WEBVTT

1
00:00.000 --> 00:00.710 align:middle line:84%


2
00:00.710 --> 00:01.880 align:middle line:84%
Welcome back to the video.

3
00:01.880 --> 00:03.980 align:middle line:90%
In this video, let's
imagine that you and I have

4
00:03.980 --> 00:06.650 align:middle line:90%
been contacted by a customer
that's got two locations,

5
00:06.650 --> 00:08.900 align:middle line:90%
and they're trying to implement
a site-to-site tunnel,

6
00:08.900 --> 00:10.020 align:middle line:84%
but it's just not working.

7
00:10.020 --> 00:12.140 align:middle line:90%
And they've asked
us, you and I, if we

8
00:12.140 --> 00:15.560 align:middle line:90%
can step in and maybe give them
some insights on why it's not

9
00:15.560 --> 00:16.290 align:middle line:84%
working.

10
00:16.290 --> 00:18.980 align:middle line:90%
So as we drive over to
site 1, where router 1 is,

11
00:18.980 --> 00:21.230 align:middle line:90%
let's imagine that we've
been given some documentation

12
00:21.230 --> 00:23.930 align:middle line:90%
and configuration information,
and we've been reviewing those.

13
00:23.930 --> 00:25.820 align:middle line:90%
One's driving-- either
you or I are driving.

14
00:25.820 --> 00:27.890 align:middle line:90%
The other person's
reading off the configs.

15
00:27.890 --> 00:29.265 align:middle line:90%
And here's what
we've identified.

16
00:29.265 --> 00:31.160 align:middle line:90%
They are using crypto
maps, which implies
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.265 --> 00:31.160 align:middle line:90%
They are using crypto
maps, which implies

17
00:31.160 --> 00:32.990 align:middle line:84%
they're also using crypto ACLs.

18
00:32.990 --> 00:34.615 align:middle line:90%
And the interesting
traffic that should

19
00:34.615 --> 00:37.010 align:middle line:90%
be encrypted and protected as
anything coming from 10.1.0

20
00:37.010 --> 00:39.800 align:middle line:84%
going to 10.2.0 and vice versa.

21
00:39.800 --> 00:42.273 align:middle line:90%
Here are the interfaces
involved on the routers.

22
00:42.273 --> 00:44.690 align:middle line:90%
And we'll imagine this here
in the middle is the internet.

23
00:44.690 --> 00:46.107 align:middle line:90%
And they've tried
it from this PC.

24
00:46.107 --> 00:49.790 align:middle line:90%
They're trying to go from
10.1.0.50 to 10.2.0.50,

25
00:49.790 --> 00:51.470 align:middle line:90%
and the traffic is
not getting there.

26
00:51.470 --> 00:53.032 align:middle line:84%
Pings don't work, nothing works.

27
00:53.032 --> 00:55.490 align:middle line:90%
One of the reasons could be
that if the cryptography is not

28
00:55.490 --> 00:58.188 align:middle line:90%
working, these private
RFC 1918 addresses

29
00:58.188 --> 01:00.230 align:middle line:90%
absolutely are going to
be blocked by our service
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.188 --> 01:00.230 align:middle line:90%
absolutely are going to
be blocked by our service

30
01:00.230 --> 01:00.730 align:middle line:84%
providers.

31
01:00.730 --> 01:02.546 align:middle line:90%
So unless they make
it into the tunnel,

32
01:02.546 --> 01:04.879 align:middle line:90%
they're not going to be routed
back and forth between R1

33
01:04.879 --> 01:07.190 align:middle line:90%
and R2 over the public
internet if they're not

34
01:07.190 --> 01:08.600 align:middle line:84%
encrypted and encapsulated.

35
01:08.600 --> 01:10.220 align:middle line:90%
So let's imagine
we've just pulled up.

36
01:10.220 --> 01:12.800 align:middle line:90%
That's what we're stepping
into at this customer site.

