WEBVTT

1
00:00.000 --> 00:01.190 align:middle line:84%


2
00:01.190 --> 00:02.970 align:middle line:90%
In the previous video,
we looked at a plan

3
00:02.970 --> 00:06.203 align:middle line:90%
for implementing the IPSec
for phase 1 and for phase 2.

4
00:06.203 --> 00:07.620 align:middle line:90%
In this video,
we're going to take

5
00:07.620 --> 00:09.810 align:middle line:90%
a look at the actual
implementation of IKE phase

6
00:09.810 --> 00:12.150 align:middle line:90%
1 and IKE phase 2 with
a special attention

7
00:12.150 --> 00:14.183 align:middle line:90%
to detail with the
fact that we are not

8
00:14.183 --> 00:15.600 align:middle line:90%
going to create a
crypto map as we

9
00:15.600 --> 00:17.700 align:middle line:90%
did with site-to-site
VPNs that use crypto maps.

10
00:17.700 --> 00:21.390 align:middle line:90%
Instead we'll create an IPSec
tunnel protection profile,

11
00:21.390 --> 00:23.370 align:middle line:90%
and then just simply
attach that profile

12
00:23.370 --> 00:24.777 align:middle line:84%
to the tunnel interface.

13
00:24.777 --> 00:26.110 align:middle line:84%
And then we'll get the job done.

14
00:26.110 --> 00:29.040 align:middle line:90%
So here are details for IKE
phase 1 and IKE phase 2.

15
00:29.040 --> 00:31.840 align:middle line:90%
I'll refer back to this if I
forget any of those values.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.040 --> 00:31.840 align:middle line:90%
I'll refer back to this if I
forget any of those values.

16
00:31.840 --> 00:34.710 align:middle line:90%
Let's go to the CLI and
start at router number 1,

17
00:34.710 --> 00:37.500 align:middle line:90%
and create the IKE phase 1
policy that matches this.

18
00:37.500 --> 00:39.750 align:middle line:90%
So here on router 1, we'll
go into configuration mode,

19
00:39.750 --> 00:44.040 align:middle line:84%
crypto, crypto ISAKMP policy.

20
00:44.040 --> 00:45.285 align:middle line:84%
And then we can use--

21
00:45.285 --> 00:47.410 align:middle line:90%
I don't have any policies
currently on this router.

22
00:47.410 --> 00:49.500 align:middle line:90%
So I'm going to go and
choose 7 just for fun.

23
00:49.500 --> 00:50.250 align:middle line:84%
Press Enter.

24
00:50.250 --> 00:53.250 align:middle line:90%
That puts this into crypto
ISAKMP policy configuration

25
00:53.250 --> 00:53.750 align:middle line:84%
mode.

26
00:53.750 --> 00:55.020 align:middle line:84%
And lets the specify details.

27
00:55.020 --> 01:00.990 align:middle line:90%
So for encryption, we wanted to
go ahead and use AES and 256.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:55.020 --> 01:00.990 align:middle line:90%
So for encryption, we wanted to
go ahead and use AES and 256.

28
01:00.990 --> 01:07.170 align:middle line:90%
And for hashing, we wanted
to go ahead and use SHA 256.

29
01:07.170 --> 01:09.240 align:middle line:90%
Let me look at my notes
to make sure that's true.

30
01:09.240 --> 01:09.740 align:middle line:84%
Yep.

31
01:09.740 --> 01:11.250 align:middle line:84%
AES 256, SHA 256.

32
01:11.250 --> 01:13.260 align:middle line:84%
So far so good.

33
01:13.260 --> 01:16.770 align:middle line:90%
For the authentication, we
want to use pre-shared keys.

34
01:16.770 --> 01:20.230 align:middle line:90%
And for the Diffie-Hellman
we want to use group 5.

35
01:20.230 --> 01:23.570 align:middle line:90%
And for the lifetime, we're
going to go for 5,000.

36
01:23.570 --> 01:30.960 align:middle line:90%
And so do show
crypto ISAKMP policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:23.570 --> 01:30.960 align:middle line:90%
And so do show
crypto ISAKMP policy.

37
01:30.960 --> 01:32.030 align:middle line:84%
And there's our policy.

