WEBVTT

1
00:00.000 --> 00:01.003 align:middle line:84%


2
00:01.003 --> 00:03.170 align:middle line:90%
In this video, I'd like to
chat with you about doing

3
00:03.170 --> 00:04.370 align:middle line:84%
IPsec troubleshooting.

4
00:04.370 --> 00:07.418 align:middle line:90%
But instead of using IKE version
1, let's kick it up a notch

5
00:07.418 --> 00:09.710 align:middle line:90%
and take a look at how we
would troubleshoot and verify

6
00:09.710 --> 00:12.920 align:middle line:90%
IKE version 2 using the
same physical topology,

7
00:12.920 --> 00:15.680 align:middle line:90%
but a slightly different
implementation of our IPsec

8
00:15.680 --> 00:16.580 align:middle line:84%
VPN.

9
00:16.580 --> 00:19.582 align:middle line:90%
So let's get the lay
of the land for IKEv2.

10
00:19.582 --> 00:21.290 align:middle line:90%
I have a separate set
of videos regarding

11
00:21.290 --> 00:24.602 align:middle line:90%
setting up a site-to-site
VPN tunnel using IKEv2.

12
00:24.602 --> 00:26.060 align:middle line:90%
And it's the same
physical topology

13
00:26.060 --> 00:28.170 align:middle line:90%
except for using
tunnel interfaces.

14
00:28.170 --> 00:31.658 align:middle line:90%
So tunnel interface 0 here,
and tunnel interface 0 here--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.170 --> 00:31.658 align:middle line:90%
So tunnel interface 0 here,
and tunnel interface 0 here--

15
00:31.658 --> 00:33.950 align:middle line:90%
and that tunnel interface
has the network address space

16
00:33.950 --> 00:36.290 align:middle line:84%
of 10.12.12.0.

17
00:36.290 --> 00:41.500 align:middle line:90%
And over here at R1, we have .1
and over here at R2 we have .2.

18
00:41.500 --> 00:43.460 align:middle line:90%
And then I created
an IPsec profile

19
00:43.460 --> 00:45.020 align:middle line:90%
that's been
associated or applied

20
00:45.020 --> 00:46.980 align:middle line:84%
to those tunnel interfaces.

21
00:46.980 --> 00:50.330 align:middle line:90%
So effectively, instead of using
a crypto map and crypto ACLs,

22
00:50.330 --> 00:53.120 align:middle line:90%
any traffic that's routed
over this tunnel interface

23
00:53.120 --> 00:54.950 align:middle line:90%
is going to be
encrypted, shipped over

24
00:54.950 --> 00:56.632 align:middle line:90%
to the peer, where
it can be decrypted,

25
00:56.632 --> 00:58.590 align:middle line:90%
and then forwarded on to
its final destination.

26
00:58.590 --> 01:02.910 align:middle line:90%
Up here, I included 10.1.0.0
and 10.2.0.0 as part of EIGRP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.590 --> 01:02.910 align:middle line:90%
Up here, I included 10.1.0.0
and 10.2.0.0 as part of EIGRP.

27
01:02.910 --> 01:05.355 align:middle line:90%
I also included the tunnel
interface as part of EIGRP.

28
01:05.355 --> 01:07.730 align:middle line:90%
So from a routing perspective,
which is really important,

29
01:07.730 --> 01:10.370 align:middle line:90%
as we know, R2 is going to
forward traffic for the 10.1

30
01:10.370 --> 01:13.580 align:middle line:90%
network over the tunnel, at
which point, the IPsec profile

31
01:13.580 --> 01:14.360 align:middle line:84%
would kick in.

32
01:14.360 --> 01:16.037 align:middle line:90%
And they'd set up
their security.

33
01:16.037 --> 01:17.370 align:middle line:84%
And the same thing for router 1.

34
01:17.370 --> 01:19.160 align:middle line:90%
If he needs to get
to 10.2.0.0, he

35
01:19.160 --> 01:21.110 align:middle line:90%
would forward it, based
on his routing table,

36
01:21.110 --> 01:22.818 align:middle line:90%
over the tunnel
interface, at which point

37
01:22.818 --> 01:25.820 align:middle line:90%
the cryptography would kick
in due to the IPsec profile

38
01:25.820 --> 01:26.930 align:middle line:84%
on the tunnel interface.

