Now, one of the benefits of using GET VPN
is that all that policy is on the key server.
So the crypto ACL, the transforms, the policies,
we don't have to specify all the detail on the group members.
All we have to do is tell the group members
about IKE phase 1, who the key server is,
and which interface to pay attention
to regarding encrypting and decrypting traffic.
And that's it.
All the policy and details will be rained down
from the key server to the group member.
So to calibrate where we're at, we've
got R1, R2, and R3 that are going to be GMs, Group Members. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
got R1, R2, and R3 that are going to be GMs, Group Members.
So we're going to need to configure
IKE phase 1 policies that are compatible with the key server
so we can build that secure channel with it.
We also need to specify what group we intend on joining.
So when we talk to the key server, we can say,
hey, we're supposed to join this group.
The other element is we're going to apply a crypto
map to the transport network interfaces.
So if this is our MPLS network and we've got our service
provider for our PEs here and R2 is a customer edge,
we would want to apply that crypto map to 0/2.
On R1 we're going to apply it to 0/1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
On R1 we're going to apply it to 0/1.
And R3 is going to be 0/3.
So that's really the biggest difference
between the configuration of these three group members
is what interface gets--
G-E-Ts-- what interface gets the crypto map that
actually applies this policy as they
encrypt and decrypt traffic using the rules
pushed down to them from the key server.
So let's take a look at the configs,
and then we'll deploy it.
So if we were going to take a look
at the full config for a group member,
this is the IKE phase 1 policy.
There is the pre-shared key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There is the pre-shared key.
So all of this is identical to what's over on the key server.
And then what we're going to do is
we are going to create this gdoi group.
We'll name it GETVPN-Group.
We're going to do the identity number that
matches the gdoi group that we have on the key server.
And then we're going to specify who the key server is.
Bada bing, bada boom.
So once we have this group defined we are then
going to create a crypto map.
Now, you might think, wow, we created crypto maps for,
like, the legacy site-to-site VPN tunnels with IPsec.
We did.
But instead of using the ISAKMP option with the crypto map, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But instead of using the ISAKMP option with the crypto map,
check this out.
We are going to specify gdoi.
So this is sequence number 10 in this crypto map called GM-Map.
And we're using gdoi.
And then we're going to specify the group.
So that group we created we'll just
pop right there, which includes the identity
number for that group, and also the key server address.
Then we're going to go to that exit interface of g0/1.
And we're going to apply that crypto map, crypto map GM-Map.
And then once we do that, this router is going to go,
whoa, I need to go ahead and I need to talk to the key server.
It's going to negotiate IKE phase 1, rain down WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's going to negotiate IKE phase 1, rain down
all the information, including the policies.
And once it does so, it'll be a fully functional member
with all the keys and crypto ACLs and everything
it needs to implement the GET VPN encryption.
So let's take that configuration.
We'll copy it, and we'll get R1.
And we will paste it in.
Look at that.
So it says right here, TEK_UPDATED.
That's the Traffic Encryption Key.
The KEK is the Key Encryption Key
that we're going to use for the rekeying.
It registered with the key server right there.
It registered to key server at 4.4.4.4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It registered to key server at 4.4.4.4.
And it installed policies.
I love it when a plan comes together.
Let's do a show crypto and gdoi, and press Enter.
So it shows the group identity.
It shows the name of the group.
It has the sever list of 4.4.4.4.
Here it's showing us the details about its IP address.
This is R1's address.
And UDP port 848.
And it's communicating with the server at 4.4.4.4
also using 848.
So if we were using a protocol analyzer,
we'd see UDP packets with port 848 being used. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'd see UDP packets with port 848 being used.
It's currently registered.
Fantastic.
And if we continue scrolling down,
here it has the access list that it got from the key server.
Traffic from 10 going 10.
So for the key encryption key policy,
we didn't really specify that.
I'm checking the defaults here.
We specified an IKE phase 1 policy.
We also did the IKE phase 2 or IPsec policy up
on the key server.
But as far as the KEK policy, it just took the defaults,
including 3DES and the hashing.
That's for the private conversation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's for the private conversation
during rekeying that's going to happen between a group
member and the key server.
And then going down here to the TEK, the Traffic Encryption
Key, that's based on the IPsec profile that we created,
including the transform set that's in that profile.
So on the transform set on the key server,
we specified AES 128, which is the default here.
That's why it's not showing the number.
And we also specified esp-sha-hmac.
It also has the time remaining of 3,569 seconds.
And that's because we specified for IPsec of the key server
we specified 3,600 seconds. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we specified 3,600 seconds.
And so the clock is ticking.
And the life time is getting shorter and shorter
as we go forward.
And then the anti-replay, we specified 5 seconds.
And that's why it's showing up right here as well.
So with that in place, let's go ahead
and do the other two group members, R2 and R3.
Virtually identical configurations,
except we are going to specify the correct egress interface,
the interface that's facing the transport network.
And for router 2, we'll take the exact same config.
The only difference here is that the interface
we're applying the crypto map is going to be g0/2.
So I'll right-click, copy, and paste that in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll right-click, copy, and paste that in.
Awesome.
We have very positive messages there regarding
getting the keys involved, and the policy.
And let's go to R3 and do the same thing.
So here on R3, we'll take that configuration.
Again, the only difference here is
that we're going to g0/3 to apply the crypto map.
We'll copy that, and paste it in.
And sure enough, we start the registration.
We got the TEK, the Traffic Encryption Key.
We got the KEK, the Key Encryption Key.
Registration was successful.
And we also got the policies installed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we also got the policies installed.
So if we were to do a show crypto gdoi or we
could use a question mark, and we
could do like a GM for Group Membership, and press Enter.
And that shows us that we are a member of the group.
In the previous video, we looked at the master of all the keys,
and that is the key server.
In this video, we configured the group members
to talk to the key server.
And in the next video, I'd like to walk
through some additional verification
that the GET VPN is actually working.
I'll see you in that next video in just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.