WEBVTT

1
00:00.000 --> 00:01.180 align:middle line:84%


2
00:01.180 --> 00:01.710 align:middle line:84%
Oh, no.

3
00:01.710 --> 00:03.800 align:middle line:84%
More problems with IPsec VPNs.

4
00:03.800 --> 00:06.300 align:middle line:90%
In the previous video, we
solved a routing problem.

5
00:06.300 --> 00:09.450 align:middle line:90%
In this video, I'd like to focus
on troubleshooting IKE version

6
00:09.450 --> 00:12.450 align:middle line:90%
1 phase 1 where there has
been a configuration problem

7
00:12.450 --> 00:15.510 align:middle line:90%
and how you and I can both
identify that with debugging

8
00:15.510 --> 00:17.860 align:middle line:90%
and correct it to
get the VPN working.

9
00:17.860 --> 00:19.230 align:middle line:84%
So here is our topology.

10
00:19.230 --> 00:22.680 align:middle line:90%
We still want to encrypt traffic
between 10 1 0 and 10 2 0.

11
00:22.680 --> 00:24.330 align:middle line:84%
This represents the internet.

12
00:24.330 --> 00:27.180 align:middle line:90%
Routing is currently in
place on both R1 and R2.

13
00:27.180 --> 00:28.055 align:middle line:84%
That's not a problem.

14
00:28.055 --> 00:30.555 align:middle line:90%
However, the customer has called
us and said, you know what?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.055 --> 00:30.555 align:middle line:90%
However, the customer has called
us and said, you know what?

15
00:30.555 --> 00:31.890 align:middle line:84%
The IPsec tunnel isn't working.

16
00:31.890 --> 00:33.847 align:middle line:90%
And we ask the very
important question,

17
00:33.847 --> 00:35.180 align:middle line:84%
when is the last time it worked?

18
00:35.180 --> 00:36.392 align:middle line:84%
And they said, never.

19
00:36.392 --> 00:38.350 align:middle line:90%
That's important to know
because if suddenly it

20
00:38.350 --> 00:40.710 align:middle line:90%
was working we'd first of
all want to take a look at--

21
00:40.710 --> 00:43.300 align:middle line:90%
see what changed that's
now causing it not to work.

22
00:43.300 --> 00:45.990 align:middle line:90%
But if it has never worked,
let's go ahead over to site one

23
00:45.990 --> 00:49.230 align:middle line:90%
to router one and let's start
troubleshooting the IKE phase

24
00:49.230 --> 00:51.520 align:middle line:84%
one tunnel from IKE version 1.

25
00:51.520 --> 00:52.020 align:middle line:84%
All right.

26
00:52.020 --> 00:53.730 align:middle line:90%
So here on R1, let's
start by taking a look

27
00:53.730 --> 00:55.620 align:middle line:90%
at the relevant portions
of our configuration

28
00:55.620 --> 00:58.920 align:middle line:84%
with a show, run, pipe section.

29
00:58.920 --> 01:00.400 align:middle line:84%
And we'll say crypto.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.920 --> 01:00.400 align:middle line:84%
And we'll say crypto.

30
01:00.400 --> 01:00.900 align:middle line:84%
All right.

31
01:00.900 --> 01:02.897 align:middle line:90%
So here's our IKE
phase one policy.

32
01:02.897 --> 01:04.980 align:middle line:90%
And in his lab, we're going
to be troubleshooting.

33
01:04.980 --> 01:07.588 align:middle line:90%
It's IKE phase one something
that's not working correctly.

34
01:07.588 --> 01:09.380 align:middle line:90%
So let's do our same
methods we did before.

35
01:09.380 --> 01:12.030 align:middle line:90%
We'll do a show IP route and
making sure we have a route.

36
01:12.030 --> 01:15.862 align:middle line:90%
In fact, I'm going to
do that on R1 and R2

37
01:15.862 --> 01:17.070 align:middle line:84%
to make sure we have routing.

38
01:17.070 --> 01:18.362 align:middle line:84%
They both have a default route.

39
01:18.362 --> 01:23.002 align:middle line:90%
From R1 I want to ping
my peer at 25.2.2.2 just

40
01:23.002 --> 01:24.210 align:middle line:84%
to make sure I reach ability.