37
01:12.800 --> 01:14.140 align:middle line:84%
And let's go to work.

38
01:14.140 --> 01:15.140 align:middle line:84%
So we log into router 1.

39
01:15.140 --> 01:17.090 align:middle line:90%
Here's a few commands that
we could do just to make sure

40
01:17.090 --> 01:18.440 align:middle line:84%
about the actual configuration.

41
01:18.440 --> 01:23.620 align:middle line:90%
We could do a show run
pipe section crypto.

42
01:23.620 --> 01:25.280 align:middle line:90%
And that's going to
show us the running

43
01:25.280 --> 01:28.920 align:middle line:90%
configuration with most of the
cryptography-related commands.

44
01:28.920 --> 01:30.770 align:middle line:90%
So here is their
IKE phase 1 policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:28.920 --> 01:30.770 align:middle line:90%
So here is their
IKE phase 1 policy.

45
01:30.770 --> 01:32.690 align:middle line:84%
They are using pre-shared keys.

46
01:32.690 --> 01:35.090 align:middle line:90%
They're willing to use
this key with any peer.

47
01:35.090 --> 01:36.050 align:middle line:84%
That's fine.

48
01:36.050 --> 01:38.360 align:middle line:90%
There's the transform
set for IKE phase 2.

49
01:38.360 --> 01:40.450 align:middle line:90%
There's the crypto map,
sequence number 10.

50
01:40.450 --> 01:43.220 align:middle line:90%
That sets the peer,
sets the transform set,

51
01:43.220 --> 01:45.170 align:middle line:84%
enables perfect forward secrecy.

52
01:45.170 --> 01:47.420 align:middle line:90%
And it's matching
on the Crypto-ACL.

53
01:47.420 --> 01:49.130 align:middle line:90%
And then this command
here is actually

54
01:49.130 --> 01:52.100 align:middle line:90%
that crypto map being applied
to the external interface.

55
01:52.100 --> 01:54.600 align:middle line:90%
And one other command that we
could do that's really helpful

56
01:54.600 --> 01:57.718 align:middle line:90%
as well is a show crypto
map and press Enter.

57
01:57.718 --> 01:59.510 align:middle line:90%
Now, even if you're
not using a crypto map,

58
01:59.510 --> 02:02.670 align:middle line:90%
this command is amazing because
it gives you a big picture.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
01:59.510 --> 02:02.670 align:middle line:90%
this command is amazing because
it gives you a big picture.

59
02:02.670 --> 02:04.280 align:middle line:84%
It shows who the peer is.

60
02:04.280 --> 02:06.350 align:middle line:84%
It shows the actual crypto ACL.

61
02:06.350 --> 02:08.360 align:middle line:90%
It shows the
Diffie-Hellman group.

62
02:08.360 --> 02:10.009 align:middle line:84%
It shows the transform set.

63
02:10.009 --> 02:11.900 align:middle line:90%
It shows the crypto
map and also where

64
02:11.900 --> 02:13.280 align:middle line:84%
that crypto map is applied.

65
02:13.280 --> 02:14.750 align:middle line:90%
And a few of my
favorite commands

66
02:14.750 --> 02:17.990 align:middle line:90%
would include show crypto
for focusing on IKE phase

67
02:17.990 --> 02:19.460 align:middle line:84%
1, the ISAKMP tunnel.

68
02:19.460 --> 02:22.290 align:middle line:90%
We're going to show
crypto ISAKMP SA.

69
02:22.290 --> 02:23.955 align:middle line:84%
And that's empty.

70
02:23.955 --> 02:26.080 align:middle line:90%
This one won't be much
better, but it's a good one.

71
02:26.080 --> 02:28.300 align:middle line:90%
We're going to do a show
crypto ISAKMP SA detail,

72
02:28.300 --> 02:30.320 align:middle line:90%
and that would give us
more details, including
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:28.300 --> 02:30.320 align:middle line:90%
and that would give us
more details, including

73
02:30.320 --> 02:32.670 align:middle line:90%
the specific hashing and
authentication being used.

