WEBVTT

1
00:00.000 --> 00:01.060 align:middle line:84%


2
00:01.060 --> 00:03.790 align:middle line:90%
In the previous video, we set
up some really great security

3
00:03.790 --> 00:07.150 align:middle line:90%
associations, one for
IKEv2, one for IPsec.

4
00:07.150 --> 00:09.150 align:middle line:90%
They're all in place, but
they're not being used

5
00:09.150 --> 00:12.180 align:middle line:90%
and the answer or the reason
for that is because of routing.

6
00:12.180 --> 00:14.050 align:middle line:90%
Those two routers,
R1 and R2, have

7
00:14.050 --> 00:16.600 align:middle line:90%
no reason to forward
traffic through those tunnel

8
00:16.600 --> 00:17.543 align:middle line:84%
interfaces.

9
00:17.543 --> 00:19.210 align:middle line:90%
So in this video,
we're going to address

10
00:19.210 --> 00:20.918 align:middle line:90%
a couple of different
ways to solve that,

11
00:20.918 --> 00:23.180 align:middle line:90%
and then we'll implement
a solution together.

12
00:23.180 --> 00:25.390 align:middle line:84%
So here is our tunnel.

13
00:25.390 --> 00:27.293 align:middle line:84%
And it's encrypted with IPsec.

14
00:27.293 --> 00:29.210 align:middle line:90%
We're just going to send
some traffic over it.

15
00:29.210 --> 00:30.610 align:middle line:84%
We have tunnel 0 on R2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.210 --> 00:30.610 align:middle line:84%
We have tunnel 0 on R2.

16
00:30.610 --> 00:33.130 align:middle line:84%
We have tunnel 0 on R1.

17
00:33.130 --> 00:35.380 align:middle line:90%
And if we want to
protect the traffic,

18
00:35.380 --> 00:38.620 align:middle line:90%
the 10.1 over here, the 10.2,
the traffic back and forth,

19
00:38.620 --> 00:39.840 align:middle line:84%
we could use static routes.

20
00:39.840 --> 00:41.920 align:middle line:90%
We could tell R2,
hey, to get to 10.1,

21
00:41.920 --> 00:43.420 align:middle line:90%
send it this way
through the tunnel.

22
00:43.420 --> 00:45.175 align:middle line:90%
And we could tell R1,
hey, to get to 10.2,

23
00:45.175 --> 00:46.300 align:middle line:84%
send it through the tunnel.

24
00:46.300 --> 00:48.430 align:middle line:90%
Or-- that doesn't
scale very well.

25
00:48.430 --> 00:50.950 align:middle line:90%
Or we could use a
dynamic routing protocol.

26
00:50.950 --> 00:54.170 align:middle line:90%
And almost any routing
protocol would work here.

27
00:54.170 --> 00:55.820 align:middle line:84%
So we could just for--

28
00:55.820 --> 00:58.470 align:middle line:90%
EIGRP converges super
quick, and it's super easy.

29
00:58.470 --> 01:01.180 align:middle line:90%
We don't have to wait 40 seconds
for the initial neighborships
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.470 --> 01:01.180 align:middle line:90%
We don't have to wait 40 seconds
for the initial neighborships

30
01:01.180 --> 01:02.210 align:middle line:84%
and stuff to come up.

31
01:02.210 --> 01:05.230 align:middle line:90%
So if we use the EIGRP, we
could include the 10 network.

32
01:05.230 --> 01:07.420 align:middle line:90%
And that would include
this interface.

33
01:07.420 --> 01:10.850 align:middle line:90%
Oh, we're also using
10.12.12 here as well.

34
01:10.850 --> 01:13.520 align:middle line:90%
So that would include this
network and the tunnels.

35
01:13.520 --> 01:15.490 align:middle line:90%
So they could become
adjacent and neighbors,

36
01:15.490 --> 01:16.390 align:middle line:84%
and this network.

37
01:16.390 --> 01:17.390 align:middle line:84%
Let's do that.

38
01:17.390 --> 01:20.540 align:middle line:90%
So once we enable EIGRP
just for the 10 network,

39
01:20.540 --> 01:24.030 align:middle line:90%
we should have reachability
from R2's perspective of 10.1

40
01:24.030 --> 01:26.680 align:middle line:84%
via the tunnel, and vice versa.