38
01:32.030 --> 01:33.822 align:middle line:90%
I want to make sure we
get all the details.

39
01:33.822 --> 01:37.230 align:middle line:90%
AES 256, SHA 256, pre-shared
key, Diffie-Hellman group 5,

40
01:37.230 --> 01:38.940 align:middle line:84%
and a 5,000 second lifetime.

41
01:38.940 --> 01:39.960 align:middle line:84%
Fantastic.

42
01:39.960 --> 01:42.260 align:middle line:90%
So we'll exit out of
that configuration mode,

43
01:42.260 --> 01:43.510 align:middle line:84%
and then let's create our key.

44
01:43.510 --> 01:46.590 align:middle line:90%
So crypto ISAKMP
key, and let's use

45
01:46.590 --> 01:48.813 align:middle line:84%
Cisco, exclamation mark 2, 3.

46
01:48.813 --> 01:50.730 align:middle line:90%
And let's say we're going
to be willing to use

47
01:50.730 --> 01:52.180 align:middle line:84%
that address with.

48
01:52.180 --> 01:53.790 align:middle line:90%
Now we could just
specify the peer,

49
01:53.790 --> 01:55.909 align:middle line:90%
or if we're going to
have lots of other peers,

50
01:55.909 --> 01:56.992 align:middle line:84%
we could just say 0.0.0.0.

51
01:56.992 --> 01:59.172 align:middle line:90%
And that's a wild
card that says,

52
01:59.172 --> 02:00.630 align:middle line:90%
hey, I'll use this
key with anybody
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.172 --> 02:00.630 align:middle line:90%
hey, I'll use this
key with anybody

53
02:00.630 --> 02:01.745 align:middle line:84%
who has this matching key.

54
02:01.745 --> 02:03.120 align:middle line:90%
So I'm going to
use that for now.

55
02:03.120 --> 02:04.470 align:middle line:84%
Let's do a do show.

56
02:04.470 --> 02:08.660 align:middle line:90%
Crypto, ISAKMP key,
and there's the key.

57
02:08.660 --> 02:10.410 align:middle line:90%
I just want to make
sure I typed it right.

58
02:10.410 --> 02:11.670 align:middle line:84%
So far so good now.

59
02:11.670 --> 02:13.220 align:middle line:84%
Now next-- that's IKE phase 1.

60
02:13.220 --> 02:16.785 align:middle line:90%
Now for IKE phase 2, we're going
to create a transform set just

61
02:16.785 --> 02:17.910 align:middle line:84%
as we did with crypto maps.

62
02:17.910 --> 02:20.640 align:middle line:90%
Except this time, after we
create the transform set,

63
02:20.640 --> 02:23.880 align:middle line:90%
we're not going to nest it
inside of a crypto map itself.

64
02:23.880 --> 02:28.300 align:middle line:90%
We're going to include it
as part of an IPSec profile.

65
02:28.300 --> 02:29.880 align:middle line:90%
So let's create
the transform set.

66
02:29.880 --> 02:33.712 align:middle line:90%
To do that, we'll do a
crypto, IPSec, transform set,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.880 --> 02:33.712 align:middle line:90%
To do that, we'll do a
crypto, IPSec, transform set,

67
02:33.712 --> 02:34.670 align:middle line:84%
and then we'll name it.

68
02:34.670 --> 02:37.440 align:middle line:84%
I'm going to call this our-set.

69
02:37.440 --> 02:38.940 align:middle line:90%
And then we're going
to include what

70
02:38.940 --> 02:42.203 align:middle line:90%
we want to have in this
IKE phase 2 transform set.

71
02:42.203 --> 02:43.620 align:middle line:90%
One of the keys
also is that if it

72
02:43.620 --> 02:45.660 align:middle line:90%
says IPSec in the
actual command,

73
02:45.660 --> 02:48.720 align:middle line:90%
generally that's referring
to IPSec, the IKE phase 2.

74
02:48.720 --> 02:51.330 align:middle line:90%
If it says ISAKMP
in the command,

75
02:51.330 --> 02:54.090 align:middle line:90%
that normally is referring
to the IKE phase 1 elements.

76
02:54.090 --> 02:58.240 align:middle line:90%
Like crypto ISAKMP policy versus
crypto IPSec transform set.

