WEBVTT

1
00:00.000 --> 00:05.000
So we've done a lot of great work in planning, implementing, and then verifying

2
00:05.000 --> 00:05.960
our IPsec

3
00:05.960 --> 00:06.960
site site VPNs.

4
00:06.960 --> 00:10.880
And I thought, well, you know what, we deserve a little bit of a celebration.

5
00:10.880 --> 00:14.900
And to do that in the world of networking, we use packet captures to take a

6
00:14.900 --> 00:15.560
peek at what

7
00:15.560 --> 00:17.600
the packets are actually doing on the network.

8
00:17.600 --> 00:22.270
So let's take a look at before encryption and then during encryption and then

9
00:22.270 --> 00:23.000
after on

10
00:23.000 --> 00:25.240
the remote side of the VPN tunnel.

11
00:25.240 --> 00:28.220
So to do that, let's generate some traffic here from this PC and we can

12
00:28.220 --> 00:28.920
generate some

13
00:28.920 --> 00:32.040
ICMP traffic and some HTTP traffic over here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.920 --> 00:32.040
ICMP traffic and some HTTP traffic over here.

14
00:32.040 --> 00:34.200
This is a web server that's also running.

15
00:34.200 --> 00:36.810
And the cool thing is if we capture the traffic here, which we'll look at here

16
00:36.810 --> 00:37.960
in just a moment,

17
00:37.960 --> 00:40.960
we'll see the naked normal traffic as it normal is.

18
00:40.960 --> 00:45.460
But once that traffic exits this interface, it'll be encrypted, shipped over to

19
00:45.460 --> 00:46.760
this peer.

20
00:46.760 --> 00:53.070
So we'll just see those external IP addresses of 1511 and 25222 on the outside

21
00:53.070 --> 00:53.920
IP packet.

22
00:53.920 --> 00:56.920
And then our two will decrypt that and then ship it off.

23
00:56.920 --> 01:01.240
So PC too, we'll just see traffic coming from 10, 10, 50, destined to itself.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:56.920 --> 01:01.240
So PC too, we'll just see traffic coming from 10, 10, 50, destined to itself.

24
01:01.240 --> 01:05.470
And if it replies, it would source it from its own IP address going to PC ones

25
01:05.470 --> 01:06.080
address

26
01:06.080 --> 01:07.400
as the destination.

27
01:07.400 --> 01:09.560
Our two would see that traffic is also being interesting.

28
01:09.560 --> 01:14.360
It would encrypt it, ship it over to R1 as encrypted data who then decrypt it.

29
01:14.360 --> 01:19.680
So I've got a capture going here, here in the cloud and also here.

30
01:19.680 --> 01:23.000
And let's go ahead and generate some traffic and then we'll share the results.

31
01:23.000 --> 01:26.240
So here at this client, we'll go ahead and let's do some pings.

32
01:26.240 --> 01:27.600
We'll send 100 pings over.

33
01:27.600 --> 01:28.920
Actually, I don't need 100.

34
01:28.920 --> 01:30.120
So let me go ahead and stop that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:28.920 --> 01:30.120
So let me go ahead and stop that.

35
01:30.120 --> 01:33.480
And then we also generate some HTTP traffic.

36
01:33.480 --> 01:38.800
So we'll open up a browser and it'll go over 10.2.0.50.

37
01:38.800 --> 01:42.050
And let me hit refresh a few times just to make sure we really are sending some

38
01:42.050 --> 01:42.520
traffic

39
01:42.520 --> 01:46.560
and for good measure, maybe some more ICMP traffic as well.

40
01:46.560 --> 01:48.080
There's a few more of those.

41
01:48.080 --> 01:49.080
Great.

42
01:49.080 --> 01:50.080
All right, then we have something to look at.

43
01:50.080 --> 01:51.080
Let's bring up the captures.

44
01:51.080 --> 01:52.080
All right.

45
01:52.080 --> 01:53.080
So here's the B4 picture.

46
01:53.080 --> 01:56.400
This is captured on the local network of 10.1.0.

47
01:56.400 --> 01:59.680
I've got a whole bunch of loopback messages sourced by the router itself.

48
01:59.680 --> 02:00.680
Let's go down here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.680 --> 02:00.680
Let's go down here.

49
02:00.680 --> 02:03.160
We have some ICMP and here we have some TCP.

50
02:03.160 --> 02:04.160
Fantastic.

51
02:04.160 --> 02:05.160
So let's grab this one right here.

52
02:05.160 --> 02:06.160
It's an HTTP get.

53
02:06.160 --> 02:07.160
Fantastic.

54
02:07.160 --> 02:09.640
Coming from 10.1.0.50, going to 10.2.0.50.

55
02:09.640 --> 02:13.720
Now 512 is what it looks like as far as bytes on the local area network.

56
02:13.720 --> 02:16.480
But once it gets encrypted, there'll be the new ESP header and a little

57
02:16.480 --> 02:17.120
overhead for

58
02:17.120 --> 02:18.600
authentication and everything else.

59
02:18.600 --> 02:20.200
So we can expect it to be slightly bigger.

60
02:20.200 --> 02:23.600
Now the key is we might not be able to even identify it because it's going to

61
02:23.600 --> 02:24.280
be encrypted

62
02:24.280 --> 02:25.280
once we look at it.

63
02:25.280 --> 02:29.960
So it's an HTTP get request that the 10.1.50 client is making to the server at

64
02:29.960 --> 02:31.720
10.2.0.50.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:29.960 --> 02:31.720
10.2.0.50.

65
02:31.720 --> 02:35.480
So let's take a look and see if we can find that same packet in the cloud.

