WEBVTT

1
00:00.000 --> 00:00.870 align:middle line:84%


2
00:00.870 --> 00:02.980 align:middle line:90%
In the previous video, we
used some debug commands

3
00:02.980 --> 00:05.620 align:middle line:90%
for IKE phase 1 to identify
a configuration problem

4
00:05.620 --> 00:07.640 align:middle line:90%
where it wasn't acceptable
to the other side.

5
00:07.640 --> 00:10.413 align:middle line:90%
We used debug crypto
isakmp to see that problem.

6
00:10.413 --> 00:12.580 align:middle line:90%
And then we corrected it
and then built the tunnels.

7
00:12.580 --> 00:14.680 align:middle line:90%
In this video, I'd like
to walk through a scenario

8
00:14.680 --> 00:17.710 align:middle line:90%
where IKE phase 1 is great,
the routing is great,

9
00:17.710 --> 00:19.880 align:middle line:90%
the connectivity between
the peers is great.

10
00:19.880 --> 00:23.260 align:middle line:90%
However, the IPsec tunnel
is not coming up because

11
00:23.260 --> 00:24.760 align:middle line:90%
of, once again, a
misconfiguration--

12
00:24.760 --> 00:28.660 align:middle line:90%
but this time, regarding the
actual IPsec or IKE phase 2

13
00:28.660 --> 00:29.450 align:middle line:84%
tunnel.

14
00:29.450 --> 00:31.908 align:middle line:90%
So here's the topology that
we're going to work with again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.450 --> 00:31.908 align:middle line:90%
So here's the topology that
we're going to work with again.

15
00:31.908 --> 00:35.560 align:middle line:90%
I've got the 10.1.0 to 10.2.0
identified as entering traffic.

16
00:35.560 --> 00:37.120 align:middle line:84%
Crypto maps are applied here.

17
00:37.120 --> 00:38.530 align:middle line:84%
Routing is in place.

18
00:38.530 --> 00:40.420 align:middle line:90%
Peer to peer
connectivity is fine.

19
00:40.420 --> 00:43.480 align:middle line:90%
But we are having a problem with
the actual IPsec tunnel itself

20
00:43.480 --> 00:44.060 align:middle line:84%
coming up.

21
00:44.060 --> 00:48.420 align:middle line:90%
So with IKE version 1, we are
going to have two tunnels.

22
00:48.420 --> 00:50.290 align:middle line:90%
We're going to have
the phase 1 tunnel,

23
00:50.290 --> 00:52.480 align:middle line:90%
also called the ISAKMP
tunnel; and the phase 2

24
00:52.480 --> 00:55.970 align:middle line:90%
tunnel, which is also called,
literally, the IPsec tunnel.

25
00:55.970 --> 00:59.380 align:middle line:90%
So we have some specific debugs,
including debug crypto ipsec,

26
00:59.380 --> 01:02.730 align:middle line:90%
that are going to focus on the
phase 2 or the IPsec tunnel
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.380 --> 01:02.730 align:middle line:90%
that are going to focus on the
phase 2 or the IPsec tunnel

27
01:02.730 --> 01:08.070 align:middle line:90%
and help us identify why it's
not working between R1 and R2.

28
01:08.070 --> 01:09.390 align:middle line:84%
All right, and here we go.

29
01:09.390 --> 01:12.150 align:middle line:90%
Let's do a few show commands
real quick-- show run

30
01:12.150 --> 01:14.830 align:middle line:84%
section crypto.

31
01:14.830 --> 01:16.450 align:middle line:90%
So here's the crypto
section regarding

32
01:16.450 --> 01:18.150 align:middle line:84%
the configuration on router 1.

33
01:18.150 --> 01:20.938 align:middle line:90%
And we can do the same
thing on router 2 as well.

34
01:20.938 --> 01:22.355 align:middle line:90%
To see how it's
all tied together,

35
01:22.355 --> 01:24.647 align:middle line:84%
we do a show crypto map.

36
01:24.647 --> 01:26.230 align:middle line:90%
And that would show
us the Crypto-ACL.

37
01:26.230 --> 01:28.253 align:middle line:90%
We could also do a
show access lists

38
01:28.253 --> 01:29.920 align:middle line:90%
and just identify
what's in it that way.