39
01:26.930 --> 01:28.970 align:middle line:90%
And here's a big difference
between the previous version

40
01:28.970 --> 01:30.140 align:middle line:84%
of IKE and IKE version 2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.970 --> 01:30.140 align:middle line:84%
of IKE and IKE version 2.

41
01:30.140 --> 01:35.060 align:middle line:90%
With IKE version 2, we have
an IKEv2 security association.

42
01:35.060 --> 01:37.760 align:middle line:90%
So we no longer have
an IKE phase 1 tunnel.

43
01:37.760 --> 01:40.460 align:middle line:90%
We are now going to build an
IKEv2 security association.

44
01:40.460 --> 01:43.310 align:middle line:90%
And then we're going to
have children, children SAs.

45
01:43.310 --> 01:47.560 align:middle line:90%
So a child SA that can be
spun off would be an IPsec SA.

46
01:47.560 --> 01:49.760 align:middle line:90%
And that's good news
because all the debugs

47
01:49.760 --> 01:51.920 align:middle line:90%
and the commands we have
regarding IPsec security

48
01:51.920 --> 01:54.170 align:middle line:90%
associations, those
all still apply.

49
01:54.170 --> 01:56.300 align:middle line:90%
But we have some new
commands and debug options

50
01:56.300 --> 01:58.340 align:middle line:90%
for IKE version 2
specifically, as we

51
01:58.340 --> 02:00.840 align:middle line:90%
take a look at this
initial IKEv2 SA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.340 --> 02:00.840 align:middle line:90%
take a look at this
initial IKEv2 SA.

52
02:00.840 --> 02:02.720 align:middle line:90%
So let's make a road
trip over to R1.

53
02:02.720 --> 02:05.178 align:middle line:90%
We'll do a quick verification
of how it's been implemented.

54
02:05.178 --> 02:07.803 align:middle line:90%
And then we'll walk through some
of the show and debug commands

55
02:07.803 --> 02:10.460 align:middle line:90%
that we could use if we're
troubleshooting IKE version 2.

56
02:10.460 --> 02:12.430 align:middle line:90%
So here at R1, let's
do a show ip route.

57
02:12.430 --> 02:14.450 align:middle line:90%
We always want to
check routing first.

58
02:14.450 --> 02:16.695 align:middle line:90%
And from R1's perspective,
we have a default route.

59
02:16.695 --> 02:18.070 align:middle line:90%
We also have a
route here learned

60
02:18.070 --> 02:21.050 align:middle line:90%
via EIGRP that says
to get to 10.2.0.0,

61
02:21.050 --> 02:23.253 align:middle line:90%
we go ahead and forward
it via the tunnel.

62
02:23.253 --> 02:25.670 align:middle line:90%
At which point, if you take a
look at the tunnel interface

63
02:25.670 --> 02:28.580 align:middle line:90%
with a show run for
interface tunnel 0,

64
02:28.580 --> 02:30.830 align:middle line:90%
it will show us the details
for that tunnel interface,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.580 --> 02:30.830 align:middle line:90%
it will show us the details
for that tunnel interface,

65
02:30.830 --> 02:32.450 align:middle line:84%
its source, its destination.

66
02:32.450 --> 02:35.030 align:middle line:90%
And we have the
IPsec profile applied

67
02:35.030 --> 02:36.750 align:middle line:84%
to that tunnel interface.

68
02:36.750 --> 02:39.550 align:middle line:90%
So what are some of the commands
we could use to verify IKEv2?

69
02:39.550 --> 02:42.790 align:middle line:90%
We could do the
show crypto session.

70
02:42.790 --> 02:44.540 align:middle line:90%
And that works with
IKE version 1 as well.

71
02:44.540 --> 02:47.270 align:middle line:90%
And here it has the information
regarding the IKEv2 tunnel,

72
02:47.270 --> 02:51.710 align:middle line:90%
which says from 15.1.1.1
locally, says R1, to 25.2.2.2.