66
02:35.480 --> 02:40.770
So here we go to the cloud where I captured it and we have a whole bunch of ESP

67
02:40.770 --> 02:42.000
traffic.

68
02:42.000 --> 02:44.560
So ESP is the encapsulating security payload.

69
02:44.560 --> 02:46.480
This is from R1.

70
02:46.480 --> 02:51.040
There's layer three source address, layer three destination addresses R2.

71
02:51.040 --> 02:53.880
And then it's pointing if we open up the header here, it's pointing to the next

72
02:53.880 --> 02:54.240
protocol

73
02:54.240 --> 02:56.600
of protocol 50, which is ESP.

74
02:56.600 --> 03:01.010
So for the ESP payload, we really can't tell what's in that payload because it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:56.600 --> 03:01.010
So for the ESP payload, we really can't tell what's in that payload because it

75
03:01.010 --> 03:02.640
's all encrypted.

76
03:02.640 --> 03:06.790
So if we try to find something that's close to that size, let's take a look

77
03:06.790 --> 03:07.640
back again.

78
03:07.640 --> 03:11.080
So we had an HTTP request of like 512.

79
03:11.080 --> 03:12.880
Let's go back to the cloud.

80
03:12.880 --> 03:14.440
And that could be it.

81
03:14.440 --> 03:19.220
So with the extra authentication information and the ESP header and the tunnel

82
03:19.220 --> 03:19.720
ing.

83
03:19.720 --> 03:24.110
So there's no way to confirm that with this protocol capture because this is an

84
03:24.110 --> 03:24.840
encrypted

85
03:24.840 --> 03:28.720
encapsulated packet that's being sent from R1 or R2.

86
03:28.720 --> 03:32.420
And then R2, when it gets it, it would decrypt it and forward it on its way to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.720 --> 03:32.420
And then R2, when it gets it, it would decrypt it and forward it on its way to

87
03:32.420 --> 03:34.040
the final destination.

88
03:34.040 --> 03:36.240
And we have a capture of that as well right here.

89
03:36.240 --> 03:39.680
So this is the capture over on the 10.2 network.

90
03:39.680 --> 03:40.680
And what was this side?

91
03:40.680 --> 03:41.680
Oh, there it is right there.

92
03:41.680 --> 03:42.680
That's probably the same one.

93
03:42.680 --> 03:43.680
HTTP get request.

94
03:43.680 --> 03:47.800
And if we take a look at the details of that and let's expand the IP4 header

95
03:47.800 --> 03:48.640
information

96
03:48.640 --> 03:49.640
here.

97
03:49.640 --> 03:52.200
It says here that the identification, it hears the hex.

98
03:52.200 --> 03:54.720
Here's the decimal 62126.

99
03:54.720 --> 03:57.120
Let's go check the original packet on the other side.

100
03:57.120 --> 03:59.320
So here's that packet that I think it is.

101
03:59.320 --> 04:02.160
If we expand that and nope, that is not it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:59.320 --> 04:02.160
If we expand that and nope, that is not it.

102
04:02.160 --> 04:04.240
That is 62133.

103
04:04.240 --> 04:05.240
So let me do this.

104
04:05.240 --> 04:09.960
Let me right click on that and say apply as filter and selected.

105
04:09.960 --> 04:11.960
And then I'll just take that same filter.

106
04:11.960 --> 04:16.370
Right click, copy it and we'll go to the destination network at site 2 and I'll

107
04:16.370 --> 04:16.640
put

108
04:16.640 --> 04:19.560
in that same display filter and press enter.

109
04:19.560 --> 04:21.040
There it is right there.

110
04:21.040 --> 04:22.040
Okay.

111
04:22.040 --> 04:25.160
So that is the same packet on both sides.

112
04:25.160 --> 04:29.870
So over at the site 1, there's the source IP and destination, the details for

113
04:29.870 --> 04:31.160
that packet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:29.870 --> 04:31.160
that packet.

114
04:31.160 --> 04:33.960
And here's that same packet after it made the journey over the cloud.

115
04:33.960 --> 04:38.140
But for this journey across the cloud, we really can't confirm which packet

116
04:38.140 --> 04:39.600
this is because

117
04:39.600 --> 04:42.120
all the payload information is encrypted.

118
04:42.120 --> 04:45.900
So we can't see the details of the original IP header because it's now part of

119
04:45.900 --> 04:46.680
the encrypted

120
04:46.680 --> 04:47.680
payload.

121
04:47.680 --> 04:50.680
So I'd like to thank you for joining me in this set of videos regarding the

122
04:50.680 --> 04:51.160
original

123
04:51.160 --> 04:57.320
flavor of site to site VPNs on Cisco iOS routers that are using crypto maps.

124
04:57.320 --> 05:00.650
If you haven't already done so, I'd also encourage you to take a look at the IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:57.320 --> 05:00.650
If you haven't already done so, I'd also encourage you to take a look at the IP

125
05:00.650 --> 05:00.920
sec

126
05:00.920 --> 05:05.370
fundamentals set of videos and also the other videos we have on topics like

127
05:05.370 --> 05:06.840
FlexVPN, GetVPN

128
05:06.840 --> 05:10.720
and DM VPN, all of which are available here at CVT nuggets.

129
05:10.720 --> 05:11.960
So thanks for joining me.

130
05:11.960 --> 05:13.640
I'll see you in the next set of videos.

131
05:13.640 --> 05:17.530
Meanwhile, I hope this has been informative for you and I'd like to thank you

132
05:17.530 --> 05:18.280
for viewing.

133
05:18.280 --> 05:28.280
[BLANK_AUDIO]