39
01:29.920 --> 01:31.030 align:middle line:90%
That's another
way of doing that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:29.920 --> 01:31.030 align:middle line:90%
That's another
way of doing that.

40
01:31.030 --> 01:32.980 align:middle line:90%
It's showing who the
peer is going to be.

41
01:32.980 --> 01:35.320 align:middle line:90%
It's showing us the
transform sets in use,

42
01:35.320 --> 01:37.197 align:middle line:90%
and also where the
crypto map is applied--

43
01:37.197 --> 01:37.780 align:middle line:84%
all fantastic.

44
01:37.780 --> 01:40.285 align:middle line:84%
Let's do a show crypto session.

45
01:40.285 --> 01:41.890 align:middle line:84%
And it says status is down.

46
01:41.890 --> 01:44.390 align:middle line:90%
Now, it could be there just
is no interesting traffic yet.

47
01:44.390 --> 01:46.240 align:middle line:90%
So let's go ahead
and do some debugs.

48
01:46.240 --> 01:48.070 align:middle line:90%
Now, if we weren't
quite sure what

49
01:48.070 --> 01:50.710 align:middle line:90%
it was, if it's IKE phase 1
or IKE phase 2 that is having

50
01:50.710 --> 01:52.070 align:middle line:84%
the problem, we could do this.

51
01:52.070 --> 01:56.800 align:middle line:90%
We could do a ping
to 10.2.0.2 and we

52
01:56.800 --> 01:59.002 align:middle line:84%
could source it from 10.1.0.1.

53
01:59.002 --> 02:00.790 align:middle line:90%
That will trigger the
interesting traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.002 --> 02:00.790 align:middle line:90%
That will trigger the
interesting traffic.

54
02:00.790 --> 02:03.170 align:middle line:84%
And if that works, we're good.

55
02:03.170 --> 02:04.900 align:middle line:90%
If it doesn't work,
that means we have

56
02:04.900 --> 02:06.640 align:middle line:84%
some kind of problem somewhere.

57
02:06.640 --> 02:09.460 align:middle line:90%
Now, if we're wondering, is
it IKE phase 1 or IKE phase 2,

58
02:09.460 --> 02:13.570 align:middle line:90%
we could do a show
crypto isakmp SA.

59
02:13.570 --> 02:17.920 align:middle line:90%
And that looks good for
IKE phase 1, right there.

60
02:17.920 --> 02:19.780 align:middle line:84%
If we do a show crypto--

61
02:19.780 --> 02:23.447 align:middle line:90%
instead of isakmp, we'll do
an ipsec sa-- and press Enter,

62
02:23.447 --> 02:25.030 align:middle line:90%
so this is based on
our configuration,

63
02:25.030 --> 02:26.798 align:middle line:90%
based on the crypto
ACL that's configured.

64
02:26.798 --> 02:27.590 align:middle line:84%
But check this out.

65
02:27.590 --> 02:29.562 align:middle line:90%
All these numbers
right here are 0.

66
02:29.562 --> 02:31.270 align:middle line:90%
So we're not encapsulating
and encrypting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.562 --> 02:31.270 align:middle line:90%
So we're not encapsulating
and encrypting

67
02:31.270 --> 02:32.228 align:middle line:84%
or decrypting anything.

68
02:32.228 --> 02:34.750 align:middle line:90%
And also down here, we have
send errors, five out of five.

69
02:34.750 --> 02:41.380 align:middle line:90%
Show crypto engine
connections active--

70
02:41.380 --> 02:43.630 align:middle line:90%
so yeah, here we have the
IKE phase 1 information.

71
02:43.630 --> 02:45.630 align:middle line:90%
That's the tunnel information
for IKE phase one,

72
02:45.630 --> 02:47.010 align:middle line:84%
but nothing for IKE phase 2.

73
02:47.010 --> 02:49.330 align:middle line:90%
So something is broken
with IKE phase 2.

74
02:49.330 --> 02:50.500 align:middle line:84%
So let's do some debugs.

75
02:50.500 --> 02:54.790 align:middle line:90%
We'll do a debug crypto
ipsec and press Enter.

