So for our game plan for the IPsec site site VPN, one of the things I noticed
is that if we have two gateways inside of NSX, for example, one at site one and
one at site two, and we use a lot of the defaults, it's just going to work a
lot of the times right out of the box because of all the defaults that are in
place.
So I thought to mix it up just a little bit.
We're going to build for our demo.
We're going to build an IPsec site site tunnel between a tier zero gateway as
part of NSX and an external third party router.
Because that way we'll have to be very specific about what we choose to use, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because that way we'll have to be very specific about what we choose to use,
then make sure it matches over here at the external router.
So we're going to have an initial tunnel.
That's our control tunnel.
So in IKEA version one, that'd be called the IKEA phase one tunnel and IKEA
version two, this is simply called the IKEA tunnel.
Think of it again, like the control tunnel between the gateway here on the left
and the router on the right.
And then we're also going to need the details for the actual IPsec tunnel,
which I will put in this pink color here.
And I'll call that tunnel B.
And that is the IPsec tunnel.
Also in our previous topologies, I was sitting this up, getting ready for a
demo and I realized, oh no, I've got a limited export version of NSX. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
demo and I realized, oh no, I've got a limited export version of NSX.
And as a result, you can't set up the IPsec.
So I rebuilt a new topology and that's what we're going to be using for this
demo.
So as part of NSX, I've got a tier zero gateway right here and I have it in red
because it's my lab three red to help keep my labs different from each other.
And we're going to be working with the T zero gateway and for connectivity,
instead of using the real public internet, I'm going to go ahead and just use a
VLAN that's in my networked environment for the connectivity back and forth WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VLAN that's in my networked environment for the connectivity back and forth
between the T zero gateway over here and the Cisco router over here.
And if we're setting up a IPsec tunnel between two NSX gateways, for example,
one at site one and one on site two, oftentimes we can use a lot of the
defaults.
So for the demo, by setting up an IPsec tunnel between a tier zero gateway and
a third party device, it's going to give us the opportunity to be very granular
and intentional on what we're using for the initial like tunnel and also for
the IPsec tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the glue that's going to tie it all together, I'm going to be using VLAN
78 in my lab topology, and that's the addressing space of 7800 with the 24 bit
mask.
And then over here at tier zero will set up edge one with dot 61 edge to a
thought 62 and a virtual IP address of dot 60 here at the T zero as it connects
to that external network segment.
That'll also be a great refresher on setting up external connectivity for a T
zero gateway. And then over here on the right hand side I've got a Cisco router
that I will logically place on the 78 VLAN as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that I will logically place on the 78 VLAN as well.
And it'll have the IP address ending in dot 10. So the two endpoints of the
tunnel don't have to be on the same subnet. But for convenience in my lab, I'm
going to put them on the same subnet subnet 7800.
In a production environment, if we're using the internet, these need to be two
reachable IP addresses over the public internet.
And for the demonstration, let's do policy based IP [garbled] tunnels where we
specify exactly which subnets we want to encrypt and ship over the IP [garbled]
tunnel.
So the two subnets are going to be the 1033 zero over here off the tier zero WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the two subnets are going to be the 1033 zero over here off the tier zero
gateway and the 1080 network over here off of the Cisco router.
Now, as far as the initial tunnel, let me go ahead and make a note here for
tunnel a, which is our control tunnel. Let's use Ike version one.
And if that's the case, this is also now called the Ike phase one tunnel. And
as far as how we want to configure it, let's go ahead and write the word haggle
out and let's fill in the blanks for hashing.
Let's use Shaw 256. So there's not a default profile that has that for Ike. We WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's use Shaw 256. So there's not a default profile that has that for Ike. We
'll go ahead and configure that here at the T zero gateway.
We'll also do a similar configuration over here at the Cisco router for the
authentication. Let's use a pre shared key.
And for that key, let's go and use the key of Cisco exclamation mark two, three
, and we'll set that same pre shared key on both sides to be used as part of the
authentication.
And then for the Diffie Hellman, let's use Diffie Hellman group 14. So as long
as it's compatible and supported on both sides, Diffie Hellman group 14 should
work great for the establishment of shared secret key material that they can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
work great for the establishment of shared secret key material that they can
then use with the encryption algorithm.
For the encryption algorithm, let's use a yes, 128 on both sides. And then for
the lifetime, let's go ahead and take whatever the default is. And that's one
of those properties where it doesn't have to match identically on both sides.
They'll adjust to whichever side has the lowest value, presuming all the other
parameters are matched up, meaning that they agree on the hashing and the
authentication and the Diffie Hellman group and the encryption.
And then let's put it a line between the Ike tunnel here and the IP sectional WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then let's put it a line between the Ike tunnel here and the IP sectional
below. So for IP sec, which is our tunnel B for encryption. Let's use a es 128.
So the encryption for the IP sectional does not have to be the same as the
initial Ike tunnel. However, in my lab environment, I want to use a very light
encryption.
And that way, if he starts saying lots and lots of traffic, it won't take a
bunch of CPU. And then for the hashing on the IP sec tunnel.
Let's go ahead and I'll see you shop 256. Now the benefit of that also the lab,
if we match the hashing and the encryption is that it's easier to remember in a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we match the hashing and the encryption is that it's easier to remember in a
lab environment, because there are a few parameters.
If we get just one of them off on either side, it'll cause the IP sec tunnel to
not function. And for the lifetime, let's use the default and also for PFS list
not to use PFS.
So I'll just specify over here on the T zero side, no perfect forward secrecy
for the IP sec tunnel. And over here at the Cisco router, I'll go ahead and
also leave off PFS.
All right, so let me check my notes here. I'll quick. We have the IP addresses
we're going to be pairing with 780060 over here and 780010 over here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to be pairing with 780060 over here and 780010 over here.
We have our two subnets that we want to protect. So for our game plan, I think
we have a pretty good start. So in the next video, let's begin our
configuration for starting off at the tier zero gateway.
Gateway in NSX.