77
02:58.240 --> 03:03.210 align:middle line:90%
So based on our plans,
let's use ESP-AES and 128,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:58.240 --> 03:03.210 align:middle line:90%
So based on our plans,
let's use ESP-AES and 128,

78
03:03.210 --> 03:08.520 align:middle line:90%
and then ESP-SHA, and
we want to do 384.

79
03:08.520 --> 03:09.510 align:middle line:84%
And that was it.

80
03:09.510 --> 03:11.190 align:middle line:90%
Now here we can
specify the mode.

81
03:11.190 --> 03:14.310 align:middle line:90%
If we don't specify mode
tunnel, it will automatically

82
03:14.310 --> 03:14.890 align:middle line:84%
do it for us.

83
03:14.890 --> 03:16.307 align:middle line:90%
That's can be the
default, but I'm

84
03:16.307 --> 03:18.050 align:middle line:90%
going to put it
in just for grins.

85
03:18.050 --> 03:20.650 align:middle line:90%
And then exit out of
transform configuration mode.

86
03:20.650 --> 03:22.650 align:middle line:90%
So hang on to your socks
because right now we're

87
03:22.650 --> 03:24.473 align:middle line:90%
going to diverge from
the crypto map option

88
03:24.473 --> 03:25.890 align:middle line:90%
that we did in the
previous videos

89
03:25.890 --> 03:28.230 align:middle line:90%
on crypto map IPSec VPN
tunnels, and now we're

90
03:28.230 --> 03:30.830 align:middle line:90%
going to create an
IPSec profile instead.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.230 --> 03:30.830 align:middle line:90%
going to create an
IPSec profile instead.

91
03:30.830 --> 03:33.180 align:middle line:90%
Think of the IPSec
profile as including

92
03:33.180 --> 03:35.740 align:middle line:90%
the details for IKE phase
2, but we're not going

93
03:35.740 --> 03:36.990 align:middle line:84%
to include it in a crypto map.

94
03:36.990 --> 03:39.150 align:middle line:90%
It'll be part of the
IPSec profile itself,

95
03:39.150 --> 03:41.000 align:middle line:90%
and then we'll
attach that profile

96
03:41.000 --> 03:42.000 align:middle line:84%
to the tunnel interface.

97
03:42.000 --> 03:42.768 align:middle line:84%
And boom.

98
03:42.768 --> 03:44.310 align:middle line:90%
We're good to go as
far as protecting

99
03:44.310 --> 03:47.580 align:middle line:90%
our traffic on that tunnel
interface with IPSec.

100
03:47.580 --> 03:50.370 align:middle line:90%
I'd like to break into
this really scheduled video

101
03:50.370 --> 03:52.640 align:middle line:90%
from my editing chair
just editing the video,

102
03:52.640 --> 03:54.210 align:middle line:90%
and I'll take an
extra moment to talk

103
03:54.210 --> 03:58.110 align:middle line:90%
about what we're about to
do with IPSec and protecting

104
03:58.110 --> 03:59.340 align:middle line:84%
the GRE traffic.

105
03:59.340 --> 04:01.620 align:middle line:90%
The old way of doing
it would be to create
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:59.340 --> 04:01.620 align:middle line:90%
The old way of doing
it would be to create

106
04:01.620 --> 04:04.772 align:middle line:90%
a crypto map and a crypto
ACL looking for GRE traffic,

107
04:04.772 --> 04:06.480 align:middle line:90%
and that would be our
interesting traffic

108
04:06.480 --> 04:07.920 align:middle line:84%
to encrypt and decrypt--

109
04:07.920 --> 04:09.750 align:middle line:84%
the GRE protocol 47.

110
04:09.750 --> 04:11.760 align:middle line:90%
However, a more
efficient way of doing

111
04:11.760 --> 04:13.560 align:middle line:90%
it, which is what I'm
about to show you,

112
04:13.560 --> 04:16.110 align:middle line:84%
is referred to using VTIs--

113
04:16.110 --> 04:18.348 align:middle line:84%
a virtual tunnel interface.

114
04:18.348 --> 04:19.890 align:middle line:90%
So we still have
our tunnel, we still

115
04:19.890 --> 04:21.360 align:middle line:90%
have the parameters
on it, but what

116
04:21.360 --> 04:24.420 align:middle line:90%
we're going to do is we are
going to change the mode.