76
02:54.790 --> 02:57.010 align:middle line:90%
And we'll do the same
thing over on R2--

77
02:57.010 --> 03:00.070 align:middle line:84%
debug crypto ipsec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:57.010 --> 03:00.070 align:middle line:84%
debug crypto ipsec.

78
03:00.070 --> 03:02.410 align:middle line:90%
All right, so since we
verified the IKE phase

79
03:02.410 --> 03:05.440 align:middle line:90%
1 seems to be working, based
on that, let's go ahead,

80
03:05.440 --> 03:07.720 align:middle line:90%
put that debug in
place for IKE phase 2.

81
03:07.720 --> 03:09.410 align:middle line:90%
And let's do the
ping once again.

82
03:09.410 --> 03:12.352 align:middle line:90%
So ping 10.2.0.2,
sourcing it from 10.1.0.1.

83
03:12.352 --> 03:14.310 align:middle line:90%
That should match, based
on the crypto map that

84
03:14.310 --> 03:17.770 align:middle line:90%
is applied on the
outgoing interface of 0/1.

85
03:17.770 --> 03:18.640 align:middle line:84%
Press Enter.

86
03:18.640 --> 03:20.470 align:middle line:90%
So here's the debug
regarding IPSEC.

87
03:20.470 --> 03:22.660 align:middle line:90%
And the message down here
about the success rate

88
03:22.660 --> 03:24.920 align:middle line:90%
is we're getting the
pings that never made it.

89
03:24.920 --> 03:26.980 align:middle line:90%
So there's some periods--
there they are--

90
03:26.980 --> 03:28.640 align:middle line:90%
some periods right
there that represent

91
03:28.640 --> 03:29.890 align:middle line:84%
the pings that didn't make it.

92
03:29.890 --> 03:31.807 align:middle line:90%
And it's trying IPSEC
again in the background.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:29.890 --> 03:31.807 align:middle line:90%
And it's trying IPSEC
again in the background.

93
03:31.807 --> 03:34.480 align:middle line:90%
If we go over to R2, who's
receiving the requests,

94
03:34.480 --> 03:36.550 align:middle line:90%
and we take a look
at the debugs here,

95
03:36.550 --> 03:39.320 align:middle line:90%
let's see if we can find out
something really obvious.

96
03:39.320 --> 03:39.820 align:middle line:84%
Here we go.

97
03:39.820 --> 03:40.510 align:middle line:84%
How about this?

98
03:40.510 --> 03:46.240 align:middle line:90%
Transform proposal not
supported for identity esp-aes.

99
03:46.240 --> 03:48.880 align:middle line:90%
And if we scroll up
earlier, same message.

100
03:48.880 --> 03:50.820 align:middle line:90%
The transform proposal
is not supported.

101
03:50.820 --> 03:54.670 align:middle line:90%
So maybe we don't have
a compatible IKE phase 2

102
03:54.670 --> 03:57.340 align:middle line:90%
policy, which would
include our transform sets

103
03:57.340 --> 03:59.830 align:middle line:90%
and the crypto ACLs and all
that good stuff that goes

104
03:59.830 --> 04:01.780 align:middle line:84%
in to the IKE phase 2 policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:59.830 --> 04:01.780 align:middle line:84%
in to the IKE phase 2 policy.

105
04:01.780 --> 04:03.430 align:middle line:90%
So we could did this--
show crypto map.

106
04:03.430 --> 04:04.930 align:middle line:90%
There's several
ways of seeing this.

107
04:04.930 --> 04:07.000 align:middle line:90%
One is show crypto
map on both sides.

108
04:07.000 --> 04:08.500 align:middle line:90%
So there's show
crypto map on R1.

109
04:08.500 --> 04:10.960 align:middle line:84%
Let me also turn off debugging.

110
04:10.960 --> 04:12.610 align:middle line:84%
And then we'll go to R1.

111
04:12.610 --> 04:17.420 align:middle line:90%
We'll do a show crypto map and
turn off debugging here, too.

112
04:17.420 --> 04:19.010 align:middle line:84%
And let's go back and forth.

113
04:19.010 --> 04:22.270 align:middle line:90%
So on R1, it says the
transform set is named B-Set

114
04:22.270 --> 04:24.820 align:middle line:84%
and it includes esp-aes.