73
02:51.710 --> 02:54.560 align:middle line:90%
And the port is 500, UDP
port 500 that they're

74
02:54.560 --> 02:55.670 align:middle line:84%
using for that tunnel.

75
02:55.670 --> 02:56.600 align:middle line:84%
And it's active.

76
02:56.600 --> 02:59.990 align:middle line:90%
It's also showing here in this
output of show crypto session

77
02:59.990 --> 03:02.150 align:middle line:90%
that we also have
an IPsec tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.990 --> 03:02.150 align:middle line:90%
that we also have
an IPsec tunnel.

78
03:02.150 --> 03:04.370 align:middle line:90%
And it's specifying all
traffic because that's

79
03:04.370 --> 03:05.747 align:middle line:84%
applied to a tunnel interface.

80
03:05.747 --> 03:08.330 align:middle line:90%
So what this implies is that any
traffic going into the tunnel

81
03:08.330 --> 03:09.838 align:middle line:84%
matches our encryption policy.

82
03:09.838 --> 03:11.630 align:middle line:90%
And we're going to go
ahead and encrypt it.

83
03:11.630 --> 03:12.960 align:middle line:84%
Now, look at this, also.

84
03:12.960 --> 03:14.390 align:middle line:84%
This is a little bit of legacy.

85
03:14.390 --> 03:15.200 align:middle line:84%
It says crypto map.

86
03:15.200 --> 03:15.800 align:middle line:84%
Trust me.

87
03:15.800 --> 03:18.133 align:middle line:90%
There's not a crypto map
anywhere in this configuration.

88
03:18.133 --> 03:19.330 align:middle line:84%
In fact, let's take a look.

89
03:19.330 --> 03:22.070 align:middle line:84%
We'll do a show run include map.

90
03:22.070 --> 03:23.737 align:middle line:90%
Yeah, and the word
"map" never shows up.

91
03:23.737 --> 03:25.070 align:middle line:84%
We don't have a crypto map here.

92
03:25.070 --> 03:26.630 align:middle line:90%
However, in some
of the output, even

93
03:26.630 --> 03:29.120 align:middle line:90%
for IKE version 2 and if
we're not using crypto maps,

94
03:29.120 --> 03:30.290 align:middle line:84%
it still shows up sometimes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.120 --> 03:30.290 align:middle line:84%
it still shows up sometimes.

95
03:30.290 --> 03:31.290 align:middle line:84%
In fact, check this out.

96
03:31.290 --> 03:33.560 align:middle line:90%
If we do a show crypto
map, here it's showing us

97
03:33.560 --> 03:36.050 align:middle line:90%
the show crypto map
details for IPsec

98
03:36.050 --> 03:38.990 align:middle line:90%
even though we are not
using a crypto map.

99
03:38.990 --> 03:41.240 align:middle line:90%
It's including the details
regarding the transform set

100
03:41.240 --> 03:42.200 align:middle line:84%
that's being used.

101
03:42.200 --> 03:44.480 align:middle line:90%
And it specifies here the
name of the IKEv2 profile,

102
03:44.480 --> 03:47.630 align:middle line:90%
as well as the IPsec profile
that we're using on the tunnel

103
03:47.630 --> 03:50.600 align:middle line:90%
interface, and in the transform
set that is being used,

104
03:50.600 --> 03:53.870 align:middle line:90%
the transforms involved for
the actual IPsec or the child

105
03:53.870 --> 03:55.610 align:middle line:84%
security association.

106
03:55.610 --> 03:58.338 align:middle line:90%
So some other cool commands that
we can issue are show crypto.

107
03:58.338 --> 03:59.130 align:middle line:84%
And check this out.

108
03:59.130 --> 04:00.458 align:middle line:84%
We'll do ikev2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
03:59.130 --> 04:00.458 align:middle line:84%
We'll do ikev2.

109
04:00.458 --> 04:03.000 align:middle line:90%
And then there's a whole bunch
of options after this as well.

110
04:03.000 --> 04:06.080 align:middle line:90%
But if we wanted to look at
the IKEv2 security association,

111
04:06.080 --> 04:09.100 align:middle line:90%
we just type in show
crypto ikev2 sa.

