WEBVTT 1 00:00.000 --> 00:06.560 So now that we've covered the game plan with what we're going to build, a GRE 2 00:06.560 --> 00:11.730 tunnel from router one to router four, let's go ahead and jump into the command 3 00:11.730 --> 00:13.000 line and get this up and running. 4 00:13.000 --> 00:17.000 I would encourage you to keep the diagram handy as we go through this so you 5 00:17.000 --> 00:19.000 can visualize what we're doing. 6 00:19.000 --> 00:20.000 Let's go ahead and jump in. 7 00:20.000 --> 00:25.000 We'll start our configuration on router one. 8 00:25.000 --> 00:30.000 So before we build the tunnel, let's do a show IP route here on router one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:30.000 --> 00:33.790 What we're looking for is simply the fact that we do have all of the loopback 10 00:33.790 --> 00:36.000 interfaces here in our routing table. 11 00:36.000 --> 00:39.000 So we should have reachability for our tunnel. 12 00:39.000 --> 00:44.000 That said, let's go into configuration mode and we'll configure our tunnel. 13 00:44.000 --> 00:47.000 So we'll configure interface tunnel one. 14 00:47.000 --> 00:50.000 And then of course we have to configure its attributes. 15 00:50.000 --> 00:55.000 Let's start with its IP address, we'll simply use 192.168.100.1. 16 00:55.000 --> 00:58.000 We'll keep this very simple. 17 00:58.000 --> 01:02.650 And although you wouldn't normally do this for a tunnel, we'll simply make this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 17 00:58.000 --> 01:02.650 And although you wouldn't normally do this for a tunnel, we'll simply make this 18 01:02.650 --> 01:04.000 a slash 24. 19 01:04.000 --> 01:08.810 A slash 30 is generally more appropriate, but we're just going to keep this 20 01:08.810 --> 01:10.000 simple for now. 21 01:10.000 --> 01:13.000 We also need to configure the tunnel source. 22 01:13.000 --> 01:18.000 In this case is going to be loopback zero and our tunnel destination. 23 01:18.000 --> 01:24.000 And this is going to be the 10.100.1.4, which is router for loopback. 24 01:24.000 --> 01:28.000 For a basic tunnel configuration, that's really all we need. 25 01:28.000 --> 01:32.000 So let's go configure router for router four is going to be the same WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 01:28.000 --> 01:32.000 So let's go configure router for router four is going to be the same 26 01:32.000 --> 01:37.000 configuration with, of course, corresponding addresses. 27 01:37.000 --> 01:40.000 So we'll just go ahead and paste this configuration in. 28 01:40.000 --> 01:43.870 So we see here, of course, we're using the appropriate address for the tunnel 29 01:43.870 --> 01:47.000 and we're using the correct tunnel destination. 30 01:47.000 --> 01:49.000 So we're going to do a little more verification. 31 01:49.000 --> 01:51.000 So we're going to do a little more verification. 32 01:51.000 --> 01:53.000 We're going to do a little more verification. 33 01:53.000 --> 01:55.000 So we're going to do a little more verification. 34 01:55.000 --> 01:57.000 So we're going to do a little more verification. 35 01:57.000 --> 01:59.000 So we're going to do a little more verification. 36 01:59.000 --> 02:01.000 So we're going to do a little more verification. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:59.000 --> 02:01.000 So we're going to do a little more verification. 37 02:01.000 --> 02:03.000 So we're going to do a little more verification. 38 02:03.000 --> 02:05.000 So we're going to do a little more verification. 39 02:05.000 --> 02:07.000 So we're going to do a little more verification. 40 02:07.000 --> 02:09.000 So we're going to do a little more verification. 41 02:09.000 --> 02:10.000 Then just this show IP interface. 42 02:10.000 --> 02:12.000 So we're going to do a little more verification. 43 02:12.000 --> 02:16.000 Then just this show IP interface brief. 44 02:16.000 --> 02:18.000 Let's actually ping the other side. 45 02:18.000 --> 02:22.000 So we'll ping 192.168.100.1. 46 02:22.000 --> 02:25.000 We can see that that's successful. 