41
01:24.210 --> 01:25.680 align:middle line:84%
That looks good.

42
01:25.680 --> 01:29.610 align:middle line:90%
And let's also a show
crypto ISAKMP SA.

43
01:29.610 --> 01:30.890 align:middle line:84%
Nothing there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:29.610 --> 01:30.890 align:middle line:84%
Nothing there.

44
01:30.890 --> 01:32.932 align:middle line:90%
And let's do a debugs
on both R1 and R2

45
01:32.932 --> 01:34.890 align:middle line:90%
because they're going to
be slightly different.

46
01:34.890 --> 01:38.370 align:middle line:90%
Same debug, but depending on
who initialized or initiated

47
01:38.370 --> 01:40.160 align:middle line:90%
the conversation
for IKE phase one,

48
01:40.160 --> 01:42.327 align:middle line:90%
we're going to have different
messages that come up.

49
01:42.327 --> 01:46.170 align:middle line:90%
So we'll do a debug,
crypto, ISAKMP here.

50
01:46.170 --> 01:47.640 align:middle line:84%
And we'll go over on R2.

51
01:47.640 --> 01:51.550 align:middle line:90%
And we'll do a debug,
crypto, ISAKMP there.

52
01:51.550 --> 01:53.330 align:middle line:84%
And we'll also do a show users.

53
01:53.330 --> 01:54.780 align:middle line:84%
So make sure I'm on the console.

54
01:54.780 --> 01:58.440 align:middle line:90%
Again, if we weren't and if
you're remotely connected in

55
01:58.440 --> 02:01.080 align:middle line:90%
and you want to see the output,
you do a terminal monitor.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:58.440 --> 02:01.080 align:middle line:90%
and you want to see the output,
you do a terminal monitor.

56
02:01.080 --> 02:04.120 align:middle line:90%
And that would make sure
you could see the output.

57
02:04.120 --> 02:04.620 align:middle line:84%
All right.

58
02:04.620 --> 02:07.060 align:middle line:90%
So what I'm going to do is
show debug back here on R1.

59
02:07.060 --> 02:07.560 align:middle line:84%
All right.

60
02:07.560 --> 02:08.310 align:middle line:84%
So that is on.

61
02:08.310 --> 02:09.977 align:middle line:90%
Let's generate some
interesting traffic.

62
02:09.977 --> 02:13.110 align:middle line:84%
Let's do a ping to 10.2.0.2.

63
02:13.110 --> 02:15.920 align:middle line:90%
So let's use my default route
where my crypto map is applied.

64
02:15.920 --> 02:18.480 align:middle line:90%
And I'll source
it from 10.1.0.1.

65
02:18.480 --> 02:21.660 align:middle line:84%
And here we go.

66
02:21.660 --> 02:22.160 align:middle line:84%
All right.

67
02:22.160 --> 02:23.402 align:middle line:84%
So it's now retrying.

68
02:23.402 --> 02:25.860 align:middle line:90%
Let's go and take a look and
see if there's any errors here

69
02:25.860 --> 02:27.900 align:middle line:84%
that we can take a look at.

70
02:27.900 --> 02:30.660 align:middle line:90%
Attempt 1 of 5, 2 of
5, he's not given up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:27.900 --> 02:30.660 align:middle line:90%
Attempt 1 of 5, 2 of
5, he's not given up.

71
02:30.660 --> 02:31.650 align:middle line:84%
But it's not working.

72
02:31.650 --> 02:33.900 align:middle line:90%
And let's take a
look at site two

73
02:33.900 --> 02:35.652 align:middle line:90%
or router two and
take a look here.

74
02:35.652 --> 02:37.110 align:middle line:90%
And I'm going to
turn off debugging

75
02:37.110 --> 02:39.277 align:middle line:90%
on both sides by the way
so I can have a screen that

76
02:39.277 --> 02:41.730 align:middle line:84%
won't keep moving on me.

77
02:41.730 --> 02:44.040 align:middle line:90%
So we'll do an
un-debug on both sides.

