In the previous video, we looked at a plan
for implementing the IPSec for phase 1 and for phase 2.
In this video, we're going to take
a look at the actual implementation of IKE phase
1 and IKE phase 2 with a special attention
to detail with the fact that we are not
going to create a crypto map as we
did with site-to-site VPNs that use crypto maps.
Instead we'll create an IPSec tunnel protection profile,
and then just simply attach that profile
to the tunnel interface.
And then we'll get the job done.
So here are details for IKE phase 1 and IKE phase 2.
I'll refer back to this if I forget any of those values. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll refer back to this if I forget any of those values.
Let's go to the CLI and start at router number 1,
and create the IKE phase 1 policy that matches this.
So here on router 1, we'll go into configuration mode,
crypto, crypto ISAKMP policy.
And then we can use--
I don't have any policies currently on this router.
So I'm going to go and choose 7 just for fun.
Press Enter.
That puts this into crypto ISAKMP policy configuration
mode.
And lets the specify details.
So for encryption, we wanted to go ahead and use AES and 256. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for encryption, we wanted to go ahead and use AES and 256.
And for hashing, we wanted to go ahead and use SHA 256.
Let me look at my notes to make sure that's true.
Yep.
AES 256, SHA 256.
So far so good.
For the authentication, we want to use pre-shared keys.
And for the Diffie-Hellman we want to use group 5.
And for the lifetime, we're going to go for 5,000.
And so do show crypto ISAKMP policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so do show crypto ISAKMP policy.
And there's our policy.
I want to make sure we get all the details.
AES 256, SHA 256, pre-shared key, Diffie-Hellman group 5,
and a 5,000 second lifetime.
Fantastic.
So we'll exit out of that configuration mode,
and then let's create our key.
So crypto ISAKMP key, and let's use
Cisco, exclamation mark 2, 3.
And let's say we're going to be willing to use
that address with.
Now we could just specify the peer,
or if we're going to have lots of other peers,
we could just say 0.0.0.0.
And that's a wild card that says,
hey, I'll use this key with anybody WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hey, I'll use this key with anybody
who has this matching key.
So I'm going to use that for now.
Let's do a do show.
Crypto, ISAKMP key, and there's the key.
I just want to make sure I typed it right.
So far so good now.
Now next-- that's IKE phase 1.
Now for IKE phase 2, we're going to create a transform set just
as we did with crypto maps.
Except this time, after we create the transform set,
we're not going to nest it inside of a crypto map itself.
We're going to include it as part of an IPSec profile.
So let's create the transform set.
To do that, we'll do a crypto, IPSec, transform set, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
To do that, we'll do a crypto, IPSec, transform set,
and then we'll name it.
I'm going to call this our-set.
And then we're going to include what
we want to have in this IKE phase 2 transform set.
One of the keys also is that if it
says IPSec in the actual command,
generally that's referring to IPSec, the IKE phase 2.
If it says ISAKMP in the command,
that normally is referring to the IKE phase 1 elements.
Like crypto ISAKMP policy versus crypto IPSec transform set.
So based on our plans, let's use ESP-AES and 128, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on our plans, let's use ESP-AES and 128,
and then ESP-SHA, and we want to do 384.
And that was it.
Now here we can specify the mode.
If we don't specify mode tunnel, it will automatically
do it for us.
That's can be the default, but I'm
going to put it in just for grins.
And then exit out of transform configuration mode.
So hang on to your socks because right now we're
going to diverge from the crypto map option
that we did in the previous videos
on crypto map IPSec VPN tunnels, and now we're
going to create an IPSec profile instead. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to create an IPSec profile instead.
Think of the IPSec profile as including
the details for IKE phase 2, but we're not going
to include it in a crypto map.
It'll be part of the IPSec profile itself,
and then we'll attach that profile
to the tunnel interface.
And boom.
We're good to go as far as protecting
our traffic on that tunnel interface with IPSec.
I'd like to break into this really scheduled video
from my editing chair just editing the video,
and I'll take an extra moment to talk
about what we're about to do with IPSec and protecting
the GRE traffic.
The old way of doing it would be to create WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The old way of doing it would be to create
a crypto map and a crypto ACL looking for GRE traffic,
and that would be our interesting traffic
to encrypt and decrypt--
the GRE protocol 47.
However, a more efficient way of doing
it, which is what I'm about to show you,
is referred to using VTIs--
a virtual tunnel interface.