74
02:32.670 --> 02:36.140 align:middle line:90%
But in either case, we don't
have an IKE phase 1 SA.

75
02:36.140 --> 02:40.070 align:middle line:90%
So we're going to a show
crypto ISAKMP policy.

76
02:40.070 --> 02:43.120 align:middle line:90%
And that confirms what we did
with the show run earlier.

77
02:43.120 --> 02:46.820 align:middle line:90%
And we do a show crypto
session, although there's not

78
02:46.820 --> 02:48.320 align:middle line:90%
going to be much
going on because we

79
02:48.320 --> 02:49.880 align:middle line:84%
don't have IKE phase 1 up.

80
02:49.880 --> 02:51.770 align:middle line:90%
So current session
status is down.

81
02:51.770 --> 02:53.280 align:middle line:90%
That means we don't
have a tunnel.

82
02:53.280 --> 02:54.840 align:middle line:90%
Now, the key here is, what
do we start troubleshooting?

83
02:54.840 --> 02:56.798 align:middle line:90%
Well, if they don't have
an IKE phase 1 tunnel,

84
02:56.798 --> 02:58.850 align:middle line:90%
they're not going to
have an IPsec tunnel,

85
02:58.850 --> 03:00.030 align:middle line:84%
assuming this never worked.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
02:58.850 --> 03:00.030 align:middle line:84%
assuming this never worked.

86
03:00.030 --> 03:02.780 align:middle line:90%
So let's go ahead and
focus on the IKE phase 1

87
03:02.780 --> 03:06.350 align:middle line:90%
tunnel, the ISAKMP tunnel first
with a debug crypto ISAKMP

88
03:06.350 --> 03:07.150 align:middle line:84%
command.

89
03:07.150 --> 03:10.860 align:middle line:90%
And that would go something
like this-- debug crypto ISAKMP.

90
03:10.860 --> 03:12.260 align:middle line:84%
And we'll do a question mark.

91
03:12.260 --> 03:13.820 align:middle line:90%
And I'm just going
to press Enter.

92
03:13.820 --> 03:16.237 align:middle line:90%
The next thing we'd want to
do is trigger the cryptography

93
03:16.237 --> 03:16.860 align:middle line:84%
to kick in.

94
03:16.860 --> 03:18.680 align:middle line:90%
So if we do a show
crypto map again,

95
03:18.680 --> 03:21.440 align:middle line:90%
just to verify what
the cryptography is,

96
03:21.440 --> 03:23.870 align:middle line:90%
anything the IP protocol
stack, IP version 4,

97
03:23.870 --> 03:27.020 align:middle line:84%
from 10.1.0 going to 10.2.0--

98
03:27.020 --> 03:30.560 align:middle line:90%
so if we do a show
IP interface brief,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:27.020 --> 03:30.560 align:middle line:90%
so if we do a show
IP interface brief,

99
03:30.560 --> 03:32.400 align:middle line:90%
I've got a 10.1.0
interface here.

100
03:32.400 --> 03:34.722 align:middle line:90%
So we could do a ping from
ourself from that address.

101
03:34.722 --> 03:36.680 align:middle line:90%
And that should trigger
the interesting traffic

102
03:36.680 --> 03:38.160 align:middle line:84%
and kick in the cryptography.

103
03:38.160 --> 03:41.390 align:middle line:84%
So let's do a ping to 10.2.0.2.

104
03:41.390 --> 03:42.420 align:middle line:84%
That's R2's address.

105
03:42.420 --> 03:44.040 align:middle line:84%
Let's check that real quick.

106
03:44.040 --> 03:46.670 align:middle line:90%
So here in our tool, we'll
do a show IP interface brief.

