So now with our Cisco router ready to go,
it's time for us to configure the T0 gateway here in NSX
to be ready and willing and able to use these protocols
for the initial tunnel and these protocols for the APSect tunnel.
And if we get everything correct,
we'll have a nice beautiful IPsec site-site tunnel
that we can then start using between 1033-0 over here
off of the NSX side of the house
and devices over here on the 1080 network behind the router.
So to configure the IPsec VPN here in the NSX manager, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to configure the IPsec VPN here in the NSX manager,
we're going to go to networking.
And then on the left, under network services,
we're going to click on VPN.
So that's where we are.
I'm going to go ahead and collapse that left-hand side,
give us a little bit more room here.
And you'll notice here under VPN, we have several options.
We have profiles.
And this is where we can set the profiles.
Basically, you think of it like the set of what we want to do
for the initial tunnel, the ICke profiles, the IPsec profiles,
and there's also one for dead peer detection profiles.
Should we choose to use it?
So one of our options is we could go ahead and specify
all these parameters here one by one for each of the ICke WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all these parameters here one by one for each of the ICke
and IPsec profiles, or we could actually walk through
the configuration and then on demand, go ahead and simply
create the profiles that we need.
We also are going to need an endpoint for the local T0 gateway.
So once again, we could click on add local endpoint right here
and do it, or we could just do it as part of the process
on demand as we need it.
So let's start off on the very far left with VPN services
and we'll click on add service.
From the dropdown, we have our options of IPsec,
L2VPN server, L2VPN client, and for this set of videos WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
L2VPN server, L2VPN client, and for this set of videos
in the skill, we're focused on IPsec site site tunnels.
So we're going to create an IPsec VPN service.
So let's call this lab IPsec VPN service.
That way when we see it, we know exactly what it is.
And for the gateway we want to associate this with,
we only have one that's our red tier zero gateway.
So we'll select that.
And then I'm going to go ahead and leave everything else
at their defaults.
So we'll click on save.
And now we effectively have this service, this VPN service
for IPsec that's associated with our red tier zero gateway, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for IPsec that's associated with our red tier zero gateway,
but there's not a lot going on with it yet.
Including we don't have any specific IPsec sessions
associated with the service, for example, the IPsec session
that we want to set up between this tier zero gateway
and the external router.
So right here, still in editing mode,
we could click under sessions, we could click on set,
and effectively it'll give us the opportunity
to create the IPsec session information.
And then as we proceed, we'll also be able to specify
the profiles and the endpoints as well,
all from within this interface.
So once we're done here, we'll go back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So once we're done here, we'll go back
and take a look at the individual components.
So under sessions, let's click on set.
Again, we're still in edit mode.
And we'll click right here and add IPsec session.
And it's going to be policy based.
And let's call this IPsec session to Cisco.
And then for the local endpoint, if you hit the dropdown,
there are no local endpoints yet, but we could go ahead
and click on the three dots and simply create one right here.
So for this local endpoint, let's call this red key zero endpoint.
And then for this endpoint, let's use the IP address
that we're going to be terminating the IPsec tunnel on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we're going to be terminating the IPsec tunnel on.
And that is on the tier zero gateway 78.0.0.60.
That's the virtual IP address.
If we're using certificates, we could specify our certificate
for us for excuse pre shared keys.
And then down here for the local ID,
if we're going to use a local ID that's different
than the IP address that we're using to peer with,
we could go ahead and specify a different value down here.
Now, for our site site tunnel, the local ID
is going to be the same as the IP address
and the similar concept over at the Cisco router.
So the local ID is going to be 78.0060 here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the local ID is going to be 78.0060 here
and then click on save.
So here for this IPsec session,
we now specify the local endpoint.
The remote IP address is going to be our Cisco router
reachable address, which is 78.0.0.10.
Then for the authentication mode, if we're using pre shared keys,
we select PSK for pre shared key
and then it's asking us to enter the pre shared key.
So over at the Cisco side, we used Cisco 123.
So here at our NSX tier zero gateway,
I'm going to put in the same key
that I use over at the Cisco router. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that I use over at the Cisco router.
And that way if the keys match,
they'll successfully complete the authentication
of the iKphase one tunnel.
So I've just put in that password, let's take a peek,
Cisco exclamation mark two three fantastic.
That's the same password I put over at the Cisco router.
And then for the remote ID,
if you're using a different IP address
than the remote IP you're connecting to,
you could put the remote ID here.
If you don't put any value here,
it's just assumes that the remote ID is the same
as the remote peers IP address.
So I'm going to leave that blank.
And if we scroll down, here's where we can specify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we scroll down, here's where we can specify
other advanced properties,
the individual profiles we want to use
for the initial control tunnel, the iKtunnel,
as well as the protocols we want to use for the IPsec tunnel.
So if we want to view what these values are,
we can click on the three dots and click on view.
And then showing us the details,
which don't match up with what we want.
So AES is good,
Shot to 56 is good, Group 14 is good,
but we don't want iK version two, I want iK version one.
So I'm going to go ahead and close that.
And I am not going to use that profile.
Let's go ahead and just create a new iK profile right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go ahead and just create a new iK profile right here
by clicking on the three dots and clicking on create new.
We'll call this our iK profile.
And for the version, we're using version one.
And you might say, Keith, why is that?