41
01:26.680 --> 01:28.810 align:middle line:90%
R1 should be able to
reach 10.2 via the tunnel.

42
01:28.810 --> 01:31.280 align:middle line:90%
And then we should have
some encrypted traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.810 --> 01:31.280 align:middle line:90%
And then we should have
some encrypted traffic.

43
01:31.280 --> 01:34.010 align:middle line:90%
So on R1 let's do a--
actually, let's do this.

44
01:34.010 --> 01:35.695 align:middle line:90%
Let's do a show
ip protocols just

45
01:35.695 --> 01:37.060 align:middle line:84%
to see what we have currently.

46
01:37.060 --> 01:39.320 align:middle line:90%
So we have no-- we don't
have EIGRP running yet,

47
01:39.320 --> 01:43.810 align:middle line:90%
so I'll do a config t, router,
eigrp, autonomous system 1.

48
01:43.810 --> 01:46.680 align:middle line:90%
We'll make that match on both
sides so they mean the same AS.

49
01:46.680 --> 01:48.370 align:middle line:90%
And then we'll
just do network 10.

50
01:48.370 --> 01:51.130 align:middle line:90%
Now, because it's
the 10 network,

51
01:51.130 --> 01:52.900 align:middle line:90%
we're just going
for the first octet.

52
01:52.900 --> 01:54.400 align:middle line:84%
We don't have to use a wildcard.

53
01:54.400 --> 01:56.200 align:middle line:90%
Just press Enter,
and we're done.

54
01:56.200 --> 01:59.230 align:middle line:90%
We can verify that with a
show ip eigrp interface.

55
01:59.230 --> 02:00.938 align:middle line:90%
And sure enough,
we got the gig 03.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:59.230 --> 02:00.938 align:middle line:90%
And sure enough,
we got the gig 03.

56
02:00.938 --> 02:02.105 align:middle line:84%
That's the internal network.

57
02:02.105 --> 02:04.380 align:middle line:90%
And we have the tunnel
0, which is heading off

58
02:04.380 --> 02:05.860 align:middle line:84%
across the transport network.

59
02:05.860 --> 02:06.730 align:middle line:84%
Fantastic.

60
02:06.730 --> 02:08.810 align:middle line:84%
Let's do the same thing on R2.

61
02:08.810 --> 02:11.422 align:middle line:90%
So on R2, let's do
a debug ip routing.

62
02:11.422 --> 02:12.880 align:middle line:90%
So we can see those
routes come in.

63
02:12.880 --> 02:14.140 align:middle line:84%
That's always fun to watch.

64
02:14.140 --> 02:17.380 align:middle line:90%
And config t router eigrp
autonomous system 1,

65
02:17.380 --> 02:19.600 align:middle line:84%
and network 10.

66
02:19.600 --> 02:22.300 align:middle line:84%
And so close.

67
02:22.300 --> 02:24.163 align:middle line:84%
There we go.

68
02:24.163 --> 02:25.330 align:middle line:84%
So there's our neighborship.

69
02:25.330 --> 02:29.920 align:middle line:90%
And we just added the
10.1.0 network via EIGRP.

70
02:29.920 --> 02:32.837 align:middle line:90%
So there's the administrative
distance for EIGRP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:29.920 --> 02:32.837 align:middle line:90%
So there's the administrative
distance for EIGRP.

71
02:32.837 --> 02:35.170 align:middle line:90%
There's the feasible distance
for that route, also known

72
02:35.170 --> 02:37.010 align:middle line:84%
as the composite metric.

73
02:37.010 --> 02:40.450 align:middle line:90%
And now let's do
a show ip route.

74
02:40.450 --> 02:42.810 align:middle line:90%
And there is our
EIGRP learned route.

75
02:42.810 --> 02:45.272 align:middle line:90%
And it says, hey, to get
there, go over the tunnel.

76
02:45.272 --> 02:46.730 align:middle line:90%
So now if we do a
ping that's going

77
02:46.730 --> 02:48.910 align:middle line:90%
to go over the
tunnel to 10.1.0.1,

78
02:48.910 --> 02:52.900 align:middle line:90%
that's the IP address
on R1 on the inside.

79
02:52.900 --> 02:55.210 align:middle line:90%
There's also a
host there at .50.

80
02:55.210 --> 02:56.070 align:middle line:84%
Let's ping that.

