In this video, we're going to begin the configuration here on site 3
by making sure we have a VPN service enabled at the T0 gateway.
And because of the previous tunnel we have set up
between this tier 0 gateway and a third-party router,
we're already going to have a VPN service enabled for this tier 0 gateway.
So that part's done.
However, what isn't going to be done yet is the actual VPN session information
that we're going to use between site 3 and site 4.
So let's head over to site 3 and begin our configuration.
So here at the NSX manager for site 3, let's start off by going to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here at the NSX manager for site 3, let's start off by going to the
networking tab.
And then with networking selected right here on the left under network services
,
let's go down and click on VPN.
So with VPN selected right here, I'm going to go ahead and collapse this left
hand column
to give us a little bit more room here in this main page.
And if we expand this current VPN service, it is an IPsec service type.
And effectively, this means that the ability to use IPsec VPNs is enabled
on our tier 0 gateway, which is where it's currently applied.
So if we're to go back to our topology and then here for our tier 0 gateway, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we're to go back to our topology and then here for our tier 0 gateway,
if we hover over services, it's going to indicate that we have VPN services
enabled.
Fantastic.
All right, so let's go back to the VPN section.
I'll collapse the left hand side one more time.
And because we already have this VPN service for IPsec enabled,
we can then proceed to the second tab here and create our new IPsec session
that we're going to use over to site 4.
So this current session is for the IPsec site to site policy based VPN session
that we have between site 3 and our external router. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we have between site 3 and our external router.
And what we want to do is create another one, but this time for us between site
3
and site 4.
So to create a brand new IPsec session, we'll simply click right here and add
IPsec session.
And that's asking us to we want policy based where we're going to specify
explicitly the source and destination networks to protect like we did
previously
or this time we want to go ahead and do route based.
And the biggest difference here with route based is that as part of the
configuration
we are going to put in right here, where says tunnel interface, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to specify the tunnel interface address we want to use at site 3,
which in our case, since I'm right here, let's go ahead and put it in 1034.34
dot
and let's take a look at our notes.
And we want to use on this logical tunnel interface over here at site 3.
We want to use 1034 34 dot 33.
So let's continue with our configuration for the virtual tunnel interface
address
right here on the T zero gateway at site 3 as part of our IPsec session
configuration
that we're doing in preparation to connect over to site 4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we're doing in preparation to connect over to site 4.
So here we'll put 1034 34 dot 33 with a 24 bit mask and that looks good based
on our plan.
And then for the name, I'm going to go ahead and call the name of this IPsec
session
we're creating.
I'm going to go ahead and call it to site 4, meaning this is coming from site 3
going to site 4
and it's route based based on what we selected when we did the drop down.
And then for the VPN service, we only have one VPN service enabled on this tier
zero gateway.
And that is this one called lab IPsec VPN service.
So now we're going to be using that one VPN service as the parent, if you will, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now we're going to be using that one VPN service as the parent, if you will,
for these two
IPsec sessions, the one to our Cisco external router and this new one that we
're creating right now.
Next, it's asking us what the local endpoint address and for our local endpoint
address,
we're going to be using the IP address on site 3, the one that's connecting out
through 23 dot 1 dot 2 dot 30.
So at the moment, if we use a drop down, we don't have that local endpoint set
up.
So what we could do is we could cancel all this, go up to local endpoints and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what we could do is we could cancel all this, go up to local endpoints and
create it or click on the three dots right here and simply create that new
endpoint and use the address 23 dot 1 dot 2 dot 30.
So we'll click on the three dots.
We'll go ahead from the drop down, click on create new right there.
And then I'm going to go ahead and I'm going to name this 23 dot 1 dot 2 dot 30
.
That way, when I see this endpoint, I'll know exactly what's in it.
And so that's going to be the name of it.
And then for the IP address, it's going to be 23 dot 1 dot 2 dot 30.
And then for the local ID right here, it defaults to the IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the local ID right here, it defaults to the IP address.
If you put nothing there, but just for grins, I'm going to put it here as well.
So now the local endpoint address called 23 dot 1 dot 2 to 30 is using the IP
address and local ID of 23 dot 1 dot 2 dot 30, which is perfect for what we
want to do over at site 3.
