All right.
It is time to configure.
We're going to start our configuration over
on R1, which is on the left-hand side of our topology.
And then we'll finish it up with configuring the FlexVPN
and IKEv2 information over on R2.
Let's get to work.
Here on R1 I'm going to go ahead and do
just a little housekeeping.
I'm adding a loopback address of 1.1.1.1 for reachability
after we have our routing protocol running.
And I'm also setting the width of the console
to 100, because that way if I'm typing in a fairly long command
it won't truncate it.
So you can see the whole thing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you can see the whole thing.
We can scroll left and right to go ahead and see it.
Now, we mentioned that we want to use the default policy.
So for IKEv2, let's take a look at what that policy is.
It says, match any front door VRF, match any local address,
and use the IKEv2 proposal called default. Super.
We agree we're going to leave all that is.
And let's also take a look at the IKEv2 proposal
just to confirm what's there.
And here is the proposal for IKEv2.
It says, for the IKEv2 security association here's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It says, for the IKEv2 security association here's
what I want you to do for encryption or data integrity.
Here's a pseudo random thing it does as well.
And then here's the Diffie-Hellman group.
And we do want to modify that so that we
can include group 16, because both my routers support it.
So let's do that now.
We'll go ahead and type in crypto ikev2 proposal default.
It gives me a warning, saying, whoa, you're
about to tweak the default. And we say, yeah, we know.
That's why we're here.
So we'll say group.
And I think we support-- yeah, let's do group 16.
Let's make sure we do it on both sides. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's make sure we do it on both sides.
And then if we type in exit and hit the up arrow a few times
to do a show crypto ikev2 proposal,
now I've just replaced the default
with that Diffie-Hellman group 16.
OK.
Fantastic.
Now, as far as the keys go, we need a key ring
that can support the pre-shared key authentication we
are going to do.
And so to do that, the syntax is crypto ikev2 keyring.
You name it, and then you say who the peer's going to be.
You specify the address of who that peer is.
And then you specify the key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then you specify the key.
Now, there's also options for specifying
a local key and a remote key if those keys happen
to be different.
But in my case, it's going to be the same key for both sides.
So I'm just using one line to get it done.
And there is our keyring called IOS-Keys.
So we'll exit out of keyring configuration mode.
Next, let's create our IKEv2 profile.
And we'll name this Our-v2-Profile.
So here is the syntax right here.
Crypto ikev2 profile, I named it.
And then it's specifying, hey, you need a couple things.
So yeah, give me a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So yeah, give me a moment.
Here we go.
So here's my match identity.
So I'm matching on 25.2.2.2, which
is the reachable address on R2 that I'm going
to be using for the identity.
Then I'm specifying that for the authentication
for the remote side using the pre-shared key,
and authentication local pre-shared key.
And I'm using the same key on both sides.
So as far as the keyring, I didn't
need to specify a different key for local and a different key
for remote.
And then because I said use a pre-shared key
for authentication, I also referred to the keyring
we created just a few moments ago, keyring local IOS-Keys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we created just a few moments ago, keyring local IOS-Keys.
That's this keyring right here.
So we'll press Enter.
And then we'll type exit to exit out of IKEv2 profile
configuration mode.
So let's go through our checklist.
We are using the default policy.
We tweaked the proposal to include Diffie-Hellman group
16.
We just created the profile.
We created the keyring.
That all looks good.
Let's go down to the IPsec profile.
And for the transform set, unless we
want to use the default, which is not part of our plan,
we need to create the IPsec transform set, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we need to create the IPsec transform set,
and then include it inside the IPsec profile,
along with the IKEv2 profile that we want to associate
in this IPsec profile.
So to create the transform, set the syntax
is crypto ipsec transform-set.
And then I'm going to name this Our-Set
and use AES 256 and SHA 512 HMAC for hash message authentication
code.
And I'm also going to set the mode to be tunnel.
And then exit.
So there's our transform set, just like it was previously
before IKEv2.
And now what we'll do is we'll create an IPsec profile that'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now what we'll do is we'll create an IPsec profile that'll
include that transform set.
And it'll also include the IKEv2 profile we
created just a few moments ago.
So to do that, we'll type in crypto ipsec profile
Our-IPsec-Profile.
We're creating a brand new IPsec profile.
And then we're including in that profile the transform set
that we just made, and also the IKEv2 profile that we
made previously right up here.
So our next step on this router is
to create a tunnel interface, interface tunnel 0.
And we'll specify an IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll specify an IP address.
Let's use 10.12.12.1 with a 24-bit mask, and over on R2
we'll do 10.12.12.2 with the 24-bit mask.
We'll specify the tunnel source, the tunnel destination.
We've done this before with tunnel interfaces.
And what we'll also do is we'll specify the mode.
Instead of GRE, we'll say tunnel mode IPsec for IPv4.
And we'll also apply that tunnel protection profile,
the IPsec profile, for the encryption
to actually kick in and take place on the tunnel interface.
And here's the config for exactly that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here's the config for exactly that.
So we have the IP address on the tunnel, the source,
the destination, and tunnel mode ipsec ipv4 as opposed to GRE.
And then the tunnel protection profile
called Our-IPsec-Profile that we just made a few moments
ago right here.
So half of a tunnel is done, the R1 side.
And we're going to do the equivalent configuration over
on R2.
So the flip side of that would be virtually identical,
everything except for the IP addresses
and the peers involved, as far as who
is the peer on the other side. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the peer on the other side.
So what I'll do is I'll put in that configuration over on R2,
and then in the next video, once that's applied,
let's walk through some basic steps
just to make sure that our IPsec is working here with IKEv2
implemented as part of FlexVPN.
So I look forward to seeing you in the next video
as we verify the IPsec tunnel together.
See you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.