115
04:24.820 --> 04:27.310 align:middle line:90%
And that's the only transforms
that we have in play.

116
04:27.310 --> 04:29.680 align:middle line:90%
And on R2, it's
showing us that we have

117
04:29.680 --> 04:31.072 align:middle line:84%
a transform set named Our-SET.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:29.680 --> 04:31.072 align:middle line:84%
a transform set named Our-SET.

118
04:31.072 --> 04:32.280 align:middle line:84%
Now, the name doesn't matter.

119
04:32.280 --> 04:34.970 align:middle line:90%
But what does matter is
what's in the transform set.

120
04:34.970 --> 04:36.550 align:middle line:90%
So we have a
non-compatible transform

121
04:36.550 --> 04:38.860 align:middle line:84%
set between these two devices.

122
04:38.860 --> 04:41.820 align:middle line:90%
This guy is willing
to use esp-aes.

123
04:41.820 --> 04:45.370 align:middle line:90%
And that's 128-bit
and sha384-hmac.

124
04:45.370 --> 04:47.680 align:middle line:90%
But the other guy--
we go back to R1--

125
04:47.680 --> 04:49.090 align:middle line:84%
isn't willing to use the hmac.

126
04:49.090 --> 04:50.840 align:middle line:90%
And that's why they're
not agreeing on it.

127
04:50.840 --> 04:54.950 align:middle line:90%
So we need to fix that here on
R1, or we can modify it on R2.

128
04:54.950 --> 04:56.130 align:middle line:84%
So let's fix it here on R1.

129
04:56.130 --> 05:00.940 align:middle line:90%
We'll do a do show
run section crypto.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:56.130 --> 05:00.940 align:middle line:90%
We'll do a do show
run section crypto.

130
05:00.940 --> 05:03.700 align:middle line:90%
So here we have a transform
set that's compatible.

131
05:03.700 --> 05:07.000 align:middle line:90%
It's just that it's not included
as part of the crypto map.

132
05:07.000 --> 05:09.040 align:middle line:90%
So if we modify this
crypto map, so I'll go back

133
05:09.040 --> 05:11.410 align:middle line:90%
to the same exact
sequence, copy, paste,

134
05:11.410 --> 05:14.380 align:middle line:90%
and we say that we want
to set the transform set

135
05:14.380 --> 05:15.970 align:middle line:84%
to be this one right here--

136
05:15.970 --> 05:17.020 align:middle line:84%
I'll copy and paste.

137
05:17.020 --> 05:20.380 align:middle line:90%
And then I'm going to
go to the interface

138
05:20.380 --> 05:22.030 align:middle line:90%
where that crypto
map is applied.

139
05:22.030 --> 05:24.940 align:middle line:90%
And I'm going to
do a no crypto map,

140
05:24.940 --> 05:27.910 align:middle line:90%
and just take it off
for a moment, Our-MAP.

141
05:27.910 --> 05:29.470 align:middle line:90%
And then I'm going
to put it back on.

142
05:29.470 --> 05:32.850 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.470 --> 05:32.850 align:middle line:84%


143
05:32.850 --> 05:34.830 align:middle line:90%
And I'm going do the
typo there on purpose.

144
05:34.830 --> 05:35.880 align:middle line:90%
If you don't put
the right syntax,

145
05:35.880 --> 05:37.422 align:middle line:90%
it gives you a
warning, saying, whoa,

146
05:37.422 --> 05:38.675 align:middle line:84%
this crypto map doesn't exist.

147
05:38.675 --> 05:40.163 align:middle line:90%
So it needs to be
case-sensitive.

148
05:40.163 --> 05:41.580 align:middle line:90%
The way you created
the crypto map

149
05:41.580 --> 05:43.413 align:middle line:90%
is the way you want to
apply the crypto map.

150
05:43.413 --> 05:45.842 align:middle line:90%
So it should give us the
message that ISAKMP is on.

151
05:45.842 --> 05:47.550 align:middle line:90%
And now lets do the
debug on both sides--

152
05:47.550 --> 05:49.710 align:middle line:84%
debug crypto ipsec.

