In this video, I'd like to sit down with you for a moment
and let's do some planning on the details
that we'll use for a site-to-site VPN using
FlexVPN and IPsec.
And then in the next video, we'll
actually implement our plan.
So, here's what I recommend we do.
Based on the previous video the IKEv2 policy, which
is wide open, the default policy,
that'll work for our purposes, so let's use that.
It basically says the--
D-E-A-F-U, L, T, there we go--
the default IKE version 2 policy says,
you know what I'm willing to use from any front door VRF that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you know what I'm willing to use from any front door VRF that
will work, any IP address, and I'm
going use the default proposal.
OK, great so we'll just use that default IKEv2 policy,
we don't have to modify it at all.
Now, that default policy is pointing and using
the default proposal.
Which, what I'd like to do is let's use that default
proposal, but let's tweak it.
Let's modify that default proposal
and let's use Diffie-Hellman group 16 because that currently
is not in the set of proposals.
I'd like it to be, so let's modify the default proposal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'd like it to be, so let's modify the default proposal
and we'll tell it to include Diffie-Hellman group 16.
For the profile on these routers, router 1 and router 2,
let's specify a few basics.
Let's say that we're going to do some matching
and let's match on each other's IP address.
So let's match on 25.2.2.2 and R2 will match on 15.1.1.1.
and if that's a match, let's also
specify that for authentication we're
going to use pre-shared keys.
And as part of that configuration for the profile WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as part of that configuration for the profile
we will specify a keyring.
Now, the keyring, which is going to be called upon,
we need to create that too.
So, let's create a keyring and we can just call it IOS-Keys.
And inside that keyring we'll specify the pre-shared key
we want them to use with each other.
And the keys, you can also specify a local and remote key,
so you can have R1 use one key for authenticating
R2 and R2 can use a different key for authenticating R1.
They could be symmetrical and that's what we're going to do,
but they don't have to be. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but they don't have to be.
You can actually specify a local and remote password
that you're going to use as part of the keyring.
And then for the IPsec profile down here,
let's create a transform set so we're not using the default.
And for encryption let's use AES-256
and for data integrity let's use HMAC, which is hashed message
authentication code, we'll use SHA-512 because all
my routers will support those.
In the proposals for IKEv2 it's also
going to have information about encryption and data integrity. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to have information about encryption and data integrity.
So, I want to point out that even though this is IKEv2,
the proposals up here are for the IKEv2 security association
and the proposals down here are for the actual IPsec security
association.
So, it's a lot like if you whisper and don't tell
too many people, it's a lot like the IKE phase
one elements for encryption and IKE phase two,
but because it's IKE version 2, we now just
call it the IKE version 2 security association and then
the IPsec security association.
But we could have different encryptions
and different hashing for each of those sets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and different hashing for each of those sets.
And then as part of our IPsec profile
we'll specify that we want to include, or specify
this profile which says who are matching with who the keys will
be, and that way we can actually build
the IPsec tunnel between them.
Also, one other element that we want to plan on,
we could use VTIs, virtual tunnel interfaces,
which is just making a tunnel interface.
And then on that tunnel interface
the default encapsulation is GRE,
but if we use the tunnel mode IPsec,
space IPv4, then instead of using GRE it'll just use IPsec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
space IPv4, then instead of using GRE it'll just use IPsec.
So, as a plan let's do that as well.
So, as we specify that tunnel motive IPsec
we'll also apply the IPsec profile
to that tunnel interface so it'll know
how to protect the traffic.
So, with that plan in mind, I'd like
to walk you through in the next video
step by step the implementation of those components
as part of FlexVPN.
So, I look forward to seeing you there in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'd like to thank you for viewing.