WEBVTT 1 00:00.000 --> 00:05.000 Sometimes is frustrating to watch somebody go through a process and go almost 2 00:05.000 --> 00:07.970 all the way through like ninety eight percent of the way and then stop short 3 00:07.970 --> 00:11.300 maybe somebody is going to college or they're taking a course they stop short. 4 00:11.300 --> 00:17.200 They didn't get the benefits of all their work well we have the same situation 5 00:17.200 --> 00:19.430 with krip with the ipsick tunnels because we planned our ike phase one like 6 00:19.430 --> 00:22.740 phase two we implemented our ike phase one like phase two sort of. 7 00:22.760 --> 00:27.810 You know what we failed to do or haven't done yet is apply the krypto map to 8 00:27.810 --> 00:32.660 the outbound or the grass interfaces on the vpn pierce and that's the final WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:27.810 --> 00:32.660 the outbound or the grass interfaces on the vpn pierce and that's the final 9 00:32.660 --> 00:36.740 step to making this process work and that's the one that a lot of people forget 10 00:36.740 --> 00:37.160 to do. 11 00:37.160 --> 00:41.120 So let's take a look at our topology will review our configs to this point and 12 00:41.120 --> 00:45.330 then will activate our ike be sick policy and it doesn't work will troubleshoot 13 00:45.330 --> 00:49.290 it together so we've implemented on our one the ike phase one policy and the 14 00:49.290 --> 00:52.200 ike phase two transform sets the crypto maps and everything else. 15 00:52.360 --> 00:56.350 And I also did the respect of work over on our two so if it doesn't go well as 16 00:56.350 --> 01:00.280 because our two is not configured correctly that's totally on me i just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 16 00:56.350 --> 01:00.280 because our two is not configured correctly that's totally on me i just 17 01:00.280 --> 01:02.680 replicated our work we did on our one. 18 01:02.680 --> 01:07.110 Swapped up the peer dressing so forth and our tonight we should be good to go 19 01:07.110 --> 01:10.120 so we're going to go to these interfaces on our one. 20 01:10.120 --> 01:14.820 And our to be zero slash one on our one zero slash two on our two and will 21 01:14.820 --> 01:20.040 simply the command crypto space map space and the name of the crypto map. 22 01:20.120 --> 01:24.730 We do not have to say inbound or outbound it's expecting to be applied on the 23 01:24.730 --> 01:29.600 interface where this router would use what if he's forwarding IP second crypto 24 01:29.600 --> 01:32.800 packets over to our to and here's the play by play. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 01:29.600 --> 01:32.800 packets over to our to and here's the play by play. 25 01:32.800 --> 01:39.130 I'll include this off if if we apply the crypto map and our one gets a packet 26 01:39.130 --> 01:44.320 from PC one this destined from 10 1 0 50 to 10 2 0 50. 27 01:44.360 --> 01:48.350 Our ones going to say whoa whoa whoa I need to this matches my crypto ACL that 28 01:48.350 --> 01:52.580 's included in the crypto map that's the plan is interface I need to encrypt it 29 01:52.580 --> 01:55.840 and ship it over to my peer but it says in frustration. 30 01:55.840 --> 02:00.480 It's brand new i just put it up i don't have a tunnel yet so it would kick into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:55.840 --> 02:00.480 It's brand new i just put it up i don't have a tunnel yet so it would kick into 31 02:00.480 --> 02:01.600 ike phase one. 32 02:01.600 --> 02:05.950 They would do the whole negotiation they would in this case authenticate using 33 02:05.950 --> 02:10.090 pre shared keys generate keys with the feeling that it's at the lifetime and 34 02:10.090 --> 02:12.480 then using that ike phase one tunnel. 35 02:12.520 --> 02:15.860 They would then kick in the ike phase two information they would build a 36 02:15.860 --> 02:19.250 separate ike phase two or ike be sick tunnel and then the traffic would be 37 02:19.250 --> 02:21.600 encrypted using the ike phase two tunnel. 38 02:21.600 --> 02:25.860 The ike tunnel and sent over where are to then decrypt it so the tunnels are 39 02:25.860 --> 02:29.970 not already in place all that work initially has to be done to negotiate and 40 02:29.970 --> 02:34.240 build the tunnels for ike connectivity between those two peers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 40 02:29.970 --> 02:34.240 build the tunnels for ike connectivity between those two peers. 41 02:34.280 --> 02:38.980 So let's configure let's go over to our two first just to verify our work to be 42 02:38.980 --> 02:43.720 good practice by the way show crypto ice account policy as well verify that we 43 02:43.720 --> 02:45.440 have our policies there. 44 02:45.440 --> 02:47.500 Yes to 56 for ike phase one. 45 02:47.500 --> 02:50.800 Shaw to that we have our honor one. 46 02:50.800 --> 02:54.600 Do show crypto ice account policy. 