So now with our basic connectivity at the T0 set,
so we have connectivity to the 78 network,
let's spend a moment here at the Cisco router and make sure
its configs are good to go as well.
So here is that external Cisco router.
Let me just do a couple of quick checks to verify what it currently has in
place.
Let's do a show IP interface brief.
Just take a look at what IP addresses it has.
So here is the interface connected to VLAN78.
It has the IP address of 780010.
So right from here is the basic check,
we can do a ping to 78.0.60. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can do a ping to 78.0.60.
That's the virtual IP address at the T0 gateway.
That's a very good sign just to make sure we're on the same layer 2 broadcast
domain
with compatible IP addressing based on our plan.
So to expedite the process here on the Cisco router,
if you need more training on Cisco,
please check out our other courses and skills at CBT Nuggets.
But for now, let me go ahead and share with you what I'm going to put in,
and then we'll take a look at some of the highlights.
To do that, I am going to cut and paste.
I'm using secure CRT, so it's going to give me an option of checking out all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm using secure CRT, so it's going to give me an option of checking out all
the commands
we're about to paste in.
And here they are.
So here are some highlights.
I'm making a loopback interface just so we have some reachable target on this
Cisco router.
So it'll have an IP address of 10, 8, 0, 10 on a loopback interface.
And then I'll represent a reachable device here on this 10, 8, 0 network.
So for the loopback interface is 10, 8, 0, 10.
And then here I'm setting up the details for effectively the control tunnel
for IP sec.
So I'm going to be using Ike version one.
And as a result, this is also called the Ike phase one tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as a result, this is also called the Ike phase one tunnel.
And there is our encryption that we want to negotiate using AES 128.
Here's our hashing of shop 256.
This specifies we want to use a pre shared key.
This specifies when I use Diffie Helma group 14.
And this specifies for a lifetime that we want to use one day, which is 86,400
seconds.
And then assuming we negotiate that OK,
here is the key that I'm willing to use with another peer.
So this is a wild card.
So effectively this device, this router will use this pre shared key with any WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So effectively this device, this router will use this pre shared key with any
other device
during Ike phase one who negotiates with it.
So we'll make sure when we configure the tier zero gateway and NSX,
we'll use that same pre shared key.
And then here I add the details for on the Cisco side, our IP sec tunnel using
AES 128
and shop 256.
And then here's how I'm specifying the interesting traffic.
So from the router's perspective, we want to encrypt traffic.
If it's coming from the 1080 network going to the 1033 zero network.
So to help reinforce what that looks like, we're telling this router right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to help reinforce what that looks like, we're telling this router right here
,
the traffic from 1080 anything.
If it's destined for 1033 zero, that's effectively the policy that it should
use
to send that traffic over the IP sec tunnel encrypted, where the receiver,
the T zero gateway can decrypt it, and then continue forwarding it down to the
VM.
And then with like phase one, I'm going to be using this crypto map
to link everything together.
So our crypto map is saying, if the traffic matches that pattern,
1080 going to 1033 zero from the router's perspective, go ahead and set your WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
1080 going to 1033 zero from the router's perspective, go ahead and set your
peer
to 708060, which is the virtual IP address we just configured on the T zero
gateway.
We're going to specify the details for IP sec tunnel, which is the details we
set up
here in this transform set.
And this command right here applies that crypto map to this interface.
So I'm removing it in case we have to do it a couple of times.
And then I'm going to go ahead and put it back on right here.
And then I have a route on this router that says, hey, to get to the 1033
network
over behind the T zero gateway, send it over to 708060.
So based on that routing, that would trigger off the initiation of the IKE WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on that routing, that would trigger off the initiation of the IKE
phase one tunnel
and assuming that goes well, it would then create the IP sec tunnel.
So from the router's perspective, it would look like this if it's all
successful.
And again, that's also presuming that we configure everything correctly over
here
at the T zero gateway.
So those are all the commands I'm about to push into this router right now.
So I'll go ahead and click on paste.
And there they go.
All those commands are now applied to this router.
And just for some basic connectivity testing, if you did a ping
over to the virtual IP address of 78 dot 0 dot 0 dot 60, we should be able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over to the virtual IP address of 78 dot 0 dot 0 dot 60, we should be able to
get a response.
Fantastic.
And if we did a debug here on the Cisco router, let's do a debug crypto ISOCamp
and press
center, those show us the nitty gritty detail for everything is trying to
negotiate for the
tunnel.
Now prior to setting it up over at the here's zero gateway, if we did a ping,
for example,
to 10 dot 33 dot 0 dot 60, and then just confirm an our topologies, that's the
IP address I have
on the interface here for this T zero gateway as it connects to the segment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the interface here for this T zero gateway as it connects to the segment.
Now, if I just ping it, it's going to source it from this interface right here
by default.
But if I tell the router, hey, source it from the interface where you have the
IP address 10
eight zero 10, then because it's coming from 10 eight zero and going to 10 33
zero,
this router is going to try to initiate an Ike phase one tunnel based on how we
have it configured.
However, because the T zero gateway is not yet configured for Ike and to
support that yet,
it should all fail.
But we'll be able to see it here because we have the debug's in place.
So with those debug's in place, let's do a ping to 10 33 0 60 and we'll source WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So with those debug's in place, let's do a ping to 10 33 0 60 and we'll source
it from our
loopback address of 10 dot eight dot zero dot 10. And that should figure the
Ike negotiation.
So that's what we're seeing right here. And it's failing because the other side
is not yet set up.
So UDP port 500 is the initial port we use to start the ball rolling with the
Ike phase one tunnel.
So it failed one of five times and that was going to 205. All right, so we can
come back to the
CLI later and take a look at this once we get the tier zero gateway set up and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
CLI later and take a look at this once we get the tier zero gateway set up and
running.
So on this router right now, if we do a show crypto, I secamp essay for
security association,
here it says no state effectively, it's not working. All right, so with our
router configured
and ready to go, our next step is to configure the IP set components here on
our tier zero gateway
to tell it to peer up and be willing to communicate with this router over here
on the right to build
our IP sector. So we'll continue configuring at T zero in the very next video.
So I'll see you there
in just a moment.