47 02:25.000 --> 02:27.000 We could also trace to it. 48 02:27.000 --> 02:32.440 Just to verify that it's getting there in a single hop, meaning it thinks it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 48 02:27.000 --> 02:32.440 Just to verify that it's getting there in a single hop, meaning it thinks it's 49 02:32.440 --> 02:34.000 directly connected. 50 02:34.000 --> 02:36.000 We can see here that in fact it is. 51 02:36.000 --> 02:41.000 Also a good thing to watch is that we can see here that in fact it is. 52 02:41.000 --> 02:43.000 So we're going to do a little more verification. 53 02:43.000 --> 02:45.000 So we're going to do a little more verification. 54 02:45.000 --> 02:47.000 So we're going to do a little more verification. 55 02:47.000 --> 02:49.000 So we're going to do a little more verification. 56 02:49.000 --> 02:51.000 So we're going to do a little more verification. 57 02:51.000 --> 02:52.000 So we're going to do a little more verification. 58 02:52.000 --> 02:53.000 So we're going to do a little more verification. 59 02:53.000 --> 02:54.000 So we're going to do a little more verification. 60 02:54.000 --> 02:55.000 So we're going to do a little more verification. 61 02:55.000 --> 02:56.000 So we're going to do a little more verification. 62 02:56.000 --> 02:57.000 So we're going to do a little more verification. 63 02:57.000 --> 02:58.000 So we're going to do a little more verification. 64 02:58.000 --> 02:59.000 So we're going to do a little more verification. 65 02:59.000 --> 03:00.000 So we're going to do a little more verification. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 66 03:00.000 --> 03:01.000 So we're going to do a little more verification. 67 03:01.000 --> 03:02.000 So we're going to do a little more verification. 68 03:02.000 --> 03:04.440 So now that the tunnel is up and working, let's go ahead and fire up our IGP 69 03:04.440 --> 03:07.000 over that tunnel. 70 03:07.000 --> 03:11.000 Remember, we're going to be using EIGRP 100. 71 03:11.000 --> 03:14.000 So we'll simply go back into configuration mode. 72 03:14.000 --> 03:17.000 In the router EIGRP 100. 73 03:17.000 --> 03:25.420 And we'll simply put in a network statement of 192.168.0.0 and we'll use 0.0. 74 03:25.420 --> 03:30.000 255.255 for our wildcard mask. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:30.000 --> 03:32.000 We'll exit out of configuration. 76 03:32.000 --> 03:35.000 And of course, we have to do the same thing on router one. 77 03:35.000 --> 03:38.000 Now router one, I will do a little bit differently. 78 03:38.000 --> 03:41.000 And I'm doing this just in case you haven't seen it. 79 03:41.000 --> 03:47.690 If we were to say network 192.168.0.0 here, but instead of putting in a wild 80 03:47.690 --> 03:48.000 card mask, 81 03:48.000 --> 03:51.000 we actually put in a subnet mask. 82 03:51.000 --> 03:57.000 I just wanted to point out that if we do a show run section EIGRP after this, 83 03:57.000 --> 04:02.000 notice that the router realizes that this should have been a wildcard mask WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 83 03:57.000 --> 04:02.000 notice that the router realizes that this should have been a wildcard mask 84 04:02.000 --> 04:05.000 and it just flips it around for us. 85 04:05.000 --> 04:09.000 Just so you're aware, you can technically put in either one, but of course, 86 04:09.000 --> 04:12.000 it's supposed to be a wildcard mask here. 87 04:12.000 --> 04:15.000 Now we want to make sure everything's correct here. 88 04:15.000 --> 04:18.000 So let's do a show IP EIGRP interface. 89 04:18.000 --> 04:23.000 We see that we are running on our Gigabit 2 and our tunnel one interface. 90 04:23.000 --> 04:27.000 So the Gigabit 2 is what's facing our workstations. 91 04:27.000 --> 04:32.000 If we do a show IP EIGRP neighbors, we should see that we are in fact up with a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 04:27.000 --> 04:32.000 If we do a show IP EIGRP neighbors, we should see that we are in fact up with a 92 04:32.000 --> 04:36.000 neighborship over tunnel one, two router four. 93 04:36.000 --> 04:43.630 And if we do a show IP route EIGRP, we should be learning about that 192.168.20 94 04:43.630 --> 04:46.000 .0/24 network, 95 04:46.000 --> 04:50.000 which is of course the network that workstation two is on. 96 04:50.000 --> 04:55.570 Now that all of our routing is in place, we should be able to ping from work 97 04:55.570 --> 04:56.000 station one 98 04:56.000 --> 04:58.000 to workstation two. 99 04:58.000 --> 05:00.000 So let's verify. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 100 05:00.000 --> 05:06.400 So here on workstation one, we'll do a ping to 192.168.20.10, which is in fact 101 05:06.400 --> 05:07.000 workstation 102 05:07.000 --> 05:08.000 two. 103 05:08.000 --> 05:13.000 We see that that is in fact working and will trace route to it as well. 104 05:13.000 --> 05:18.000 So we see here on the trace that we are in fact getting there, which of course, 105 05:18.000 --> 05:20.000 we knew from the ping. 106 05:20.000 --> 05:25.000 But most importantly, we see that it's going to router one, router four, and 107 05:25.000 --> 05:26.000 then to the 108 05:26.000 --> 05:27.000 destination. 109 05:27.000 --> 05:33.000 What we're not seeing is the fact that it is actually going through routers two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 05:27.000 --> 05:33.000 What we're not seeing is the fact that it is actually going through routers two 110 05:33.000 --> 05:34.000 and three 111 05:34.000 --> 05:36.000 on the underlay. 112 05:36.000 --> 05:39.000 That's what makes GRE AVPM. 113 05:39.000 --> 05:44.000 We're not seeing the underlay network from the overlay side. 114 05:44.000 --> 05:46.000 But here's the thing. 115 05:46.000 --> 05:49.000 We already said this is not protecting the traffic. 116 05:49.000 --> 05:55.040 So let's jump into wire shark and take a look at the packet capture of some of 117 05:55.040 --> 05:56.000 this traffic 118 05:56.000 --> 05:58.000 traversing our tunnel. 119 05:58.000 --> 06:02.000 So we can see here right off the bat with packet one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 05:58.000 --> 06:02.000 So we can see here right off the bat with packet one. 120 06:02.000 --> 06:11.400 This is an EIGRP hello that's going from 192.168.100.4 to the destination two 121 06:11.400 --> 06:14.000 24.0.0.10. 122 06:14.000 --> 06:17.000 That's going to be inside the tunnel. 123 06:17.000 --> 06:22.520 In fact, if we look down here at the decoding window, we can actually see that 124 06:22.520 --> 06:24.000 it has a GRE 125 06:24.000 --> 06:25.000 header. 126 06:25.000 --> 06:30.000 However, we can see what's inside of the GRE header. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 06:30.000 --> 06:37.000 For example, we can open up the EIGRP header and see all of the contents. 128 06:37.000 --> 06:39.000 This is not being protected. 129 06:39.000 --> 06:45.000 That's how wire shark was able to tell us that this was an EIGRP hello to begin 130 06:45.000 --> 06:46.000 with. 131 06:46.000 --> 06:50.000 Even though it's in a GRE encapsulation. 132 06:50.000 --> 06:52.000 Same with packet two. 133 06:52.000 --> 06:56.000 We can see here on packet two that it clearly sees. 134 06:56.000 --> 07:02.000 This is an ICMP echo request followed by the reply right below it at packet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 134 06:56.000 --> 07:02.000 This is an ICMP echo request followed by the reply right below it at packet 135 07:02.000 --> 07:02.000 three. 136 07:02.000 --> 07:06.990 But this is the pin going back and forth between workstation one and work 137 07:06.990 --> 07:08.000 station two. 138 07:08.000 --> 07:15.510 Again, it has the GRE header, but it also knows all of the information inside 139 07:15.510 --> 07:17.000 because GRE is 140 07:17.000 --> 07:23.000 not protecting the payload or the original IP headers. 141 07:23.000 --> 07:29.000 So now we have an unprotected GRE VPN between routers one and four. 142 07:29.000 --> 07:33.690 But of course, the main thing we want to look at in this skill is protecting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 142 07:29.000 --> 07:33.690 But of course, the main thing we want to look at in this skill is protecting 143 07:33.690 --> 07:35.000 that connection. 144 07:35.000 --> 07:38.600 So next, let's move on to IPsec.