117
04:24.420 --> 04:26.670 align:middle line:90%
The default mode for
our tunnel is GRE,

118
04:26.670 --> 04:31.950 align:middle line:90%
and we're going to change it
to say tunnel mode IPSec IPv4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:26.670 --> 04:31.950 align:middle line:90%
and we're going to change it
to say tunnel mode IPSec IPv4.

119
04:31.950 --> 04:35.220 align:middle line:90%
So it's no longer using GRE,
it's now going to use IPSec.

120
04:35.220 --> 04:37.860 align:middle line:90%
In addition, we slap on the
tunnel protection profile,

121
04:37.860 --> 04:40.380 align:middle line:90%
the IPSec profile, that
encrypts and decrypt

122
04:40.380 --> 04:42.910 align:middle line:90%
the traffic going in and
out of that interface.

123
04:42.910 --> 04:45.540 align:middle line:90%
So the difference is
if we used a crypto map

124
04:45.540 --> 04:47.460 align:middle line:90%
looking for GRE traffic
and we applied that

125
04:47.460 --> 04:50.940 align:middle line:90%
to the physical interface,
that would be GRE over IPSec.

126
04:50.940 --> 04:53.490 align:middle line:90%
And what we're about to
witness and experience

127
04:53.490 --> 04:56.370 align:middle line:90%
is using a virtual tunnel
interface where we're not

128
04:56.370 --> 04:58.560 align:middle line:90%
using the tunnel
mode of GRE, we're

129
04:58.560 --> 05:01.200 align:middle line:90%
using tunnel mode
IPSec for IPv4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:58.560 --> 05:01.200 align:middle line:90%
using tunnel mode
IPSec for IPv4.

130
05:01.200 --> 05:03.810 align:middle line:90%
So with that little
injection, let's continue

131
05:03.810 --> 05:06.360 align:middle line:90%
on with our configuration
and verification

132
05:06.360 --> 05:09.510 align:middle line:90%
of a virtual tunnel interface
that has a tunnel protection

133
05:09.510 --> 05:11.490 align:middle line:84%
profile for IPSec.

134
05:11.490 --> 05:15.828 align:middle line:90%
So to create the profile, the
syntax is crypto IPSec profile.

135
05:15.828 --> 05:17.620 align:middle line:90%
And then we'll go ahead
and give it a name.

136
05:17.620 --> 05:19.380 align:middle line:84%
Let's call it our-IPSec-profile.

137
05:19.380 --> 05:21.960 align:middle line:84%


138
05:21.960 --> 05:24.288 align:middle line:90%
And then inside of
this profile, we

139
05:24.288 --> 05:26.580 align:middle line:90%
are going to go ahead and
set the transform set that we

140
05:26.580 --> 05:27.820 align:middle line:84%
created a few moments ago.

141
05:27.820 --> 05:29.260 align:middle line:84%
So set transform set.

142
05:29.260 --> 05:30.500 align:middle line:84%
And the name is--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.260 --> 05:30.500 align:middle line:84%
And the name is--

143
05:30.500 --> 05:33.040 align:middle line:90%
I would just go
ahead and paste that.

144
05:33.040 --> 05:34.480 align:middle line:84%
And then we're good to go.

145
05:34.480 --> 05:37.800 align:middle line:90%
So we now have this profile
called our IPSec profile, which

146
05:37.800 --> 05:39.190 align:middle line:84%
includes the transform set.

147
05:39.190 --> 05:41.520 align:middle line:90%
So now we have the IKE
phase 1 policy setup.

148
05:41.520 --> 05:43.800 align:middle line:90%
We have transform set
that created IKE phase 2.

149
05:43.800 --> 05:46.350 align:middle line:90%
We've got the IPSec
profile configured

150
05:46.350 --> 05:48.080 align:middle line:84%
that has transform set in it.

151
05:48.080 --> 05:50.520 align:middle line:90%
It's now time to go ahead
the tunnel interface,

152
05:50.520 --> 05:52.210 align:middle line:84%
and tell it to use it.

153
05:52.210 --> 05:54.840 align:middle line:90%
So to do that, we'll go into
configuration mode interface

154
05:54.840 --> 05:57.720 align:middle line:90%
tunnel 0, and we're going
to do two specific things.