153
05:49.710 --> 05:52.500 align:middle line:90%
And we'll do the same
thing over on R2--

154
05:52.500 --> 05:54.143 align:middle line:84%
debug crypto ipsec.

155
05:54.143 --> 05:55.560 align:middle line:90%
And then we'll do
that ping again.

156
05:55.560 --> 05:57.337 align:middle line:90%
I'll hit the Up arrow
key a few times.

157
05:57.337 --> 05:59.170 align:middle line:90%
And we'll generate some
interesting traffic.

158
05:59.170 --> 06:00.837 align:middle line:90%
So the IKE phase 1
tunnel is already up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
05:59.170 --> 06:00.837 align:middle line:90%
So the IKE phase 1
tunnel is already up.

159
06:00.837 --> 06:03.300 align:middle line:90%
It just had to go ahead and
build the IPsec or IKE phase

160
06:03.300 --> 06:04.110 align:middle line:84%
2 tunnel.

161
06:04.110 --> 06:06.772 align:middle line:84%
And that looks pretty positive.

162
06:06.772 --> 06:08.730 align:middle line:90%
And here in R2, if we
scroll down a little bit,

163
06:08.730 --> 06:10.830 align:middle line:90%
it specifies right
here-- let's see here--

164
06:10.830 --> 06:14.220 align:middle line:90%
the IPsec process
proposal map accepted.

165
06:14.220 --> 06:15.810 align:middle line:90%
And this output
here on the receiver

166
06:15.810 --> 06:18.540 align:middle line:90%
is going to be much more
helpful than the one over on R1.

167
06:18.540 --> 06:20.790 align:middle line:90%
So if you have the ability
to do debugs on both sides,

168
06:20.790 --> 06:22.450 align:middle line:84%
that would be ideal.

169
06:22.450 --> 06:25.310 align:middle line:90%
So now here on R1, if we
did a show crypto session,

170
06:25.310 --> 06:27.780 align:middle line:90%
it's going to show that
we have an active session.

171
06:27.780 --> 06:30.480 align:middle line:90%
And if we do a show
crypto ipsec sa,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
06:27.780 --> 06:30.480 align:middle line:90%
And if we do a show
crypto ipsec sa,

172
06:30.480 --> 06:33.030 align:middle line:90%
it will give us the details
for the secret association

173
06:33.030 --> 06:35.870 align:middle line:90%
for IPsec, which includes the
encapsulations and encryptions

174
06:35.870 --> 06:37.840 align:middle line:84%
and decaps and decryptions.

175
06:37.840 --> 06:40.350 align:middle line:90%
So if we sent five more pings,
which we'll do right now,

176
06:40.350 --> 06:41.700 align:middle line:84%
that should go up to nine.

177
06:41.700 --> 06:45.300 align:middle line:90%
So we do a show crypto ipsec sa,
now we are at a count of nine.

178
06:45.300 --> 06:46.410 align:middle line:84%
So that looks great.

179
06:46.410 --> 06:48.163 align:middle line:90%
And as far as send
errors, we have zero.

180
06:48.163 --> 06:49.830 align:middle line:90%
So in this video, we
had the opportunity

181
06:49.830 --> 06:53.280 align:middle line:90%
to both identify a problem with
the IPsec tunnel, the IKE phase

182
06:53.280 --> 06:54.990 align:middle line:90%
2 tunnel, and also
troubleshoot it

183
06:54.990 --> 06:57.840 align:middle line:90%
by using a debug to identify
that the proposals were not

184
06:57.840 --> 07:00.270 align:middle line:84%
compatible between R1 and R2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:57.840 --> 07:00.270 align:middle line:84%
compatible between R1 and R2.

185
07:00.270 --> 07:01.950 align:middle line:90%
We made them
compatible, tried it

186
07:01.950 --> 07:04.505 align:middle line:90%
again with interesting traffic,
and then the tunnel came up.

187
07:04.505 --> 07:06.130 align:middle line:90%
So thanks for joining
me in this video.

188
07:06.130 --> 07:07.870 align:middle line:90%
And I'll see you
in the next one.

189
07:07.870 --> 07:10.230 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

190
07:10.230 --> 07:13.430 align:middle line:90%
And I'd like to thank
you for viewing.