112
04:09.100 --> 04:10.833 align:middle line:90%
There is also an
option for detailed

113
04:10.833 --> 04:12.500 align:middle line:90%
if you want to get
all the nitty gritty.

114
04:12.500 --> 04:15.320 align:middle line:90%
But show crypto ikev2 sa by
itself will give us plenty.

115
04:15.320 --> 04:17.320 align:middle line:90%
And if we scroll a little
bit over to the right,

116
04:17.320 --> 04:20.839 align:middle line:90%
it's showing us the details
regarding that IKEv2 security

117
04:20.839 --> 04:21.470 align:middle line:84%
association.

118
04:21.470 --> 04:25.340 align:middle line:90%
And if we do the command
show crypto engine

119
04:25.340 --> 04:28.800 align:middle line:90%
connections active
and pressed Enter,

120
04:28.800 --> 04:32.080 align:middle line:90%
here it's showing us our
IKEv2 security association.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:28.800 --> 04:32.080 align:middle line:90%
here it's showing us our
IKEv2 security association.

121
04:32.080 --> 04:34.550 align:middle line:90%
And then it's showing
us our individual SAs,

122
04:34.550 --> 04:37.585 align:middle line:90%
one for each direction for
IPsec that is currently in use.

123
04:37.585 --> 04:38.960 align:middle line:90%
And the traffic
that we're seeing

124
04:38.960 --> 04:41.870 align:middle line:90%
encrypted back and forth here
is because EIGRP is running.

125
04:41.870 --> 04:44.900 align:middle line:90%
And the EIGRP traffic going over
the tunnel is being encrypted.

126
04:44.900 --> 04:47.060 align:middle line:90%
So if we hit the Up
arrow key, that's

127
04:47.060 --> 04:48.890 align:middle line:90%
going to increment
alone just based

128
04:48.890 --> 04:50.935 align:middle line:90%
on the EIGRP packets
being sent back and forth.

129
04:50.935 --> 04:52.310 align:middle line:90%
And if we want to
see the details

130
04:52.310 --> 04:54.110 align:middle line:90%
for the IPsec SA,
the child SA, we

131
04:54.110 --> 04:56.800 align:middle line:84%
could do a show crypto ipsec.

132
04:56.800 --> 04:59.630 align:middle line:90%
And this is very much like it
was with IKE version 1, show

133
04:59.630 --> 05:01.712 align:middle line:84%
crypto ipsec SA, press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:59.630 --> 05:01.712 align:middle line:84%
crypto ipsec SA, press Enter.

134
05:01.712 --> 05:03.420 align:middle line:90%
So because we're not
using the crypto map

135
05:03.420 --> 05:05.640 align:middle line:90%
but we have an IPsec profile
associated with a tunnel

136
05:05.640 --> 05:07.500 align:middle line:90%
interface, we're
encrypting all traffic

137
05:07.500 --> 05:09.510 align:middle line:90%
that's going over
that tunnel interface.

138
05:09.510 --> 05:12.810 align:middle line:90%
Here's our peer information,
with UDP port 500 identified

139
05:12.810 --> 05:16.170 align:middle line:90%
as being used, and packets
encapsulated and deencapsulated

140
05:16.170 --> 05:19.320 align:middle line:90%
and encrypted and decrypted,
and send errors being 0.

141
05:19.320 --> 05:20.820 align:middle line:90%
And so if we scroll
up a little bit,

142
05:20.820 --> 05:23.242 align:middle line:90%
we have the inbound
security associations.

143
05:23.242 --> 05:25.200 align:middle line:90%
And we have the outbound
security associations.

144
05:25.200 --> 05:27.840 align:middle line:90%
And if we hit the Up
arrow key a couple times,

145
05:27.840 --> 05:29.325 align:middle line:90%
do show crypto
connections active.

146
05:29.325 --> 05:30.870 align:middle line:90%
And that's representing
these two right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:29.325 --> 05:30.870 align:middle line:90%
And that's representing
these two right here.

147
05:30.870 --> 05:31.870 align:middle line:84%
One of these is inbound.

148
05:31.870 --> 05:32.610 align:middle line:84%
One is outbound.