78
02:44.040 --> 02:46.510 align:middle line:90%
And let's go ahead
and scroll up.

79
02:46.510 --> 02:50.010 align:middle line:90%
So the top of the output,
we're using UDP port 500, which

80
02:50.010 --> 02:52.380 align:middle line:84%
is what IKE phase one does.

81
02:52.380 --> 02:55.410 align:middle line:90%
And as we scroll down, we
have some mismatches here.

82
02:55.410 --> 02:58.200 align:middle line:90%
Now, some of these mismatches
may not be a showstopper.

83
02:58.200 --> 03:01.500 align:middle line:90%
Like I remember in the previous
debug we had major 69 mismatch,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:58.200 --> 03:01.500 align:middle line:90%
Like I remember in the previous
debug we had major 69 mismatch,

84
03:01.500 --> 03:02.715 align:middle line:84%
but we still had the tunnels.

85
03:02.715 --> 03:06.040 align:middle line:90%
But we are having some
additional mismatches here.

86
03:06.040 --> 03:08.190 align:middle line:90%
So we have a key that
we can use for 15.1.1.1.

87
03:08.190 --> 03:10.380 align:middle line:90%
This is from R2's
perspective again.

88
03:10.380 --> 03:14.010 align:middle line:90%
And if we scroll down a
little bit, oh look at this.

89
03:14.010 --> 03:15.552 align:middle line:84%
Attributes are not acceptable.

90
03:15.552 --> 03:17.010 align:middle line:90%
So basically, what
that says, we're

91
03:17.010 --> 03:19.140 align:middle line:90%
going to IKE phase one
is that the IKE phase one

92
03:19.140 --> 03:23.820 align:middle line:90%
policy that we tried here on
R2 was not found to be matching

93
03:23.820 --> 03:24.970 align:middle line:84%
the policy over on R1.

94
03:24.970 --> 03:28.575 align:middle line:90%
So we could have five, or six,
or 100 IKE phase one policies.

95
03:28.575 --> 03:30.700 align:middle line:90%
They'd all be compared till
there would be a match.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:28.575 --> 03:30.700 align:middle line:90%
They'd all be compared till
there would be a match.

96
03:30.700 --> 03:32.730 align:middle line:90%
However, this is
saying this one matched

97
03:32.730 --> 03:34.790 align:middle line:90%
and I think we only have
one policy on each side.

98
03:34.790 --> 03:37.050 align:middle line:90%
Look at that, no
offer is accepted.

99
03:37.050 --> 03:39.040 align:middle line:90%
Phase one policy,
not acceptable.

100
03:39.040 --> 03:39.540 align:middle line:84%
All right.

101
03:39.540 --> 03:42.000 align:middle line:90%
So let's go ahead
and take a look.

102
03:42.000 --> 03:45.120 align:middle line:90%
And so show crypto,
ISAKMP policy.

103
03:45.120 --> 03:47.040 align:middle line:84%
So there's the policy on R2.

104
03:47.040 --> 03:49.485 align:middle line:90%
We'll do the same
command over on R1.

105
03:49.485 --> 03:50.945 align:middle line:90%
Oh, let's copy
and paste that in.

106
03:50.945 --> 03:52.320 align:middle line:90%
And let's compare
the difference.

107
03:52.320 --> 03:54.370 align:middle line:84%
So AES 192, secure--

108
03:54.370 --> 03:56.020 align:middle line:90%
that's going to
go back and forth.

109
03:56.020 --> 03:57.750 align:middle line:90%
So they're both using
AES, they're both

110
03:57.750 --> 03:59.910 align:middle line:90%
using the same flavor
of SHA, they're both

111
03:59.910 --> 04:03.017 align:middle line:90%
using pre-shared key, they're
both using Diffie-Hellman Five,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
03:59.910 --> 04:03.017 align:middle line:90%
using pre-shared key, they're
both using Diffie-Hellman Five,

112
04:03.017 --> 04:04.350 align:middle line:84%
and they have the same lifetime.

113
04:04.350 --> 04:06.183 align:middle line:90%
The lifetime is one of
those things where it

114
04:06.183 --> 04:07.410 align:middle line:84%
doesn't have to be identical.