81
02:56.070 --> 02:57.820 align:middle line:90%
And let's also do a
trace to that as well.

82
02:57.820 --> 03:00.610 align:middle line:84%
Trace to 10.1.0.50.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:57.820 --> 03:00.610 align:middle line:84%
Trace to 10.1.0.50.

83
03:00.610 --> 03:02.110 align:middle line:84%
And sure enough, there you go.

84
03:02.110 --> 03:04.330 align:middle line:90%
The next hop is
10.12.12.1, which

85
03:04.330 --> 03:05.870 align:middle line:84%
is the other end of the tunnel.

86
03:05.870 --> 03:07.600 align:middle line:84%
So that traffic was protected.

87
03:07.600 --> 03:10.300 align:middle line:90%
And if we did a packet
capture on that traffic,

88
03:10.300 --> 03:12.380 align:middle line:90%
it would look
something like this.

89
03:12.380 --> 03:13.520 align:middle line:84%
So here is the traffic.

90
03:13.520 --> 03:16.985 align:middle line:90%
So the 25.2.2.2 is one end of
the tunnel going to 15.1.1.1.

91
03:16.985 --> 03:17.860 align:middle line:84%
That's the other end.

92
03:17.860 --> 03:19.360 align:middle line:84%
And there's responses back.

93
03:19.360 --> 03:21.860 align:middle line:90%
So with that trace
route that we just did,

94
03:21.860 --> 03:24.160 align:middle line:90%
which would be using
UDP as the headers,

95
03:24.160 --> 03:25.960 align:middle line:90%
we can't see any
of that, because it

96
03:25.960 --> 03:27.960 align:middle line:84%
got encapsulated in IPsec.

97
03:27.960 --> 03:30.562 align:middle line:90%
And at layer 4 it says,
hey, it's protocol 50 ESP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:27.960 --> 03:30.562 align:middle line:90%
And at layer 4 it says,
hey, it's protocol 50 ESP,

98
03:30.562 --> 03:32.770 align:middle line:90%
but it does have here in
the header-- check this out.

99
03:32.770 --> 03:36.250 align:middle line:90%
It has the ESP SPI, the
Security Parameter Index,

100
03:36.250 --> 03:41.440 align:middle line:90%
which is 0x for
hexadecimal, 83a96616.

101
03:41.440 --> 03:44.830 align:middle line:90%
So if we take a look at R2 on
the-- this is going from R2

102
03:44.830 --> 03:46.420 align:middle line:84%
over to R1--

103
03:46.420 --> 03:48.550 align:middle line:90%
we should be able
to verify that SPI.

104
03:48.550 --> 03:51.370 align:middle line:90%
So here in R2, if we do a
show crypto ipsec Security

105
03:51.370 --> 03:53.740 align:middle line:90%
Association, or
sa is the syntax.

106
03:53.740 --> 03:55.400 align:middle line:84%
Check this out right there.

107
03:55.400 --> 03:57.790 align:middle line:90%
This is the current
outbound SPI,

108
03:57.790 --> 04:02.633 align:middle line:84%
0x 83a96616 in hexadecimal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
03:57.790 --> 04:02.633 align:middle line:84%
0x 83a96616 in hexadecimal.

109
04:02.633 --> 04:04.300 align:middle line:90%
And we can also see
that we have packets

110
04:04.300 --> 04:05.883 align:middle line:90%
that are being
encrypted and decrypted

111
04:05.883 --> 04:08.152 align:middle line:90%
as we send traffic back
and forth over the tunnel.

112
04:08.152 --> 04:09.610 align:middle line:90%
So in this video
we've taken a look

113
04:09.610 --> 04:12.580 align:middle line:90%
at adding routing to make
those tunnels useful so we can

114
04:12.580 --> 04:14.860 align:middle line:90%
actually use IPsec to
protect the traffic going

115
04:14.860 --> 04:16.095 align:middle line:84%
through the tunnels.

116
04:16.095 --> 04:17.720 align:middle line:90%
So thanks for joining
me in this video.

117
04:17.720 --> 04:18.950 align:middle line:90%
And I'll see you
in the next one.

118
04:18.950 --> 04:21.250 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

119
04:21.250 --> 04:24.510 align:middle line:90%
And I'd like to thank
you for viewing.