So with those in place, we'll click on safe.
So we've got the name of this IP succession.
It's route based.
Here's the parent VPN service that we're going to be using on the tier zero
gateway.
Here's the local endpoint name, which also points to 23 dot 1 dot 2 dot 30.
And now it's asking us about the remote IP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now it's asking us about the remote IP.
So for the remote IP, we want to point to the device or the entity that we're
going to be peering with.
So in our case, that's going to be site for at the global reachable address of
24 dot 1 dot 2 dot 40.
And we verified we could ping that earlier.
So for the remote IP address from the perspective of site 3, the remote IP is
going to be 24 dot 1 dot 2 dot 40.
So we'll put that in as the remote IP 24 dot 1 dot 2 dot 40.
And then for the authentication, we're going to be using PSK, which is acronym WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the authentication, we're going to be using PSK, which is acronym
for pre shared key.
So if we select pre shared key as the authentication mode, we then want to go
ahead and put in the pre shared key that we want to use.
So I'll do that right here.
So I've typed in a pre shared key when click on the little eyeball there to see
what it is.
So I'm going to use that as the pre shared key.
And when we go over to site for, I'll use the same pre shared key.
So we've got the name.
It's route based.
There's the parent VPN service.
There's our local endpoint.
There's the remote IP.
Here's the pre shared key.
Here's the IP address we want to use on our end of the logical tunnel that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here's the IP address we want to use on our end of the logical tunnel that we
're also going to be building between us and site for.
And then for the remote ID, it's going to default to the IP address that we're
using for the remote ID.
But if you wanted to, you could also specify here as well.
It's not required, but you can.
And sometimes if you have lots of different VPN tunnels, it's not a bad idea to
hard code everything and that we can be very clear about which ID and which IPs
you're using with which neighbors and which peers.
So then as we scroll down, we have a set of advanced properties.
And that's where we can specify right here under advanced properties what we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's where we can specify right here under advanced properties what we
want to use for the Ike profiles for the initial Ike tunnel and for the IP sec
profile, which is for the IP sec tunnel as well as the dead peer detection
profiles.
So if we use the defaults here and those defaults for the same over on the
other side, they should be totally compatible.
So if we want to view the details in these profiles, we can go ahead and click
on the three dots and click on view.
So the default Ike profile is using Ike version two encryption AES 128 for the
hashing shot to 56 and for Diffie, Hellman Diffie, Hellman group 14 and a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hashing shot to 56 and for Diffie, Hellman Diffie, Hellman group 14 and a
lifetime of 86,400 seconds.
So if we didn't want to use these values for the negotiations of the initial
Ike tunnel, we could go ahead and create our own Ike profile and then use it.
So I'm going to use this default one here for the Ike profile for IP sec
profiles.
I'm going to use the default there as well. Let's go ahead and view it.
It's going to be using AES 128 for the IP sec tunnel.
It's not using any hashing by default as shown right here and it's using PFS
perfect forward secrecy and for calculating the king material for that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
perfect forward secrecy and for calculating the king material for that.
It's using Diffie, Hellman group 14 for the IP sec tunnel and the lifetime is
3600 seconds.
So as long as this is the same information that we're going to be using over at
site four, it's going to be totally compatible.
So I'm going to click on close and we're going to use those two.
We'll also use the default dead peer detection profile as well.
So with all those values in place, we'll simply click on save and then we'll
click on a refresh here and we should expect this to not succeed because the
other side is not yet configured.
So it takes two to tingo when doing IPsec site site VPN tunnels. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it takes two to tingo when doing IPsec site site VPN tunnels.
So again, here's the details that we just set up and based on our game plan, I
think we now have site three as far as the IP sec VPN session information set
up correctly.
So with that set up, our next step is to go ahead and do a very similar
configuration over at site four except for site four.
It's local ID and IP address will be 24 dot 1 dot 2 dot 40 and from its
perspective, the remote ID would be 23 dot 1 dot 2 dot 30.
And for this logical network, we're building between site for and site three in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for this logical network, we're building between site for and site three in
the next video as we configure site for, we'll be using the IP address 103434
dot 44.
All right, so with that in mind, join me in the next video as we begin our
configuration on site for.
[no audio]