115
04:07.410 --> 04:09.300 align:middle line:90%
And they'll negotiate
to the lower.

116
04:09.300 --> 04:11.490 align:middle line:84%
But what's different here?

117
04:11.490 --> 04:12.060 align:middle line:84%
Oh I see it.

118
04:12.060 --> 04:12.580 align:middle line:84%
There we go.

119
04:12.580 --> 04:15.750 align:middle line:84%
So on R1, we have a AES 192.

120
04:15.750 --> 04:19.320 align:middle line:84%
And on R2, it's using AES 256.

121
04:19.320 --> 04:21.047 align:middle line:84%
And that indeed is the problem.

122
04:21.047 --> 04:23.130 align:middle line:90%
That's why there wasn't a
compatible IKE phase one

123
04:23.130 --> 04:24.130 align:middle line:84%
policy.

124
04:24.130 --> 04:26.430 align:middle line:90%
And so the IKE phase one
tunnel never established.

125
04:26.430 --> 04:28.097 align:middle line:90%
And that means the
IKE phase two tunnel,

126
04:28.097 --> 04:29.730 align:middle line:90%
the IPsec tunnel
didn't have a chance

127
04:29.730 --> 04:31.647 align:middle line:90%
because they didn't have
the phase one set up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:29.730 --> 04:31.647 align:middle line:90%
because they didn't have
the phase one set up.

128
04:31.647 --> 04:32.970 align:middle line:84%
Let's set them both to 256.

129
04:32.970 --> 04:37.710 align:middle line:90%
So go back to R1, we'll do
a show, run, type, section,

130
04:37.710 --> 04:38.610 align:middle line:84%
crypto.

131
04:38.610 --> 04:41.140 align:middle line:90%
And let's go into configuration
mode and just change it.

132
04:41.140 --> 04:43.560 align:middle line:90%
So we'll go crypto,
ISAKMP policy five,

133
04:43.560 --> 04:44.880 align:middle line:84%
modify the same policy.

134
04:44.880 --> 04:47.400 align:middle line:90%
We can also make
another policy and put

135
04:47.400 --> 04:48.428 align:middle line:84%
in the right parameters.

136
04:48.428 --> 04:49.470 align:middle line:84%
And that would also work.

137
04:49.470 --> 04:51.840 align:middle line:90%
But it's going to modify
the existing policy five.

138
04:51.840 --> 04:57.000 align:middle line:90%
And we'll say encryption
is AES and 256 I

139
04:57.000 --> 04:58.610 align:middle line:84%
think is what he's looking for.

140
04:58.610 --> 04:59.110 align:middle line:84%
All right.

141
04:59.110 --> 05:00.560 align:middle line:84%
So debugs are off.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
04:59.110 --> 05:00.560 align:middle line:84%
So debugs are off.

142
05:00.560 --> 05:04.870 align:middle line:90%
Let's do a debug, crypto,
ISAKMP on both sides again.

143
05:04.870 --> 05:06.160 align:middle line:84%
Debug, crypto, ISAKMP.

144
05:06.160 --> 05:06.760 align:middle line:84%
Great.

145
05:06.760 --> 05:10.060 align:middle line:90%
And now let's generate some
entering traffic with a ping.

146
05:10.060 --> 05:13.120 align:middle line:90%
So ping to 10, dot-- in
fact let's just verify.

147
05:13.120 --> 05:17.117 align:middle line:90%
While we're here, let's
verify it to show crypto, map,

148
05:17.117 --> 05:18.450 align:middle line:84%
and just verify all the details.

149
05:18.450 --> 05:23.200 align:middle line:90%
So any traffic in the IPv4
protocol stack from 10 1 0

150
05:23.200 --> 05:26.770 align:middle line:90%
to 10 2 0 is going to match
based on the crypto ACL.

151
05:26.770 --> 05:29.920 align:middle line:90%
The crypto ACL is applied
to the gigabit 0/1 interface

152
05:29.920 --> 05:31.500 align:middle line:84%
via our crypto map.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
05:29.920 --> 05:31.500 align:middle line:84%
via our crypto map.

153
05:31.500 --> 05:33.170 align:middle line:84%
There's the transform set.