107
03:46.670 --> 03:48.410 align:middle line:84%
Sure enough, 10.2.0.2.

108
03:48.410 --> 03:49.940 align:middle line:84%
So we'll ping 10.2.0.2.

109
03:49.940 --> 03:53.600 align:middle line:90%
And we'll source it
from our local 10.1.0.1.

110
03:53.600 --> 03:58.760 align:middle line:90%
And survey says,
that dog won't hunt.

111
03:58.760 --> 04:00.560 align:middle line:90%
All right, we're
getting five timeouts,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
03:58.760 --> 04:00.560 align:middle line:90%
All right, we're
getting five timeouts,

112
04:00.560 --> 04:04.370 align:middle line:90%
five pings sent, and zero
responses, and no debug

113
04:04.370 --> 04:07.940 align:middle line:90%
messages, which implies
that nothing is kicking in.

114
04:07.940 --> 04:11.000 align:middle line:90%
Let's do a show debug just
to make sure it's still on.

115
04:11.000 --> 04:11.780 align:middle line:84%
Yeah.

116
04:11.780 --> 04:13.278 align:middle line:90%
Also, if you're
remotely connected,

117
04:13.278 --> 04:15.320 align:middle line:90%
you ought to do a terminal
monitor so you can see

118
04:15.320 --> 04:16.885 align:middle line:84%
that feedback at your console.

119
04:16.885 --> 04:19.010 align:middle line:90%
Otherwise, you may have
the log messages happening.

120
04:19.010 --> 04:20.670 align:middle line:90%
But if they're not
showing up on your screen,

121
04:20.670 --> 04:21.760 align:middle line:84%
you won't able to see them.

122
04:21.760 --> 04:23.450 align:middle line:90%
And at that point, you
have to do a show log

123
04:23.450 --> 04:24.960 align:middle line:90%
to go ahead and
see those messages.

124
04:24.960 --> 04:27.690 align:middle line:90%
If I do a who, I'm
currently on the console,

125
04:27.690 --> 04:30.080 align:middle line:90%
so I should be seeing in
any log messages that come.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:27.690 --> 04:30.080 align:middle line:90%
so I should be seeing in
any log messages that come.

126
04:30.080 --> 04:31.700 align:middle line:90%
All right, so let's go
back to our troubleshooting

127
04:31.700 --> 04:32.270 align:middle line:84%
methodology.

128
04:32.270 --> 04:35.930 align:middle line:90%
The very first thing to check
is routing, asking the router,

129
04:35.930 --> 04:38.207 align:middle line:90%
hey, if you got a packet
for 10.2.something,

130
04:38.207 --> 04:39.290 align:middle line:84%
what would you do with it?

131
04:39.290 --> 04:39.950 align:middle line:84%
Would you route it?

132
04:39.950 --> 04:40.790 align:middle line:84%
What would you do?

133
04:40.790 --> 04:44.300 align:middle line:90%
Let's take a look at the routing
table on R1 to see what R1 will

134
04:44.300 --> 04:48.570 align:middle line:90%
do if it receives a packet
destined to 10.2.anything.

135
04:48.570 --> 04:51.260 align:middle line:90%
So here on R1, we'll
do a show IP route.

136
04:51.260 --> 04:56.675 align:middle line:90%
And survey says, yeah, I don't
have a route to 10.2 anything.

137
04:56.675 --> 04:58.050 align:middle line:90%
And I don't have
a default route.

138
04:58.050 --> 05:00.450 align:middle line:90%
So the problem is that
this router is not
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
04:58.050 --> 05:00.450 align:middle line:90%
So the problem is that
this router is not

139
05:00.450 --> 05:02.310 align:middle line:90%
trying to forward
that packet anywhere.

140
05:02.310 --> 05:04.890 align:middle line:90%
And that's why it's not
kicking in on any interface

141
05:04.890 --> 05:06.492 align:middle line:90%
where it has
cryptography applied.