47 02:56.240 --> 03:01.000 We are using okay i thought verify they were the same great great great awesome WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 02:56.240 --> 03:01.000 We are using okay i thought verify they were the same great great great awesome 48 03:01.000 --> 03:05.180 so going back to our two we're using pre shared keys and. 49 03:05.180 --> 03:10.040 If you have a group five lifetime of five thousand seconds to show crypto ice 50 03:10.040 --> 03:11.220 account keys. 51 03:11.220 --> 03:15.490 We are using the key of Cisco exclamation mark two three so is our one 52 03:15.490 --> 03:20.500 fantastic okay and then as far as the ike phase two information to show crypto 53 03:20.500 --> 03:21.040 map. 54 03:21.360 --> 03:26.740 That's a very quick way of saying a lot of the details in that crypto map so it 55 03:26.740 --> 03:32.440 's using a yes and shaw it's using perfect for secrecy with group fifteen. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 03:26.740 --> 03:32.440 's using a yes and shaw it's using perfect for secrecy with group fifteen. 56 03:32.440 --> 03:36.210 There's our crypto a seal from our two which is ten to zero going to ten one 57 03:36.210 --> 03:40.350 zero and these are these are the details i would check if things were not going 58 03:40.350 --> 03:42.880 well are that i p six tunnel didn't function. 59 03:43.200 --> 03:47.240 Looking at the first details for ike phase one and then ike phase two and then 60 03:47.240 --> 03:49.560 verifying where it fell off where it went wrong. 61 03:49.560 --> 03:53.400 Now this is the same that our crypto map is not applied anywhere so let's fix 62 03:53.400 --> 03:58.830 that based on our topology we will go to get zero slash two on our two and girl 63 03:58.830 --> 04:02.460 get zero slash one on our one and that's where we'll apply the crypto maps. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 03:58.830 --> 04:02.460 get zero slash one on our one and that's where we'll apply the crypto maps. 64 04:02.580 --> 04:10.820 So on our to go to configuration mode interface gig zero slash two and crypto 65 04:10.820 --> 04:15.060 map and the name is right here i copy paste it so i get syntax correct. 66 04:15.060 --> 04:18.630 And then you'll notice there's no in or out there's an option for some 67 04:18.630 --> 04:22.820 redundancy will cover redundancy in a separate video but the base the apply and 68 04:22.820 --> 04:23.980 boom it's done. 69 04:24.180 --> 04:27.730 And we have a little message saying hey i see camp is on and so now we do a 70 04:27.730 --> 04:28.820 show crypto map. 71 04:28.820 --> 04:32.770 There's the details and also shows us that it's applied to that interface gig WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 71 04:28.820 --> 04:32.770 There's the details and also shows us that it's applied to that interface gig 72 04:32.770 --> 04:33.780 zero slash two. 73 04:33.780 --> 04:40.310 Couple of things we can do a show crypto ice camp essay that's short for 74 04:40.310 --> 04:44.530 security association that's basically our ike phase one tunnel we don't have 75 04:44.530 --> 04:45.000 one. 76 04:45.280 --> 04:50.800 We haven't configured our one yet also do a show crypto ike be sick. 77 04:50.800 --> 04:56.490 Essay for the security association for ike phase two look at this so it shows 78 04:56.490 --> 05:01.260 that it has this crypto map is applied to get zero slash two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 04:56.490 --> 05:01.260 that it has this crypto map is applied to get zero slash two. 79 05:01.260 --> 05:05.720 And it's showing the interesting traffic but there's no traffic encrypted or 80 05:05.720 --> 05:09.420 decrypted and there's a couple reasons for that one is we haven't had any 81 05:09.420 --> 05:12.940 interesting traffic yet we have generated any and secondly. 82 05:13.000 --> 05:16.720 Are ones not yet set up so are one doesn't have the crypto map applied let's 83 05:16.720 --> 05:19.060 fix that now so we're here are one will do a. 84 05:19.060 --> 05:24.080 Config t interface gig zero slash one and we'll do a crypto map. 85 05:24.080 --> 05:28.380 And it is called scrolling up right there. 86 05:28.380 --> 05:33.280 A copy paste it make up a copy paste it and make sure i get the syntax correct WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 05:28.380 --> 05:33.280 A copy paste it make up a copy paste it and make sure i get the syntax correct 87 05:33.280 --> 05:37.580 as far as the upper lower case paste it in and now it's applied. 88 05:38.020 --> 05:42.130 And we have a message is a camp is now on ice camp again the internet security 89 05:42.130 --> 05:46.040 association key management protocol doing a lot of the heavy lifting force. 90 05:46.040 --> 05:51.010 Dynamically in the background for us regarding key exchange and key negotiation 91 05:51.010 --> 05:53.200 so we show crypto ice camp essay. 