154
05:33.170 --> 05:35.360 align:middle line:90%
And let's go ahead and
generate some traffic.

155
05:35.360 --> 05:38.460 align:middle line:84%
So we'll do a ping to 10.2.0.2.

156
05:38.460 --> 05:41.110 align:middle line:84%
We'll source it from 10.1.0.1.

157
05:41.110 --> 05:42.640 align:middle line:84%
And oh yeah.

158
05:42.640 --> 05:44.070 align:middle line:84%
This is looking much better.

159
05:44.070 --> 05:45.910 align:middle line:90%
I'm going to go ahead
and do an un-all.

160
05:45.910 --> 05:47.570 align:middle line:90%
It'll catch up to me
there in a moment.

161
05:47.570 --> 05:49.750 align:middle line:90%
So here where it's saying
attributes are acceptable,

162
05:49.750 --> 05:50.750 align:middle line:84%
that's a very good sign.

163
05:50.750 --> 05:54.730 align:middle line:90%
And then, if we did this, if we
did a show, crypto, ISAKMP, SA,

164
05:54.730 --> 05:57.360 align:middle line:90%
it's now showing us we have the
security association in place.

165
05:57.360 --> 05:59.800 align:middle line:90%
So the state of QM IDLE,
which is quick mode idle,

166
05:59.800 --> 06:01.230 align:middle line:84%
means it's currently happy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
05:59.800 --> 06:01.230 align:middle line:84%
means it's currently happy.

167
06:01.230 --> 06:03.460 align:middle line:90%
It's sitting there and
the status is active.

168
06:03.460 --> 06:05.560 align:middle line:90%
And if we did a show,
crypto, ISAKMP, SA,

169
06:05.560 --> 06:09.250 align:middle line:90%
detail, that would give us
details on the actual IKE phase

170
06:09.250 --> 06:11.270 align:middle line:90%
one tunnel that they have,
including what method

171
06:11.270 --> 06:13.300 align:middle line:90%
they're using for
encryption, the hashing,

172
06:13.300 --> 06:14.800 align:middle line:90%
the authentication,
Diffie-Hellman,

173
06:14.800 --> 06:16.250 align:middle line:84%
and the remaining lifetime.

174
06:16.250 --> 06:20.230 align:middle line:90%
So if we did a show, crypto,
engine, connections, active,

175
06:20.230 --> 06:22.053 align:middle line:90%
this is a long time
favorite command.

176
06:22.053 --> 06:24.220 align:middle line:90%
So this right here is
representing our IKE phase one

177
06:24.220 --> 06:24.970 align:middle line:84%
tunnel.

178
06:24.970 --> 06:26.920 align:middle line:90%
And these two right
here are representing

179
06:26.920 --> 06:29.020 align:middle line:90%
the two secret
associations associated

180
06:29.020 --> 06:32.130 align:middle line:90%
with our IPsec tunnel which is
currently active and working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:29.020 --> 06:32.130 align:middle line:90%
with our IPsec tunnel which is
currently active and working.

181
06:32.130 --> 06:33.790 align:middle line:90%
And we might say,
how fortune is that?

182
06:33.790 --> 06:35.620 align:middle line:90%
The IKE phase one and
IKE phase two works.

183
06:35.620 --> 06:36.120 align:middle line:84%
Great.

184
06:36.120 --> 06:38.770 align:middle line:90%
Well what if we have
routing in place

185
06:38.770 --> 06:41.020 align:middle line:90%
and the IKE phase one
works, but we have

186
06:41.020 --> 06:43.030 align:middle line:84%
a problem with IKE phase two?

187
06:43.030 --> 06:44.842 align:middle line:90%
How do we identify
that, troubleshoot that,

188
06:44.842 --> 06:45.550 align:middle line:84%
and resolve that?

189
06:45.550 --> 06:47.720 align:middle line:90%
Well, that's the topic
for our very next video.

190
06:47.720 --> 06:49.880 align:middle line:90%
So I'll see you there
in just a moment.

191
06:49.880 --> 06:52.270 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

192
06:52.270 --> 06:55.440 align:middle line:90%
And I'd like to thank
you for viewing.