142
05:06.492 --> 05:07.450 align:middle line:84%
So we need to fix that.

143
05:07.450 --> 05:09.210 align:middle line:90%
Let's take a look
at our topology.

144
05:09.210 --> 05:13.560 align:middle line:90%
So R1 should have a
default gateway, 15.1.1.5,

145
05:13.560 --> 05:15.520 align:middle line:90%
which it doesn't in
its routing table.

146
05:15.520 --> 05:17.100 align:middle line:90%
So we've got a
default route there.

147
05:17.100 --> 05:20.222 align:middle line:90%
Then when the traffic
comes in destined for 10.2,

148
05:20.222 --> 05:22.680 align:middle line:90%
it would say, oh, I'm going to
use my default route sending

149
05:22.680 --> 05:23.620 align:middle line:84%
out this interface.

150
05:23.620 --> 05:25.440 align:middle line:90%
And if we have
cryptography applied here,

151
05:25.440 --> 05:27.840 align:middle line:90%
that's when the whole
IPsec process, including

152
05:27.840 --> 05:30.330 align:middle line:90%
IKE phase 1 and IKE phase
2 for IKE version 1--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
05:27.840 --> 05:30.330 align:middle line:90%
IKE phase 1 and IKE phase
2 for IKE version 1--

153
05:30.330 --> 05:32.670 align:middle line:90%
that's when that all kicks
in, builds the tunnels,

154
05:32.670 --> 05:37.000 align:middle line:90%
and then sends the traffic over
the tunnel between R1 and R2.

155
05:37.000 --> 05:38.020 align:middle line:84%
So let's fix that.

156
05:38.020 --> 05:39.437 align:middle line:90%
We'll go into
configuration mode--

157
05:39.437 --> 05:42.240 align:middle line:84%
IP route quad zeros.

158
05:42.240 --> 05:45.270 align:middle line:90%
And the next hop is
going to be 15.1.1.5.

159
05:45.270 --> 05:49.760 align:middle line:90%
Also, for grins, we'll do a
ping, 15.1.1.5, to make sure

160
05:49.760 --> 05:50.760 align:middle line:84%
that address is correct.

161
05:50.760 --> 05:51.750 align:middle line:84%
Yep, that's good.

162
05:51.750 --> 05:55.078 align:middle line:90%
And we'll do a show IP
route just to verify that.

163
05:55.078 --> 05:56.370 align:middle line:84%
Right, so now it's got a route.

164
05:56.370 --> 05:57.328 align:middle line:84%
Let's verify our debug.

165
05:57.328 --> 06:00.000 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
06:00.000 --> 06:01.160 align:middle line:84%
Debug's still in place.

167
06:01.160 --> 06:02.422 align:middle line:84%
And we'll do that same ping.

168
06:02.422 --> 06:04.380 align:middle line:90%
And we'll just hit the
Up arrow key a few times

169
06:04.380 --> 06:06.720 align:middle line:90%
and do that same ping
over to 10.2.0.2.

170
06:06.720 --> 06:10.140 align:middle line:90%
And to be clear why we're doing
that, we want to source this

171
06:10.140 --> 06:13.870 align:middle line:90%
from a network that is going
to match the crypto ACL.

172
06:13.870 --> 06:16.620 align:middle line:90%
So if we source it from
our 10.1.0 interface,

173
06:16.620 --> 06:19.260 align:middle line:90%
and we send it to
10.2.0.2, which

174
06:19.260 --> 06:22.110 align:middle line:90%
would be R2's address here,
that should match the crypto ACL

175
06:22.110 --> 06:23.480 align:middle line:84%
from R1's perspective.

176
06:23.480 --> 06:25.500 align:middle line:90%
And that should invoke
all the cryptography.

177
06:25.500 --> 06:29.340 align:middle line:90%
All right, so ping
10.2.0.2, source 10.1.0.1.

