have the option.
We want to specify what we want here and then for PFS if you don't want to use
it you don't have to but if we do want to use PFS where it runs DIFI helmet
again.
We can choose our DIFI helmet group so appear we use five because this is the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can choose our DIFI helmet group so appear we use five because this is the
IP sec tunnel like phase two we don't have to use the same you know.
DIFI helmet group we could use group fifteen for example as long as both
routers support it so now we have our details regarding what we want to happen
for like phase one like phase two the next step is to implement the
configurations to make it happen so what we're going to do the next videos as
they come up is in the very next video which I'll see you there in just a
moment.
We'll configure the Ike phase one policy on both routers we'll do some quick
checks make sure we are all in place and then as we proceed in the next video WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
checks make sure we are all in place and then as we proceed in the next video
we'll layer on top of that the Ike phase two policy or the IP sec policy
including the transform sets so you can see the configuration hot to make our
plans that we just designed a reality on our routers for the IP sec site to
site tunnel.
So we'll continue this journey in the next video as we configure the Ike phase
one policies so I'll see you there in just a moment.
Meanwhile I hope this has been informative for you and I'd like to thank you
for viewing.
you