So we still have our tunnel, we still
have the parameters on it, but what
we're going to do is we are going to change the mode.
The default mode for our tunnel is GRE,
and we're going to change it to say tunnel mode IPSec IPv4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we're going to change it to say tunnel mode IPSec IPv4.
So it's no longer using GRE, it's now going to use IPSec.
In addition, we slap on the tunnel protection profile,
the IPSec profile, that encrypts and decrypt
the traffic going in and out of that interface.
So the difference is if we used a crypto map
looking for GRE traffic and we applied that
to the physical interface, that would be GRE over IPSec.
And what we're about to witness and experience
is using a virtual tunnel interface where we're not
using the tunnel mode of GRE, we're
using tunnel mode IPSec for IPv4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using tunnel mode IPSec for IPv4.
So with that little injection, let's continue
on with our configuration and verification
of a virtual tunnel interface that has a tunnel protection
profile for IPSec.
So to create the profile, the syntax is crypto IPSec profile.
And then we'll go ahead and give it a name.
Let's call it our-IPSec-profile.
And then inside of this profile, we
are going to go ahead and set the transform set that we
created a few moments ago.
So set transform set.
And the name is-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the name is--
I would just go ahead and paste that.
And then we're good to go.
So we now have this profile called our IPSec profile, which
includes the transform set.
So now we have the IKE phase 1 policy setup.
We have transform set that created IKE phase 2.
We've got the IPSec profile configured
that has transform set in it.
It's now time to go ahead the tunnel interface,
and tell it to use it.
So to do that, we'll go into configuration mode interface
tunnel 0, and we're going to do two specific things.
We're going to a tunnel mode IPSec for IPv4 traffic, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're going to a tunnel mode IPSec for IPv4 traffic,
and then we're going to specify the IPSec profile we
want to use.
Now the tunnel just went down too because R1 is thinking,
Oh, this is IPSec IPv4, and the other side is just
using genric GRE all by itself.
So they don't agree on that, and the tunnel is down.
So before we leave R1, let's also use the command tunnel
protection IPSec.
And the profile is going to give me the profile that we just
created.
So I'm going to go and scroll up and just
grab that, right click, copy it, and then paste it.
That way I don't have a typo. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That way I don't have a typo.
And boom, we are good to go.
So now R1 is all ready to go.
It just needs a partner that's agreeing with it.
So we're going to go over to R2, and R2
is going need the IKE phase 1 policy, the transform set,
the IPSec profile, and then attached
to the tunnel interface itself.
We'll do that right now.
So there's the IKE phase 1 policy on R2
that matches what is over on R1.
Next we'll specify the pre-shared key.
So we'll go into that next.
Now the pre-shared key matches, and R2
is willing to use that pre-shared key with anybody. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is willing to use that pre-shared key with anybody.
Next we'll create our transform set.
We'll make sure it matches, or is
compatible with the transforms that R1 wants to use.
Next we'll create an IPSec profile,
and inside that profile, we'll specify
that it's going to use the transform set that we just
created.
And then we'll go to interface tunnel 0,
and we'll specify that the mode for that tunnel
is going to be IPSec for IPv4.
And we're going to specify the tunnel protection profile
for IPSec that it should use.
So we'll do that next.
So tunnel protection IPSec profile,
the name of the IPSec profile, press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the name of the IPSec profile, press Enter.
And if that's not working, our neighborship should come up.
There it is.
That looks really great.
So if we go back to our client at PC1
and we try to reach PC2 again, and go to the web page there,
the traffic should hit R1 before it shipped out that tunnel
interface.
It should be also protected with IPSec.
Let's do a quick test.
And then the next video, we'll do some packet analysis
to verify that what we think is happening indeed is.
So here is the client at site 1.
We'll open up a browser.
We'll go to 10.2.0.50, and that looks great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll go to 10.2.0.50, and that looks great.
We'll refresh that a few times, and we are good to go.
We have connectivity.
And back to the routers, if we do a show crypto,
engine connection is active.
So here's showing us that we have some IPSec, IKE phase 2,
and some IKE phase 1 tunnels.
And we can do a show crypto ISAKMP SA for the IKE phase 1
information, and a show crypto IPSec SA for the IKE phase 2
information.
And there they're showing us that we
have encapsulated and de-encapsulated packets that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have encapsulated and de-encapsulated packets that
are being protected via IPSec.
So now that it appears to be working,
let's take a look at it with a packet capture before, during,
and after just to verify that what we think is happening
is really happening.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.