149
05:32.610 --> 05:34.530 align:middle line:90%
In fact, the connection
ID 5 right here

150
05:34.530 --> 05:36.780 align:middle line:90%
for outbound, that means
this is the outbound security

151
05:36.780 --> 05:37.770 align:middle line:84%
association.

152
05:37.770 --> 05:41.340 align:middle line:90%
And if we scroll up, the
inbound one is connection ID 6.

153
05:41.340 --> 05:43.460 align:middle line:90%
And that's this bad
boy right there.

154
05:43.460 --> 05:45.960 align:middle line:90%
And regarding debugging, there's
some special debug commands

155
05:45.960 --> 05:46.850 align:middle line:84%
regarding IKEv2.

156
05:46.850 --> 05:48.152 align:middle line:84%
It's debug crypto ikev2.

157
05:48.152 --> 05:49.860 align:middle line:90%
And then we have some
additional options.

158
05:49.860 --> 05:51.635 align:middle line:84%
Or we can press Enter here.

159
05:51.635 --> 05:53.760 align:middle line:90%
And then if-- in fact,
let's do that on both sides.

160
05:53.760 --> 05:58.230 align:middle line:90%
We'll go over to R2,
debug crypto ikev2.

161
05:58.230 --> 06:00.540 align:middle line:90%
And let's go ahead and
shut down an interface
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
05:58.230 --> 06:00.540 align:middle line:90%
And let's go ahead and
shut down an interface

162
06:00.540 --> 06:02.064 align:middle line:84%
and bring it back up.

163
06:02.064 --> 06:04.380 align:middle line:90%
So because we're using
our tunnel interface,

164
06:04.380 --> 06:06.730 align:middle line:84%
we'll go ahead and shut that.

165
06:06.730 --> 06:07.980 align:middle line:84%
And give that a moment to cry.

166
06:07.980 --> 06:09.382 align:middle line:84%
So EIGRP is timed out.

167
06:09.382 --> 06:11.340 align:middle line:90%
And the security association
is having problems

168
06:11.340 --> 06:12.360 align:middle line:84%
because the interface is down.

169
06:12.360 --> 06:14.040 align:middle line:90%
Now, the cool thing
about IKE version 2,

170
06:14.040 --> 06:16.913 align:middle line:90%
it's pretty aggressive as far
as if something goes down,

171
06:16.913 --> 06:19.080 align:middle line:90%
it does a lot better job
of identifying that there's

172
06:19.080 --> 06:21.600 align:middle line:90%
a problem and try to
establish that, as opposed

173
06:21.600 --> 06:24.310 align:middle line:90%
to IKE version 1, which
was less aggressive.

174
06:24.310 --> 06:26.050 align:middle line:84%
So there is a ton.

175
06:26.050 --> 06:28.640 align:middle line:90%
There's like 15
pages of output here.

176
06:28.640 --> 06:30.390 align:middle line:90%
So instead of trying
to scroll up and down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:28.640 --> 06:30.390 align:middle line:90%
So instead of trying
to scroll up and down

177
06:30.390 --> 06:32.860 align:middle line:90%
through all of that, let's just
go take a look at the logs.

178
06:32.860 --> 06:37.145 align:middle line:90%
Let's do a show log and
make sure it's in there.

179
06:37.145 --> 06:38.520 align:middle line:90%
Yep, we're logging
to the buffer.

180
06:38.520 --> 06:39.420 align:middle line:84%
That's fantastic.

181
06:39.420 --> 06:41.230 align:middle line:90%
And then we can sort
through this that way.

182
06:41.230 --> 06:42.813 align:middle line:90%
So if we scroll
through some of this--

183
06:42.813 --> 06:44.580 align:middle line:90%
there's just a lot
of output here--

184
06:44.580 --> 06:47.370 align:middle line:90%
verify peer's
policy, peer's policy

185
06:47.370 --> 06:49.740 align:middle line:90%
verified, including
the peer wants

186
06:49.740 --> 06:52.313 align:middle line:90%
to go ahead and authenticate
via preshared key.

187
06:52.313 --> 06:53.730 align:middle line:90%
And then we go
through the process

188
06:53.730 --> 06:56.560 align:middle line:90%
of using our preshared key
for the authentication.