155
05:57.720 --> 06:02.573 align:middle line:90%
We're going to a tunnel
mode IPSec for IPv4 traffic,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:57.720 --> 06:02.573 align:middle line:90%
We're going to a tunnel
mode IPSec for IPv4 traffic,

156
06:02.573 --> 06:04.740 align:middle line:90%
and then we're going to
specify the IPSec profile we

157
06:04.740 --> 06:05.470 align:middle line:84%
want to use.

158
06:05.470 --> 06:07.860 align:middle line:90%
Now the tunnel just went down
too because R1 is thinking,

159
06:07.860 --> 06:11.100 align:middle line:90%
Oh, this is IPSec IPv4,
and the other side is just

160
06:11.100 --> 06:13.300 align:middle line:84%
using genric GRE all by itself.

161
06:13.300 --> 06:15.640 align:middle line:90%
So they don't agree on that,
and the tunnel is down.

162
06:15.640 --> 06:18.990 align:middle line:90%
So before we leave R1, let's
also use the command tunnel

163
06:18.990 --> 06:20.780 align:middle line:84%
protection IPSec.

164
06:20.780 --> 06:23.280 align:middle line:90%
And the profile is going to
give me the profile that we just

165
06:23.280 --> 06:23.882 align:middle line:84%
created.

166
06:23.882 --> 06:25.590 align:middle line:90%
So I'm going to go
and scroll up and just

167
06:25.590 --> 06:29.370 align:middle line:90%
grab that, right click,
copy it, and then paste it.

168
06:29.370 --> 06:30.890 align:middle line:84%
That way I don't have a typo.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:29.370 --> 06:30.890 align:middle line:84%
That way I don't have a typo.

169
06:30.890 --> 06:33.220 align:middle line:84%
And boom, we are good to go.

170
06:33.220 --> 06:34.620 align:middle line:84%
So now R1 is all ready to go.

171
06:34.620 --> 06:36.940 align:middle line:90%
It just needs a partner
that's agreeing with it.

172
06:36.940 --> 06:38.610 align:middle line:90%
So we're going to go
over to R2, and R2

173
06:38.610 --> 06:41.880 align:middle line:90%
is going need the IKE phase
1 policy, the transform set,

174
06:41.880 --> 06:43.830 align:middle line:90%
the IPSec profile,
and then attached

175
06:43.830 --> 06:45.660 align:middle line:84%
to the tunnel interface itself.

176
06:45.660 --> 06:47.070 align:middle line:84%
We'll do that right now.

177
06:47.070 --> 06:49.440 align:middle line:90%
So there's the IKE
phase 1 policy on R2

178
06:49.440 --> 06:51.630 align:middle line:84%
that matches what is over on R1.

179
06:51.630 --> 06:54.070 align:middle line:90%
Next we'll specify
the pre-shared key.

180
06:54.070 --> 06:55.470 align:middle line:84%
So we'll go into that next.

181
06:55.470 --> 06:57.240 align:middle line:90%
Now the pre-shared
key matches, and R2

182
06:57.240 --> 07:00.300 align:middle line:90%
is willing to use that
pre-shared key with anybody.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

182
06:57.240 --> 07:00.300 align:middle line:90%
is willing to use that
pre-shared key with anybody.

183
07:00.300 --> 07:02.015 align:middle line:90%
Next we'll create
our transform set.

184
07:02.015 --> 07:03.390 align:middle line:90%
We'll make sure
it matches, or is

185
07:03.390 --> 07:06.600 align:middle line:90%
compatible with the transforms
that R1 wants to use.

186
07:06.600 --> 07:08.670 align:middle line:90%
Next we'll create
an IPSec profile,

187
07:08.670 --> 07:10.722 align:middle line:90%
and inside that
profile, we'll specify

188
07:10.722 --> 07:12.930 align:middle line:90%
that it's going to use the
transform set that we just

189
07:12.930 --> 07:14.230 align:middle line:84%
created.

190
07:14.230 --> 07:16.500 align:middle line:90%
And then we'll go to
interface tunnel 0,

191
07:16.500 --> 07:18.660 align:middle line:90%
and we'll specify that
the mode for that tunnel

192
07:18.660 --> 07:21.660 align:middle line:84%
is going to be IPSec for IPv4.