Well, at the Cisco side,
it's about half the configuration to use iK version one.
And that's currently what we have over on that Cisco router.
So I just want to match what we're currently doing over there
so that we can create a successful initial iK tunnel.
And then for the encryption AES 128,
for the hashing Shot to 56,
Diffie-Hellman Group 14, that all looks great.
And for the lifetime, 86,400 seconds, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the lifetime, 86,400 seconds,
that looks great too.
And we'll click on save.
So the details for our initial tunnel are set.
So for the IPsec tunnel,
let's click on the three dots and click on view.
And here we're close, but we have PFS as one of the things
that would cause us a problem
because over at the Cisco side,
I did not enable PFS.
So we'll click on close there.
I'll say, I don't want to use that one.
And let's create a new IPsec profile
that matches what our Cisco device is currently set up for.
So we'll click on create new,
we'll call this lab IPsec profile.
And for the encryption, we'll use AES 128. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for the encryption, we'll use AES 128.
And we could specify more than just one encryption algorithm here.
And that would become part of what this device,
this tier zero gateway is willing to negotiate.
So because I know the other side is only doing AES 128,
I'll specify that for the encryption,
for the IPsec tunnel, for the hashing,
I'm using SHA-256 and I'm not using PFS,
I'm gonna turn it off here as well.
And for the lifetime, hopefully the lifetime
on the other side is gonna be compatible with that.
I think it might be, we'll find out here in a minute
and we'll click on save. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we'll click on save.
So now we have our iq profile, our IPsec profile,
and for dead peer detection, let's take a look at that.
So we'll click on view.
So a dead peer detection,
this will be says this side is gonna send a little probe
every 60 seconds, just to verify that the tunnel is up
and active, I'm gonna go ahead and leave that on.
So we'll go ahead and leave that profile.
Now, before we leave the config,
we also need to specify the subnets
that we're trying to protect.
So here it says, what are the local networks
and the remote networks?
So let's take a look at our topology.
So here in our topology, the local network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in our topology, the local network
from the perspective of this T zero gateway
is 1033 zero going to 1080.
So we'd wanna specify those two networks as the local
from the T zero side and the remote.
So for the local networks, it is 10.33.0
with a 24-bit mask.
And for the remote network that we wanna protect,
it is 10.8.0 with a 24-bit mask.
So that's one of the negatives of doing
policy-based IPsec VPNs,
because if you add additional networks,
you also would need to come back to your VPN configuration
and specify that you also wanna provide protection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and specify that you also wanna provide protection
for those networks.
Or you could also have each site using, for example,
a block of the 10 network address space,
like 10, 1/16 for site one and 10, 2/16 for site two
and have summary addresses, that would also work.
So for our demo, we wanna protect traffic
between these two networks.
So we'll specify those here, we'll scroll down
and click on save and click on close.
And let's go into the CLI at the router.
So back at the Cisco router,
because I had the debug on, check it out. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because I had the debug on, check it out.
If we scroll up here, here is in the process
of doing the negotiation for the initial Ike tunnel.
And here it says Ike phase one complete.
So that was successful.
And if we scroll down, it then went to work
in setting up and negotiating the actual IPsec tunnel.
So an Ike version one, and this message right here
with the phase two complete indicates that that is all done.
So if we did a show crypto ISA-CAMP SA detail here
at the Cisco side, this is showing us the details
for the actual Ike phase one tunnel WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for the actual Ike phase one tunnel
with AES for the encryption, shot 56,
pre shared key, Diffie-Hellman 14.
And if we wanna look at the details
for the actual IPsec security association,
we can do a show crypto IPsec SA press enter.
And that shows the details
about the IPsec security association,
including the networks that are being protected.
So traffic from 1080 from the Cisco side,
going to 1033-0 for outbound traffic
is gonna be protected by IPsec.
And at the moment, as far as the IPsec tunnel goes, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And at the moment, as far as the IPsec tunnel goes,
we haven't had any packets encrypted or decrypted
over the IPsec tunnel.
And that's because we haven't had any user traffic yet.
So if we did a show crypto engine connections active,
that's confirming our security association.
So the Ike here is the initial Ike phase one tunnel
or the control tunnel.
And then the other two here are the IPsec security associations.
And there's actually two of them,
they're going in each direction.
So one going from the router to the gateway
and the other one going from the gateway to the router.
And that's what's being represented right here.
And back at the NSX manager WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And back at the NSX manager
with the networking tab selected and VPN on the left,
if we click here on IPsec sessions and expand that
here it's showing success.
That's a very good sign.
If we click right here on view statistics
from the NSX gateway perspective,
this is showing us how much traffic has been encrypted
and decrypted over the IPsec tunnel.
So at the moment, because you don't have any user
setting traffic, these values are all zero.
So we'll click on close there.
Now the next question is, I suppose, is it really working?
Now we looked at it from the Cisco side,
we looked at it from the T0 NSX gateway side WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we looked at it from the T0 NSX gateway side
and they both said, hey, it's up.
But they also said there's zero packets
that have been encrypted and decrypted
going over the IPsec tunnel.
So the next logical step then is to verify
with some live traffic trying to go from 1033.0
over to 10A0 to verify that it's actually going
over the tunnel protected.
And that's exactly what you and I get to do and verify
in the next video.
So I'll see you there in just a moment.