In this video, we're going to do a couple things.
Number one, we're going to identify many of the components
that we're going to need to configure on the key server
and plan those out beforehand.
That way when we get to the CLI we won't be like,
hmm, what should we use.
We'll have a good plan and then we'll
follow through on the plan.
So, let's go to the chalkboard and identify
some of the major components that we
are going to want to configure on the key server.
So, in our topology we will imagine this is MPLS
and that our service provider is providing
us MPLS layer 3 VPN services.
Which basically means that the 10.1.0 network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Which basically means that the 10.1.0 network,
if we have a customer here who routes packets to 10.2.0,
the service provider knows about all of our routes,
they're keeping track of it with MPLS layer 3 VPNs themselves,
and we have full reachability.
And the reason that's important is because with group encrypted
transport we are not swapping out
the IP headers with a different set of IP addresses.
So, if 10.1.0 doesn't have reachability to 10.2.0
over this network, it's not going
to have it after we do IPsec.
So, we want to make sure we have full reachability
in the solution before we do group encrypted transport WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the solution before we do group encrypted transport
because the IP headers are going to be preserved
after the encryption.
So, let's plan for IKE phase 1 because we're
going to need that between R4, the key server,
and the individual group members.
Now, R2 and R1 and R3 don't need IKE phase 1 between them
because we're not building tunnel overlays,
but what we do need is IKE phase 1 compatible between each
of the group members and the key server.
So, here's what I propose we do.
For encryption let's use AES 128, and for hashing let's use
SHA 256, for Diffie-Hellman let's use WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
SHA 256, for Diffie-Hellman let's use
group 14, and for authentication let's use pre-shared keys.
That means we need to set a pre-shared key
and we'll use a pre-shared key that's
the same on all the devices as they authenticate
with the key server.
And for the address we'll just tell them
all the pre-shared key can be used with anybody.
If we wanted to lock it down from the key server perspective
we can say, OK only use that key with 15.1.1.1 and 25.2.2.2
et cetera, but the wild card for the pre-shared keys
just says whatever the key is we specify, feel WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just says whatever the key is we specify, feel
free to use it with everybody.
And for IPsec, as part of the policy that we'll then
push down to all the group members,
we are going to need to create a transform set, which
is identical to the other videos on IPsec we've done.
In addition to an IPsec transform set,
we're going to make an IPsec profile and in that profile
we'll include the transform set.
We can also set the lifetime and this information
that we configure is going to be part of the policy
that we push down to the group members.
So, this IPsec policy that we're configuring
is going to be part of the policy we push down
to the group members.
Now, for the rekeying we're also going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, for the rekeying we're also going
to need to generate an RSA key pair,
just like we would to enable SSH.
And the reason we're going to generate RSA key pair,
it's going to use that key pair as part of the rekeying
when it communicates with the group members.
Also, we're going to need an ACL,
I'll put a C there in front, that's
a crypto ACL that identifies traffic from 10 to 10
will be encrypted.
And this is the gotcha that I'd like to talk with you about.
The gotcha is that in the crypto ACL
the permit statements identify what we want to encrypt.
So, if we accidentally include too much, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, if we accidentally include too much,
like we include NTP traffic, or OSPF traffic,
or other control plane traffic that shouldn't be encrypted
because the other side is not expecting it,
we might have fail--
we will have failures in our network
as far as our routing protocols and things like that in NTP.
So, what you'd want to do is, what
we'll do this example is we'll create a crypto ACL that
says permit from 10 to 10 and then we'll
deny everything else.
And that way only the traffic that's
going from the 10 networks to the other 10 networks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going from the 10 networks to the other 10 networks
will be encrypting.
They'll match the encryption policy and everything else
won't.
So, the hard way of learning that is accidentally
making that crypto ACL too loose and having it
include protocols where your router says,
oh, I should encrypt this, it says it encrypted,
and the other side is not expecting it to be encrypted.
And that's a problem.
So, a word of caution is be sure you have a good plan
and only permit those specific protocols and addresses
that you want to in a get VPN crypto ACL.
And then the binding glue that takes
the IPsec profile and the crypto ACL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the IPsec profile and the crypto ACL
and bundles it all together is called
a GDOI, a group domain of interpretation, group
and in the configuration on the key server in that group,
we're going to specify the IP address of the key server,
we're going to specify an identity number, we're going
to specify rekey information regarding
the frequency of the rekeys and how we want to rekey,
are we going to do it with multicast or unicast.
And also, as part of the rekey we're
going to specify the RSA key pair
that we want to use on that key server
as part of that rekeying.
So, the configuration and the binding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, the configuration and the binding
of all that, I will walk you through in a couple
videos from now, but I wanted to give us a
heads up on the elements of what would
be expected to be configured on the key server.
So, that's a good, pretty high-level picture
of some of the configuration elements
we want to implement on our key server
and then overwrite the group members that configuration
is very small.
It basically says, hey, you're participating in get VPN.
You're part of this GDOI, the group
domain of interpretation group, and here's your key server, go.
And he goes, authenticates, gets the policy, and goes to work.
So, we'll turn our attention to the key server WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, we'll turn our attention to the key server
first and its configuration.
Then after that, after it's all setup,
we'll then go to the individual group members
and implement those as well.
So, we'll start the key server configuration
and I'll walk you through all the config
on that in the next video.
So, I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.