We are making progress. We've configured iG phase one on router one and I also
went over to our two and I implement the same iG phase one policy there so they
're matching.
So in this video I'd like to walk you through the syntax and demonstration of
implementing our policy for IP sec the iG phase two tunnel on a Cisco router.
And to get this ball rolling I just want to remind mostly me to be quite honest
.
Remind myself of the parameters that we want to use for the iG phase two tunnel
. So we're going to configure an ACL on router one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
. So we're going to configure an ACL on router one.
Router one that would be an ACL that says traffic from 10 1 0 going to 10 2 0
and over here on router two that ACL would be traffic from 10 to 0 going to 10
1 0.
Now this access list which is called a crypto ACL we're not going to apply it
directly to an interface as a filter but rather we're going to include it as
something called a crypto map.
That lets the routers know what traffic needs to be encrypted and what traffic
doesn't if it doesn't match the ACL.
We also are going to specify the encryption for the iG phase two tunnel we use WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also are going to specify the encryption for the iG phase two tunnel we use
a s 128 we're going to use an h Mac of 384 Shaw and we're going to point to the
peers so our two will point to our one are one will point to our two and we're
going to use tunnel mode
and just for grins we're not going to rely on the diffi helmet that was run
during IKE phase one we're going to run our own diffi helmet generate our new
keys and as a result we'll use that key material for our secret for encrypting
and decrypting data for our IP
So back where we left off there's our IKE phase one policy and the key all set WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So back where we left off there's our IKE phase one policy and the key all set
up let's go into the details for configuring IKE phase two or the IP sec tunnel
details.
So we're going to configuration mode the first thing we're going to create is a
transform set.
Now a transform set is just set of instructions on how we want to manipulate
the data so an IP sec transform set to create one the syntax would be crypto IP
sec and then the keyword transform set space and then we name it.
I'm going to call this one our set for you and me so we'll call our set.
I'm also going to be just aware of the case sensitivity that I put in because WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm also going to be just aware of the case sensitivity that I put in because
later when we call on this we want to use the same exact name for this
transform set.
So in this transform set we can specify are we going to use a h or we're going
to use ESP and if we're using those do you want to use respectively the h Macs
with them as well as the encryption.
So the syntax would go something like this let me peek at our plan real quick
let me peek at our plan real quick okay for encryption we want a yes 128 and
for h Mac we wanted shop 384 great let's go back to the CLI and let's do it.
So in this transform set I'm going to go ahead and choose those from the list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in this transform set I'm going to go ahead and choose those from the list.
Let's start off with ESP dash a s and now it's asking okay what flavor of a s
do you want and based on our plan we want to use 128 so a s 128 space and if we
want to have h Mac which we do which is the hashing with the secrets involved.
We type in ESP dash shah dash and we want to use 384 based on our plan and I
need to go ahead and make sure I specify the right one we wanted this guy right
here so I just copy paste it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here so I just copy paste it.
We wanted ESP Shaw 384 h Mac I think that was it so a yes 128 for encryption
and Shaw 384 h Mac for data integrity and great so now we've got this transform
set.
So we're going to go ahead and select the transform set and then we're going to
go ahead and select the transform set and then we're going to go ahead and
select the transform set and then we're going to go ahead and select the
transform set and then we're going to go ahead and select the transform set and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
transform set and then we're going to go ahead and select the transform set and
then we're going to
go ahead and select the transform set and then we're going to go ahead and
select the transform set and then we're going to go ahead and select the
transform set and then we're going to go ahead and select the transform set and
then we're going to go ahead and select the transform set and then we're going
to
until we take one final step and that is associating something called a crypto
map with the egress
interface on that router so that's a step that's coming up in a video or two so
we're building WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're building
that and putting all the building blocks together for the final result so we
have a transform set
next let's create a crypto ACL and so for this crypto ACL it's going to be an
extended access
control list so we can you know use 100 or 101 or a named access control list
either way would work
let's do IP access list extended and let's call this crypto dash ACL press
enter and let's just have
one entry and from our ones perspective is going to be a permit meaning a match WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one entry and from our ones perspective is going to be a permit meaning a match
for any IP traffic
in the IPV4 protocol suite that's coming from 10.1.0.0 then we use a wildcard
mask which means we only care
about matching on the first two octets of 10.1 and the destination would be 10.