178
06:29.340 --> 06:32.070 align:middle line:90%
Debugging of ISAKMP, which
is IKE phase 1, is on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
06:29.340 --> 06:32.070 align:middle line:90%
Debugging of ISAKMP, which
is IKE phase 1, is on.

179
06:32.070 --> 06:34.900 align:middle line:90%
Ah, that's looking very
positive, very positive.

180
06:34.900 --> 06:38.430 align:middle line:90%
And if we do that ping again,
yeah, five out of five.

181
06:38.430 --> 06:40.860 align:middle line:90%
So it may have lost one
or two as it was initially

182
06:40.860 --> 06:42.160 align:middle line:84%
negotiating all the tunnels.

183
06:42.160 --> 06:44.520 align:middle line:90%
And now the IPsec's security
associations are in place.

184
06:44.520 --> 06:45.510 align:middle line:84%
We have success.

185
06:45.510 --> 06:47.603 align:middle line:90%
And let me go ahead
and turn off debugging.

186
06:47.603 --> 06:49.770 align:middle line:90%
And let's go through the
output here and take a look

187
06:49.770 --> 06:51.240 align:middle line:84%
at a few of the highlights.

188
06:51.240 --> 06:53.710 align:middle line:90%
So here, it's referring to
Aggressive and Main mode.

189
06:53.710 --> 06:56.932 align:middle line:90%
Those are two different ways of
negotiating the phase 1 tunnel.

190
06:56.932 --> 06:58.890 align:middle line:90%
And it says here it's
going to Main mode, which

191
06:58.890 --> 07:01.098 align:middle line:90%
is going to involve a few
additional packets compared
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

191
06:58.890 --> 07:01.098 align:middle line:90%
is going to involve a few
additional packets compared

192
07:01.098 --> 07:01.980 align:middle line:84%
to Aggressive mode.

193
07:01.980 --> 07:04.230 align:middle line:90%
It found pre-shared
key that was matching

194
07:04.230 --> 07:05.490 align:middle line:84%
on the peer at the other side.

195
07:05.490 --> 07:06.700 align:middle line:84%
That's a good sign.

196
07:06.700 --> 07:08.850 align:middle line:90%
It looked at the IKE
phase 1 policy, which

197
07:08.850 --> 07:10.260 align:middle line:84%
was this bad boy right here.

198
07:10.260 --> 07:11.340 align:middle line:84%
And this is good news.

199
07:11.340 --> 07:12.763 align:middle line:84%
Attributes are acceptable.

200
07:12.763 --> 07:14.680 align:middle line:90%
So that means they're
continuing to negotiate.

201
07:14.680 --> 07:16.500 align:middle line:90%
Oh, there's three of our pings
that made it, by the way.

202
07:16.500 --> 07:17.583 align:middle line:84%
So the pings went through.

203
07:17.583 --> 07:20.100 align:middle line:90%
And the output to the
console was still coming up.

204
07:20.100 --> 07:23.220 align:middle line:90%
Here, it's sending a packet
to its peer at 25.2.2.2,

205
07:23.220 --> 07:25.770 align:middle line:90%
my port 500--
that's UDP port 500

206
07:25.770 --> 07:28.650 align:middle line:90%
for the negotiation
establishment of that IKE phase

207
07:28.650 --> 07:29.650 align:middle line:84%
1 tunnel.

208
07:29.650 --> 07:34.620 align:middle line:90%
So here, we have Main Mode
2, Main Mode 3, Main Mode 4--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

208
07:29.650 --> 07:34.620 align:middle line:90%
So here, we have Main Mode
2, Main Mode 3, Main Mode 4--

209
07:34.620 --> 07:36.060 align:middle line:84%
looks very promising.

210
07:36.060 --> 07:38.310 align:middle line:90%
As we continue to go down,
we have additional packets.

211
07:38.310 --> 07:39.300 align:middle line:84%
regarding Main mode.