189
06:56.560 --> 06:58.260 align:middle line:90%
And if we take a look
at router 2 also,

190
06:58.260 --> 07:00.270 align:middle line:90%
which is running the
same debug, and scroll up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
06:58.260 --> 07:00.270 align:middle line:90%
which is running the
same debug, and scroll up

191
07:00.270 --> 07:01.320 align:middle line:84%
through the output--

192
07:01.320 --> 07:03.660 align:middle line:90%
here, as part of the output,
saying IKEv2 security

193
07:03.660 --> 07:05.502 align:middle line:90%
association created,
which is a good sign.

194
07:05.502 --> 07:07.710 align:middle line:90%
And we can look at all the
details leading up to that

195
07:07.710 --> 07:08.520 align:middle line:84%
previously in the output.

196
07:08.520 --> 07:10.020 align:middle line:90%
And again, some of
the show commands

197
07:10.020 --> 07:12.750 align:middle line:90%
we could would be
show crypto session,

198
07:12.750 --> 07:15.390 align:middle line:84%
and show crypto ikev2 sa.

199
07:15.390 --> 07:18.860 align:middle line:90%
And then show crypto ipsec
sa for the IPsec child

200
07:18.860 --> 07:21.647 align:middle line:84%
SA that's been created by IKEv2.

201
07:21.647 --> 07:23.230 align:middle line:90%
So from a troubleshooting
perspective,

202
07:23.230 --> 07:25.260 align:middle line:90%
this is very similar to what
we had with IKE version 1.

203
07:25.260 --> 07:27.600 align:middle line:90%
We'd want to make sure we have
routing in place-- critical.

204
07:27.600 --> 07:29.460 align:middle line:90%
We'd want to make sure
we have connectivity

205
07:29.460 --> 07:32.280 align:middle line:90%
between the two devices, the
two endpoints of the VPN tunnel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

205
07:29.460 --> 07:32.280 align:middle line:90%
between the two devices, the
two endpoints of the VPN tunnel.

206
07:32.280 --> 07:34.470 align:middle line:90%
And we'd also want
to make sure that we

207
07:34.470 --> 07:37.110 align:middle line:90%
have that parent SA, the
security association put

208
07:37.110 --> 07:37.900 align:middle line:84%
in place.

209
07:37.900 --> 07:40.410 align:middle line:90%
So whether it's the IKE phase
1 tunnel with IKE version

210
07:40.410 --> 07:43.035 align:middle line:90%
1 or the IKEv2 tunnel
with IKE version 2,

211
07:43.035 --> 07:44.910 align:middle line:90%
we'd want to make sure
that's in place first.

212
07:44.910 --> 07:46.550 align:middle line:90%
And if that's not working,
troubleshoot that.

213
07:46.550 --> 07:48.008 align:middle line:90%
And then with the
parent tunnel up,

214
07:48.008 --> 07:50.280 align:middle line:90%
if the second tunnel, the
child tunnel, in this case,

215
07:50.280 --> 07:52.253 align:middle line:90%
with the IPsec SA, if
that's not working,

216
07:52.253 --> 07:54.420 align:middle line:90%
we could troubleshoot that
using our troubleshooting

217
07:54.420 --> 07:56.170 align:middle line:90%
technologies and the
debugs that we talked

218
07:56.170 --> 07:59.248 align:middle line:90%
about in the previous video,
like, debug crypto ipsec sa

219
07:59.248 --> 07:59.790 align:middle line:84%
and so forth.

220
07:59.790 --> 08:01.060 align:middle line:90%
All right, so in
this video, we've
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

220
07:59.790 --> 08:01.060 align:middle line:90%
All right, so in
this video, we've

221
08:01.060 --> 08:02.893 align:middle line:90%
taken a look at some
tools and some commands

222
08:02.893 --> 08:04.590 align:middle line:90%
that we could use
with IKE version 2.

223
08:04.590 --> 08:05.590 align:middle line:84%
I'm glad you joined me.

224
08:05.590 --> 08:06.970 align:middle line:84%
I'll see you in the next video.

225
08:06.970 --> 08:09.270 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

226
08:09.270 --> 08:12.530 align:middle line:90%
And I'd like to thank
you for viewing.