193
07:21.660 --> 07:24.060 align:middle line:90%
And we're going to specify
the tunnel protection profile

194
07:24.060 --> 07:25.810 align:middle line:84%
for IPSec that it should use.

195
07:25.810 --> 07:26.860 align:middle line:84%
So we'll do that next.

196
07:26.860 --> 07:28.800 align:middle line:90%
So tunnel protection
IPSec profile,

197
07:28.800 --> 07:31.140 align:middle line:90%
the name of the IPSec
profile, press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
07:28.800 --> 07:31.140 align:middle line:90%
the name of the IPSec
profile, press Enter.

198
07:31.140 --> 07:33.600 align:middle line:90%
And if that's not working, our
neighborship should come up.

199
07:33.600 --> 07:34.100 align:middle line:84%
There it is.

200
07:34.100 --> 07:35.666 align:middle line:84%
That looks really great.

201
07:35.666 --> 07:38.460 align:middle line:90%
So if we go back to
our client at PC1

202
07:38.460 --> 07:42.270 align:middle line:90%
and we try to reach PC2 again,
and go to the web page there,

203
07:42.270 --> 07:45.240 align:middle line:90%
the traffic should hit R1 before
it shipped out that tunnel

204
07:45.240 --> 07:45.990 align:middle line:84%
interface.

205
07:45.990 --> 07:48.450 align:middle line:90%
It should be also
protected with IPSec.

206
07:48.450 --> 07:49.650 align:middle line:84%
Let's do a quick test.

207
07:49.650 --> 07:52.170 align:middle line:90%
And then the next video,
we'll do some packet analysis

208
07:52.170 --> 07:55.230 align:middle line:90%
to verify that what we think
is happening indeed is.

209
07:55.230 --> 07:57.930 align:middle line:84%
So here is the client at site 1.

210
07:57.930 --> 07:59.270 align:middle line:84%
We'll open up a browser.

211
07:59.270 --> 08:02.820 align:middle line:90%
We'll go to 10.2.0.50,
and that looks great.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
07:59.270 --> 08:02.820 align:middle line:90%
We'll go to 10.2.0.50,
and that looks great.

212
08:02.820 --> 08:05.470 align:middle line:90%
We'll refresh that a few
times, and we are good to go.

213
08:05.470 --> 08:06.520 align:middle line:84%
We have connectivity.

214
08:06.520 --> 08:08.730 align:middle line:90%
And back to the routers,
if we do a show crypto,

215
08:08.730 --> 08:11.280 align:middle line:84%
engine connection is active.

216
08:11.280 --> 08:14.220 align:middle line:90%
So here's showing us that we
have some IPSec, IKE phase 2,

217
08:14.220 --> 08:16.660 align:middle line:84%
and some IKE phase 1 tunnels.

218
08:16.660 --> 08:20.940 align:middle line:90%
And we can do a show crypto
ISAKMP SA for the IKE phase 1

219
08:20.940 --> 08:27.520 align:middle line:90%
information, and a show crypto
IPSec SA for the IKE phase 2

220
08:27.520 --> 08:28.020 align:middle line:84%
information.

221
08:28.020 --> 08:29.100 align:middle line:90%
And there they're
showing us that we

222
08:29.100 --> 08:31.440 align:middle line:90%
have encapsulated and
de-encapsulated packets that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

222
08:29.100 --> 08:31.440 align:middle line:90%
have encapsulated and
de-encapsulated packets that

223
08:31.440 --> 08:33.298 align:middle line:84%
are being protected via IPSec.

224
08:33.298 --> 08:34.840 align:middle line:90%
So now that it
appears to be working,

225
08:34.840 --> 08:37.929 align:middle line:90%
let's take a look at it with a
packet capture before, during,

226
08:37.929 --> 08:40.627 align:middle line:90%
and after just to verify that
what we think is happening

227
08:40.627 --> 08:41.460 align:middle line:84%
is really happening.

228
08:41.460 --> 08:42.752 align:middle line:84%
I'll see you in the next video.

229
08:42.752 --> 08:45.120 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

230
08:45.120 --> 08:48.260 align:middle line:90%
And I'd like to thank
you for viewing.