212
07:39.300 --> 07:41.160 align:middle line:90%
Everything looks
successful here.

213
07:41.160 --> 07:42.990 align:middle line:90%
Everything looks
pretty positive here.

214
07:42.990 --> 07:45.180 align:middle line:84%
And then we have Main Mode 6.

215
07:45.180 --> 07:46.795 align:middle line:90%
Then we have IKE
phase 1 complete.

216
07:46.795 --> 07:49.170 align:middle line:90%
And if we did some show commands
now, similar to the ones

217
07:49.170 --> 07:52.498 align:middle line:90%
we did earlier, such as
show crypto ISAKMP SA,

218
07:52.498 --> 07:54.540 align:middle line:90%
it's now going to show us
that we have a security

219
07:54.540 --> 07:55.930 align:middle line:84%
association in place.

220
07:55.930 --> 07:59.325 align:middle line:90%
And if we did a show ISAKMP
SA detail and pressed Enter,

221
07:59.325 --> 08:01.200 align:middle line:90%
it would show us additional
detail, including
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

221
07:59.325 --> 08:01.200 align:middle line:90%
it would show us additional
detail, including

222
08:01.200 --> 08:03.240 align:middle line:90%
the encryption method
used, the hashing used,

223
08:03.240 --> 08:05.760 align:middle line:90%
the authentication method, the
Diffie-Hellman group, as well

224
08:05.760 --> 08:07.120 align:middle line:84%
as the lifetime.

225
08:07.120 --> 08:09.660 align:middle line:90%
And then we do a
show crypto session.

226
08:09.660 --> 08:12.190 align:middle line:90%
And here, it's showing active
Security Associations, or SAs

227
08:12.190 --> 08:12.690 align:middle line:84%
2.

228
08:12.690 --> 08:15.630 align:middle line:90%
We have one for IKE phase 1,
which is the ISAKMP tunnel.

229
08:15.630 --> 08:17.340 align:middle line:90%
And we have one for
the IPsec tunnel,

230
08:17.340 --> 08:20.757 align:middle line:90%
also, in IKE version 1, known
as the IKE phase 2 tunnel.

231
08:20.757 --> 08:22.590 align:middle line:90%
So thanks for joining
me in this video as we

232
08:22.590 --> 08:26.400 align:middle line:90%
troubleshot a VPN tunnel
where routing was the problem.

233
08:26.400 --> 08:28.840 align:middle line:90%
Now in the next video, I'm
going to put routing in place

234
08:28.840 --> 08:29.410 align:middle line:84%
so it works.

235
08:29.410 --> 08:31.035 align:middle line:90%
But we'll have another
problem with IKE
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

235
08:29.410 --> 08:31.035 align:middle line:90%
But we'll have another
problem with IKE

236
08:31.035 --> 08:33.390 align:middle line:90%
phase 1 that we'll need
to troubleshoot together.

237
08:33.390 --> 08:36.179 align:middle line:90%
The cool thing is, we can
use the same methodology.

238
08:36.179 --> 08:37.169 align:middle line:84%
Do we have routing?

239
08:37.169 --> 08:38.580 align:middle line:84%
We will in the next video.

240
08:38.580 --> 08:41.730 align:middle line:90%
Do we have connectivity between
the two ends of the VPN?

241
08:41.730 --> 08:43.799 align:middle line:90%
And third, are
our configurations

242
08:43.799 --> 08:47.100 align:middle line:90%
compatible enough to build
the IKE phase 1 tunnel?

243
08:47.100 --> 08:49.030 align:middle line:90%
We'll troubleshoot
that in the next video.

244
08:49.030 --> 08:50.710 align:middle line:90%
I'll see you there
in just a moment.

245
08:50.710 --> 08:53.100 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

246
08:53.100 --> 08:56.360 align:middle line:90%
And I'd like to thank
you for viewing.