92 05:53.200 --> 05:59.160 Wow we don't have we don't have a ike phase one tunnel show crypto my favorite 93 05:59.160 --> 06:03.060 commands show crypto engine connections active is a great one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 05:59.160 --> 06:03.060 commands show crypto engine connections active is a great one. 94 06:03.100 --> 06:07.300 Show the solver tunnels are in place we've got nothing no tunnels what is that. 95 06:07.300 --> 06:12.700 There's a good answer for that with i p [garbled] site site to site vpn tells a 96 06:12.700 --> 06:16.600 traditional way which we just did if there's no interesting traffic. 97 06:16.600 --> 06:20.100 If there's no traffic that matches the crypto a seal that's part of a crypto 98 06:20.100 --> 06:22.200 map on that interface for our one or two. 99 06:22.200 --> 06:26.590 It is there i don't need to build a tunnel traffic needs to go but once we 100 06:26.590 --> 06:30.350 generate traffic then they'll go ahead and i'll kick in the negotiations for a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 100 06:26.590 --> 06:30.350 generate traffic then they'll go ahead and i'll kick in the negotiations for a 101 06:30.350 --> 06:33.080 phase one if they haven't built that so yet they'll build up. 102 06:33.480 --> 06:37.100 They'll kick in the negotiations for a phase to build that and then they'll 103 06:37.100 --> 06:41.500 send the traffic so we can actually watch all that to do that with some debug. 104 06:41.500 --> 06:47.210 So if we do a debug crypto ice camp and that'll be good so we'll see all the 105 06:47.210 --> 06:53.110 ice camp information flow here and i'm sitting at the console so they'll come 106 06:53.110 --> 06:57.500 to the console and we can also a debug crypto i p sec. 107 06:58.100 --> 07:02.000 Enter so those debug is going to be a lot of information but it'll be fun we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 107 06:58.100 --> 07:02.000 Enter so those debug is going to be a lot of information but it'll be fun we 108 07:02.000 --> 07:06.080 can now see once the tunnels are established the details are going on behind 109 07:06.080 --> 07:07.040 the scenes. 110 07:07.040 --> 07:10.580 For both like phase one like phase two now this can become important if we're 111 07:10.580 --> 07:14.200 troubleshooting network we didn't configure or maybe we don't have access to 112 07:14.200 --> 07:15.020 both sides. 113 07:15.020 --> 07:19.390 By doing a debug we can see where it goes bad so if i phase one completes and 114 07:19.390 --> 07:22.400 then i phase two says i can negotiate transform. 115 07:22.440 --> 07:26.740 We might say well you got incompatible transform for like phase two or if it's 116 07:26.740 --> 07:29.380 doing like phase one is not completing it. 117 07:29.380 --> 07:32.720 And it's because once i want to do our say and i want to preshared you can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 117 07:29.380 --> 07:32.720 And it's because once i want to do our say and i want to preshared you can 118 07:32.720 --> 07:36.520 actually see that in the negotiations and troubleshooting by correcting the 119 07:36.520 --> 07:37.280 config. 120 07:37.280 --> 07:41.850 So with this debug on let's bring up our friend right here and we did a trace 121 07:41.850 --> 07:47.650 earlier i just haven't moved this machine since then so if we do is just a ping 122 07:47.650 --> 07:48.060 . 123 07:48.520 --> 07:52.460 To ten dot two dot zero dot fifty well actually the same trace because what's 124 07:52.460 --> 07:56.260 going to happen is the tunnels don't exist yet so the first packet or two is 125 07:56.260 --> 07:59.200 probably going to be drops will do a trace and. 126 07:59.200 --> 08:01.900 The reason it's not continuing right now is because the tunnel in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 126 07:59.200 --> 08:01.900 The reason it's not continuing right now is because the tunnel in the 127 08:01.900 --> 08:03.200 background is being built. 128 08:03.200 --> 08:07.730 Oh look we find so if we did again now the tunnels are all up now says yeah i 129 08:07.730 --> 08:12.140 sent my default gateway and then he shipped over to twenty five two two and 130 08:12.140 --> 08:12.640 then. 131 08:12.740 --> 08:17.610 Final to the final destination so now this is actually encrypted traffic that's 132 08:17.610 --> 08:18.580 being sent. 133 08:18.580 --> 08:22.860 Now if we look at the tunnels let's go back to the seal i have got the bugs gal 134 08:22.860 --> 08:24.160 ore some do an on all. 135 08:24.160 --> 08:28.140 And let's do a we go back to the debug in a moment to show crypto ice account 136 08:28.140 --> 08:30.280 essay for security association. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 136 08:28.140 --> 08:30.280 essay for security association. 137 08:30.280 --> 08:34.360 So this is showing that our ike phase one tunnel is established we can also 138 08:34.360 --> 08:36.640 throw in the keyword of detail there. 