When we're using IPsec, and we're using IKE version one,
there's going to be two phases, the IKE phase one
tunnel and the IKE phase two tunnel, or the IPsec tunnel.
When is the best time to plan out the details, as far
as the encryption algorithms and the hashing that we're
going to use for those?
I would suggest the best time to do
that, to plan it out would be before we're actually
at the CLI and typing it in.
So let's spend a few moments in this video planning
out what we want to use for IKE phase one and IKE phase two,
and then we'll proceed in the next video
by implementing our design. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by implementing our design.
All right, let's go ahead and do our planning
for IKE phase one and IKE phase two
as we're going to protect that GRE traffic going
over the network.
So for encryption, let's do this.
Let's use AES for IKE phase one.
Let's use AES 256 for hashing.
Let's use SHA 256 for authentication.
Let's use pre-shared keys.
For the diffy element group, let's use group five.
And for the lifetime, let's use 5,000 seconds.
And if we're using pre-shared keys,
we'll also need to specify what that pre-shared key is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll also need to specify what that pre-shared key is
and who we're willing to use it with.
Now for IKE phase two, for encryption,
let's use it AES 128, and we could choose any flavor that's
supported by both sides for IKE phase two,
but I want to point out that they
don't have to match what we use for IKE phase one,
because this is a separate transform going
to be used for IKE phase two or the IPsec tunnel itself.
And for the HMAC, which is hashing
with the benefit of using the secret key as part
of the formula, so only the person with the key
could do the correct hash, let's use SHA 384. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
could do the correct hash, let's use SHA 384.
So that will be our plan.
And you might be saying, well, Keith, you know,
when we did crypto maps, we also had a crypto ACL
to identify the traffic we wanted to protect.
Now, we could create a crypto ACL that says, you know,
GRE traffic protocol 47.
Just go ahead and encrypt that.
That'll be it.
Or a better way of doing it is to create a tunnel protection
profile, not a crypto map, and applying that tunnel protection
profile to the tunnel interface and boom.
We're done.
Any traffic going out or coming in on that tunnel interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Any traffic going out or coming in on that tunnel interface
is going to be assumed to be encrypted
if it's outbound or decrypted if it's inbound.
So that's going to be a slight difference, and an easier
difference, when we go to implement the IPsec, which
we'll do, now that we have a plan, in our next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.