2.0.0 with the same
wildcard mask meaning we don't care about matching on anything beyond the first
two octets boom so
there is an extended access list it's not being used yet we need to tie that
all together with
something called a crypto map that step is coming up so our next step is once WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
something called a crypto map that step is coming up so our next step is once
we have the transform
set and we have the access control list that we're going to use as a crypto ACL
how in the world do
all these things get you know put together in like a bundle the answer is we're
going to use like a
shopping cart let's imagine we're shopping in a store I want some of this and
some of that we're
putting on the shopping cart the device in traditional IPsec VPNs that we're
going to use is called a
crypto map think of a crypto map like a shopping cart and what we're going to
do is we're going to
say okay here's your shopping cart this crypto map and we want to put this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say okay here's your shopping cart this crypto map and we want to put this
access list in it which is
the interesting traffic we want to put this peer match you know set traffic to
this peer we want to
put in the transform set like what encryption and hashing do we want to use and
also if we want to
use PFS perfect forward secrecy we put that in the shopping cart so without
further ado let's create
our crypto map which is like a shopping cart and will include all those details
about the IPsec tunnel
that we want to establish so the syntax for this for creating a crypto map is
crypto space map space
and then we're going to go ahead and give it a word and the word we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we're going to go ahead and give it a word and the word we're going to
use is our dash map
and it is if we use this syntax as part of the upper case lowercase we want to
remember that because
when we go to apply this to an interface we'd we'd want to use the same exact
syntax because if
you put if you do a typo or it's not correct it's not going to recognize it as
a valid crypto map so
we're going to do crypto map our map space and then a question mark and there's
this option right
here called the sequence number and I'm going to use sequence number 10 let me WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here called the sequence number and I'm going to use sequence number 10 let me
talk about why that
might be really important that could be really important because we might have
one crypto map
that we're going to use but we might have several peers maybe we're hub and
spoke and we've got a
central site with four different remote sites we're connected with we could
have different
sections or sequences in one crypto map one appropriate for site 10 one
appropriate for site 20 and so
forth so we're just going to have one sequence because we only have one peer
but that's why we're
using a sequence number as part of our crypto map and then we'll do a space and
a question mark
and I'm going to do this one right here of II, IPsec dash iSACAMP what this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'm going to do this one right here of II, IPsec dash iSACAMP what this
means is that iSACAMP
the internet security association key management protocol what it does behind
the scenes for us
is a lot of busy work and a lot of dynamic negotiation of keys and that's all I
'm saying is I want to
use that so basically if this crypto map is applied and there's interesting
traffic that it says oh
I should encrypt this it will automatically negotiate and work with iKphase one
policy that we have set
up to build the iKphase one tunnel if it's not already up and then subsequently
bring up the IPsec WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
bring up the IPsec
tunnel if it needs an IPsec tunnel established so that's what iPsec dash iSAC
AMP does it does allow
that nitty-gritty detail for us automatically then we'll press enter and now it
's saying hey
whoa this crypto map is empty it's like your shopping cart is empty we need
some details in it so
let's go ahead and put in the details so let's start off by saying please match
on the address
or the addresses i should say that are in the access controllers called crypto
dash ACL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dash ACL
so what that says as part of this crypto map is says okay our one says okay
traffic from 10.1
anything going to 10.2 anything because that's what's in the crypto ACL the ad
access list that's
interesting traffic and if i see that traffic and if this crypto map is applied
somewhere i should
you know encrypt the traffic and ship that data over to my peer who then can
decrypt it now the
other question is who's your peer so that's also set here inside this crypto
map so we'll
set the peer in this case is our one the peer is going to be 25 let me look at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
set the peer in this case is our one the peer is going to be 25 let me look at
the address real
quick so our two's address is going to be 252222 that's the reachable address
on our two over the
transport network here so we'll put 25.2.2.2 boom and we also created a
transform set we should
specify in this shopping cart called a crypto map what that transform set is so
we'll do a set
transform set and it was our dash sct and then we also if we want to do pfs
perfect forward secrecy
we can do it as well so i'll do pfs and based on our plan we use group and i WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can do it as well so i'll do pfs and based on our plan we use group and i
think we planned
let's take a look real quick here's our plan and we planned on pfs 15 so we'll
do 15 and then we'll
type in exit and let's take a look at the details of our crypto map we'll do a
do show crypto map
just like that and let's look at this together so this shopping cart called our
it's also
crypto map has
one sequence number 10 and then that it basically says if traffic matches this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one sequence number 10 and then that it basically says if traffic matches this
axis control list
which is crypto dash ACL which is spelled out right here 1010 going to 1020
then go ahead and
specifying that regarding this tunnel that hasn't been established when you
build the tunnel
that we should use diffihelman group 15 to generate our own keys it's
specifying that we
should use perfect forward secrecy and that's why the group information is here
and the transform WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the transform
set for this tunnel should use AES did we specify okay so because it's not
showing right here the
value let me just take a look at our notes real quick because it's not showing
a value here the
default is 128 and that's why that 128 is not showing up and then we're using
SHA-384 hmac for
the data integrity fantastic so this shopping cart called our map it has all
those details in it now
the problem the big problem is this guy right here interfaces using crypto map
our map nada
there's nothing there we don't have this applied yet and that's the actual WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's nothing there we don't have this applied yet and that's the actual
final step in getting
ipsec working in a site to site environment we have to take this crypto map
that we just created
and we have to go back to our topology and looking at our topology we need to
apply that crypto map
right here on this interface so you apply it on the interface between this pier
and the interface
it would use as it's talking to the other end of the tunnel also we would do
the appropriate the
similar configuration over here on r2 including a crypto ACL saying 10 to 0 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
similar configuration over here on r2 including a crypto ACL saying 10 to 0
going to 10 1 0 and
the encryption and the hashing and the transform set which i will do i'll
mirror all that over on
r2 but the final step on both these routers is we need to take the crypto map
and apply it on that
interface that they would be using to talk to the pier and that is what
activates our ipsec policy
and the great news is we're going to do exactly that and watch it come up in
the very next video
so i will see you there in just a moment meanwhile i hope this has been
informative for you and i'd
like to thank you for viewing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like to thank you for viewing