WEBVTT 1 00:00.000 --> 00:10.000 So as our final step here, let's jump into the command line and wire shark and 2 00:10.000 --> 00:10.400 do some 3 00:10.400 --> 00:15.680 verification of our IP section tunnel. 4 00:15.680 --> 00:22.440 So here on router one, let's do a show crypto, like V2 SA, which will show us 5 00:22.440 --> 00:23.560 the security 6 00:23.560 --> 00:27.080 association from Ike version two. 7 00:27.080 --> 00:33.360 What we see here, of course, is our local and remote addresses for this SA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 7 00:27.080 --> 00:33.360 What we see here, of course, is our local and remote addresses for this SA. 8 00:33.360 --> 00:34.920 We see that it's ready. 9 00:34.920 --> 00:41.440 We see that the encryption has been negotiated as AES GCM with a key size of 10 00:41.440 --> 00:43.280 256 bits. 11 00:43.280 --> 00:46.360 PRF is set to SHA 512. 12 00:46.360 --> 00:50.080 The Diffie-Hellman group is set to group 20. 13 00:50.080 --> 00:54.160 So we can see that everything we told it to use is being used. 14 00:54.160 --> 00:59.880 And we see that it's exchanged the local and the remote as PIs. 15 00:59.880 --> 01:05.460 We can also do a show crypto IP sec SA, and this will tell us more information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 15 00:59.880 --> 01:05.460 We can also do a show crypto IP sec SA, and this will tell us more information 16 01:05.460 --> 01:05.880 about the 17 01:05.880 --> 01:10.280 tunnel itself, which is using this policy. 18 01:10.280 --> 01:14.620 So first we see that tunnel one is the head and the local address for that is 19 01:14.620 --> 01:17.680 10.100.1.1. 20 01:17.680 --> 01:22.680 We also see the current peer at 10.100.1.4. 21 01:22.680 --> 01:27.120 And then we see how many packets have been encrypted and decrypted. 22 01:27.120 --> 01:31.360 Now I did let this run for a while, so we would have some good counts here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 01:27.120 --> 01:31.360 Now I did let this run for a while, so we would have some good counts here. 23 01:31.360 --> 01:35.620 Most of these packets are going to be the EIGRP hellos that are going back and 24 01:35.620 --> 01:36.000 forth 25 01:36.000 --> 01:39.280 over this tunnel since we let it sit for a while. 26 01:39.280 --> 01:44.490 But one of the most important things to see here is that we are encapsulating 27 01:44.490 --> 01:45.520 and decapsulating 28 01:45.520 --> 01:50.160 packets specifically that have been encrypted. 29 01:50.160 --> 01:53.840 Of course, another good command is the show interface tunnel one. 30 01:53.840 --> 01:58.780 We look at this in a previous section and remember what we saw was that the 31 01:58.780 --> 01:59.440 default 32 01:59.440 --> 02:04.880 tunnel protocol and transport was GRE over IP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 32 01:59.440 --> 02:04.880 tunnel protocol and transport was GRE over IP. 33 02:04.880 --> 02:10.000 But as we can see now, it is IP sec over IP. 34 02:10.000 --> 02:14.600 Now this encapsulation of course does have to match on both sides. 35 02:14.600 --> 02:18.730 So we know that router four is configured properly, but let's go over and 36 02:18.730 --> 02:19.440 verify that 37 02:19.440 --> 02:22.080 it has the same encapsulation. 38 02:22.080 --> 02:27.860 So on router four, if we do our show interface tunnel one, it is also set to IP 39 02:27.860 --> 02:28.680 sec IP. 40 02:28.680 --> 02:30.760 So all of this looks good. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 40 02:28.680 --> 02:30.760 So all of this looks good. 41 02:30.760 --> 02:34.850 Let's go ahead and take a look at our wire shark packet capture and see what 42 02:34.850 --> 02:35.760 these packets 43 02:35.760 --> 02:39.320 look like on the underlay network. 44 02:39.320 --> 02:43.480 So here's a capture of router ones gigabit one interface. 45 02:43.480 --> 02:48.520 We see packets going back and forth between router four and router one. 46 02:48.520 --> 02:53.600 Notice the protocol on all of them is ESP. 47 02:53.600 --> 02:58.590 Also note down here in the IP header that the protocol says and cap security 48 02:58.590 --> 02:59.280 payload 49 02:59.280 --> 03:02.880 and it's listing it as protocol 50. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:59.280 --> 03:02.880 and it's listing it as protocol 50. 50 03:02.880 --> 03:08.280 Also under the encapsulating security payload, we also see the SPI. 51 03:08.280 --> 03:13.440 So from the underlay network, we're not seeing any of the contents. 52 03:13.440 --> 03:15.240 We don't know if that's a ping. 53 03:15.240 --> 03:18.160 We don't know if that's regular user traffic. 54 03:18.160 --> 03:22.400 We don't know if that's an EIGRP. 55 03:22.400 --> 03:28.200 So this is the result when we're actually encrypting the original packet. 56 03:28.200 --> 03:34.000 So now that we have IP sec operational between our two devices, well, that was WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 03:28.200 --> 03:34.000 So now that we have IP sec operational between our two devices, well, that was 57 03:34.000 --> 03:34.960 our goal and 58 03:34.960 --> 03:37.880 what we wanted to achieve in this skill. 59 03:37.880 --> 03:42.940 So we have done that and we have verified that it is in fact working and looked 60 03:42.940 --> 03:43.280 at these 61 03:43.280 --> 03:49.320 encrypted packets to see that we can't see the payload or the original IP 62 03:49.320 --> 03:50.440 headers. 63 03:50.440 --> 03:55.240 So that said, that concludes everything we need to discuss in this skill, which 64 03:55.240 --> 03:55.480 leaves 65 03:55.480 --> 03:58.160 us with just the challenge. 66 03:58.160 --> 03:58.600 Good luck.