139 08:36.920 --> 08:41.030 And that was show us the methods that we use so a yes and shot to do six and 140 08:41.030 --> 08:43.400 pre shared key and if he hung group. 141 08:43.400 --> 08:46.840 All showing up as part of that and share it says. 142 08:46.840 --> 08:51.070 A qm idle quick mode idle that's a good sign that means it's not trying to 143 08:51.070 --> 08:54.680 actively build the tunnel established is all good to go. 144 08:54.680 --> 08:56.700 So we can also show crypto. 145 08:56.700 --> 08:58.120 I piece sec. 146 08:58.120 --> 09:02.720 Essay for security association press enter and that was show us now that we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 146 08:58.120 --> 09:02.720 Essay for security association press enter and that was show us now that we've 147 09:02.720 --> 09:04.820 got from our ones perspective. 148 09:05.020 --> 09:08.440 We're using this IP address for the crypto map is applied there's our 149 09:08.440 --> 09:11.220 interesting traffic specified by the crypto acl. 150 09:11.220 --> 09:15.220 We've got a current peer twenty five two two two and showing us here that the 151 09:15.220 --> 09:18.800 encapsulations and the caps now right here we have an uneven number for sends 152 09:18.800 --> 09:20.420 and receives and that was because. 153 09:20.420 --> 09:24.750 During the initial flow of traffic it was building the tunnels so we wanted to 154 09:24.750 --> 09:28.820 check that what we could do is let's go back to our Linux box to a ping. 155 09:29.020 --> 09:35.860 And let's do a count of let's say ten that be great and we'll go to ten dot two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 155 09:29.020 --> 09:35.860 And let's do a count of let's say ten that be great and we'll go to ten dot two 156 09:35.860 --> 09:40.540 dot zero fifty and that's just an exactly ten fantastic and if we go back to 157 09:40.540 --> 09:44.780 the counters previously in our one it showed thirty five and ten it should now 158 09:44.780 --> 09:46.220 be forty five and twenty. 159 09:46.220 --> 09:51.030 So hit the up arrow key for show crypto IP sec essay and sure not so now we're 160 09:51.030 --> 09:54.820 not losing you know packets because on the initial bill to the tunnel. 161 09:54.900 --> 09:58.100 The tunnel was established in some of those packets were dropped while it was 162 09:58.100 --> 09:59.380 negotiating the tunnels. 163 09:59.380 --> 10:02.510 So here's the beginning of the debug and there's a lot going on but it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 163 09:59.380 --> 10:02.510 So here's the beginning of the debug and there's a lot going on but it 164 10:02.510 --> 10:06.080 basically boils down to this there was traffic that was sent on the interface 165 10:06.080 --> 10:08.820 for the crypto map was they didn't have any tunnels established. 166 10:08.820 --> 10:13.540 So they negotiate the tunnel so that involved sending over here we have our 167 10:13.540 --> 10:17.500 priority five policy for ike phase one with the details there. 168 10:17.620 --> 10:17.800 Based on this message there is a it's acceptable meaning they matched on both 169 10:17.800 --> 10:24.750 sides the details of the policy so they agreed they're going to run diffy hel 170 10:24.750 --> 10:32.180 man they did authentication here's the pre shared key matching the other peer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 170 10:24.750 --> 10:32.180 man they did authentication here's the pre shared key matching the other peer. 171 10:32.180 --> 10:37.140 So they did the whole pre shared key authentication thing as we scroll down to 172 10:37.140 --> 10:42.240 all the messages here ice account it was successful we then kick into IP sec 173 10:42.240 --> 10:44.940 which is basically the ike phase two. 174 10:45.060 --> 10:49.880 So they begin the negotiation of ike phase two based on the transform sets 175 10:49.880 --> 10:54.230 including this guy a yes and shot three four h mac they create the ike phase 176 10:54.230 --> 10:57.780 two tunnel and then now they're starting to forward traffic on that tunnel. 177 10:57.780 --> 11:01.210 Another thing really fun for you and I do is let's take a look at with a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 177 10:57.780 --> 11:01.210 Another thing really fun for you and I do is let's take a look at with a 178 11:01.210 --> 11:04.980 protocol capture and take a look at the packets before they had ike sec and 179 11:04.980 --> 11:08.470 then during and after so we can take a look at what the packets look like 180 11:08.470 --> 11:12.580 before they're encrypted after their encrypted and then after their decrypted 181 11:12.580 --> 11:13.460 by the other and 182 11:13.500 --> 11:16.930 we'll do that in the next video meanwhile I hope this has been informative for 183 11:16.930 --> 11:19.300 you and I'd like to thank you for viewing. 184 11:19.300 --> 11:29.300 [BLANK_AUDIO]