One of the challenges of working with FlexVPN
is that there are a lot of individual pieces and parts
that can be tweaked or modified, and that's partly also in place
because it uses IKE version 2.
So what I'd like to do in this video
is walk you through and introduce you
to some of those components and pieces regarding IKE version
2, which is heavily relied on by FlexVPN.
So let's begin by taking a look at IKEv2 specific components
in the configs that if we're using the defaults,
we still want to be aware of.
So let's take a look at these.
We'll just do one at a time. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll just do one at a time.
And let's start with policy.
What exactly is an IKEv2 policy, and do I need to create one?
Let's take a look at what the default is, and then we
can make a decision-- do we need to create one or modify that,
or can we use the default IKEv2 policy?
So on a router and this router has not
been configured with IKE version 2 yet.
So we do a show crypto and IKEv2 and a question mark.
And let's go ahead and ask for seeing the policies that exist.
So we do a show crypto IKEv2 policy and press Enter.
That is the default policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That is the default policy.
Da-da-da-da!
So here are the details for the default IKEv2 policy--
Match front door VRF.
So if you're using VRFs, and you're
specifying one VRF that you want to use for your IKEv2 policy,
you can specify that.
But by default, it says any VRFs will do.
Match address?
Any address.
I don't care.
And the proposal?
Default. So what this IKEv2 policy says
is that I'm really open, and I want
to use a proposal called default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to use a proposal called default.
Now the next question is, what is the IKEv2 proposal default,
and what does it include?
I'm glad you asked.
That's next on our list.
Let's take a look.
So the proposals are about the negotiation,
what we're willing to use for the IKEv2 SA, which
is another way of saying the security association for IKEv2.
So we're going to specify or use the defaults regarding
encryption and hashing and also the Diffie-Hellman Group.
And if we want to see what the default proposal is,
we can just go to the CLI and take a look. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can just go to the CLI and take a look.
So the default policy says that we want
to use the default proposal.
So to see the default proposal, we
do to show crypto IKEv2 and proposal.
And there it is.
So what this says is that regarding encryption we're
willing to do AES 256, AES 192, and AES 128.
For data integrity, we're willing to do
SHA in these flavors.
The PRF is a pseudo-random function that's used.
And here's the Diffie-Hellman Group.
So here we have Diffie-Hellman Group five and also
Diffie-Hellman Group two.
So if we're OK with those proposals WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we're OK with those proposals
we don't need to tweak them, but we could do this.
We could either create a brand new IKEv2 proposal
and specify that to be used.
Or we could modify the default, and it'll give us a warning too
if we do that.
But we could modify the default and specify, hey,
you know what we want to use Diffie-Hellman Group 16,
and then that would become part of the default IKEv2 proposal.
Now, next on our list is a profile.
So there is a default policy, there's a default proposal,
but regarding the profile itself,
there's no default profile. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's no default profile.
A profile is going to specify the details for the router.
It could include things such as the local identity
of this device based on IP, or if we're
using digital certificates, like a fully qualified domain
name or other elements, then we can
specify for the device itself.
It can also specify in a profile a match statement saying, OK,
I want to use this profile if I'm
matching with a peer at this IP address
or a peer using this fully qualified domain name or a peer
with a certain email address.
So if we're using RSA signature, and we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we're using RSA signature, and we
have digital certificates that are being shared,
we can pull and match on that detail as well.
And then, as part of the profile,
we can also say, OK, great based on matching
with this peer I want to go ahead and use
this specific key.
Except in IKE version 2, we don't just
specify the key we actually point to a keyring
think of a keyring.
Think of a keyring like a set of keys
that you can pull out on a single ring and use it.
So if you had 15 different peers,
and you had 15 different sets of keys, pre-shared keys you're
going to use, you can have 15 different keyrings, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to use, you can have 15 different keyrings,
and you just pick from the right keyring or authenticating
with that peer.
Now, in addition to our IKEv2 specific information
that we just went over, we also have our IPsec profiles.
Now, IPsec profiles are very similar to what
we had with IKE version 1.
So we have a transform set or we use the default.
We can also refer in an IPsec profile, which IKE version 2
profile we want to use.
So that way, if we apply an IPsec profile
to let's say a tunnel interface, tunnel interface 0 right
here, when it's out negotiating and talking with other devices, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here, when it's out negotiating and talking with other devices,
it knows the IPsec profile it should use,
which includes who it's going to match with.
And based on that, what keyrings it's
expecting to use for that authentication if we're doing
pre-shared keys, or for using RSA
signatures and digital certificates
the profile can have those details
as well regarding matching any authentication with a given
peer.
Now, if you're thinking, wow, Keith, that's
a lot of pieces and parts.
You're right, you're right.
It makes a good business case for
Software-Defined networking.
In any event, what we're going to do in the next video is
I'd like to walk you through the design phase WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'd like to walk you through the design phase
for a site the site tunnel using FlexVPNs.
And then, you and I can follow that up, that design session,
with the implementation to help reinforce
the concepts that we're learning in this set of videos.
So I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.