WEBVTT

1
00:00.000 --> 00:02.460
So in this video, now that we've configured everything,

2
00:02.460 --> 00:04.740
let's verify that we have connectivity

3
00:04.740 --> 00:09.620
from the 1033 network over here to the 1044 network over here.

4
00:09.620 --> 00:10.900
That traffic should logically route it

5
00:10.900 --> 00:12.180
over this tunnel interface.

6
00:12.180 --> 00:14.340
And if it is, all traffic going over that tunnel

7
00:14.340 --> 00:15.880
is protected with IPsec.

8
00:15.880 --> 00:19.560
So our traffic as it goes from site three over to site four,

9
00:19.560 --> 00:21.460
as it goes over this public network here,

10
00:21.460 --> 00:23.780
should all be protected with IPsec.

11
00:23.780 --> 00:25.620
So first let's verify basic connectivity

12
00:25.620 --> 00:27.780
that's bringing up a couple VMs.

13
00:27.780 --> 00:31.100
So here is the VM red on the left.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.780 --> 00:31.100
So here is the VM red on the left.

14
00:31.100 --> 00:34.020
And here's the VM violet over here on the right.

15
00:34.020 --> 00:36.620
And let's just verify they can ping each other.

16
00:36.620 --> 00:38.780
Let's go ahead and verify their IP addresses.

17
00:38.780 --> 00:42.300
We'll do IF config for either zero on both of them.

18
00:42.300 --> 00:46.300
So on the left, this VM here has the IP address 10330152,

19
00:46.300 --> 00:47.420
as shown right there.

20
00:47.420 --> 00:51.540
And on the right, this little VM has the IP address 10440151.

21
00:51.540 --> 00:53.060
So let's verify a ping.

22
00:53.060 --> 00:58.980
So on the left, let's do a ping to 10.44.0.151 and press enter.

23
00:58.980 --> 01:00.860
And that is working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.980 --> 01:00.860
And that is working.

24
01:00.860 --> 01:06.260
Let's also do a ping over here from the right to 10.33.0.152,

25
01:06.260 --> 01:07.220
press enter.

26
01:07.220 --> 01:08.900
And that is also working.

27
01:08.900 --> 01:11.060
So all that traffic between these two VMs

28
01:11.060 --> 01:13.340
is logically being routed over this tunnel.

29
01:13.340 --> 01:16.660
And that tunnel is being protected with IPsec.

30
01:16.660 --> 01:18.700
So all that traffic in addition to being routed

31
01:18.700 --> 01:21.860
over this logical tunnel is being protected with IPsec.

32
01:21.860 --> 01:24.460
And for fun, let's do a quick little test.

33
01:24.460 --> 01:27.940
So I'm going to do a control C on both sides to stop the ping.

34
01:27.940 --> 01:30.580
I'll go ahead and also do an IF config again
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:27.940 --> 01:30.580
I'll go ahead and also do an IF config again

35
01:30.580 --> 01:33.540
just to verify what the IP address is involved are.

36
01:33.540 --> 01:35.980
So on the left, it's 10330152.

37
01:35.980 --> 01:39.140
And on the right, it's 10440151.

38
01:39.140 --> 01:41.740
So to confirm the traffic is all being encrypted,

39
01:41.740 --> 01:44.060
let me bring up a packet capture.

40
01:44.060 --> 01:46.780
And let me tell my distributor switch at site three

41
01:46.780 --> 01:49.220
that I want to go ahead and capture packets

42
01:49.220 --> 01:51.380
and send them over to my management computer.

43
01:51.380 --> 01:54.500
So here at site three, we'll go to our network tab here

44
01:54.500 --> 01:55.940
in the vSphere client.

45
01:55.940 --> 01:59.380
And let's go to our switch, which my edges are using.

46
01:59.380 --> 02:03.100
And let's go to configure and go down to port mirroring.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.380 --> 02:03.100
And let's go to configure and go down to port mirroring.

47
02:03.100 --> 02:04.740
And I currently have a session set up.

48
02:04.740 --> 02:05.940
Let's take a look at the details.

49
02:05.940 --> 02:07.980
We'll click on the three dots, click on edit.

50
02:07.980 --> 02:09.420
And this is saying that we're taking traffic

51
02:09.420 --> 02:11.180
from both of my edge nodes.

52
02:11.180 --> 02:12.860
Now, only one of them is active,

53
02:12.860 --> 02:14.700
but because I want to make sure I capture it,

54
02:14.700 --> 02:16.180
I'm going to select both of them.

55
02:16.180 --> 02:19.380
And for the destination, this is the destination IP address

56
02:19.380 --> 02:20.700
of my management computer.

57
02:20.700 --> 02:22.580
So we'll go back to edit properties.

58
02:22.580 --> 02:24.300
And I want to enable this.

59
02:24.300 --> 02:27.180
And I'm going to go ahead and enable that and click on OK.

60
02:27.180 --> 02:30.540
So now that is sending data over to my management computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:27.180 --> 02:30.540
So now that is sending data over to my management computer.

61
02:30.540 --> 02:32.780
And so that we can now see that data that's coming in,

62
02:32.780 --> 02:34.220
let me bring up Wireshark.

63
02:34.220 --> 02:36.180
So here is Wireshark.

64
02:36.180 --> 02:38.780
And what I want to do is I want to collect the data coming in

65
02:38.780 --> 02:40.420
on my ethernet interface.

66
02:40.420 --> 02:43.020
And also, I'd like to do a little bit of filtering

67
02:43.020 --> 02:45.460
and only collect packets that happen

68
02:45.460 --> 02:48.420
to be going to IP protocol 47, which

69
02:48.420 --> 02:50.300
is the protocol number four, GRE.

70
02:50.300 --> 02:52.380
And that way, I don't have to have 20 or 30,000 packets

71
02:52.380 --> 02:53.180
to look at.

72
02:53.180 --> 02:55.460
I can just take a look at the ones that were sent to me

73
02:55.460 --> 02:56.900
from the distributed switch.

74
02:56.900 --> 02:59.380
So with that in place, we'll go ahead and enable that.

75
02:59.380 --> 03:01.940
And here they come and let me make that full screen.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:59.380 --> 03:01.940
And here they come and let me make that full screen.

76
03:01.940 --> 03:04.380
So if we grabbed any one of these packets

77
03:04.380 --> 03:06.540
that the distributed switch is sending to me,

78
03:06.540 --> 03:08.940
everything up to this point with GRE is just

79
03:08.940 --> 03:11.180
the distributed switch shipping it over

80
03:11.180 --> 03:13.260
to my management computer so we could take a look.

81
03:13.260 --> 03:16.260
Also, for Grins, I'm going to put in a display filter

82
03:16.260 --> 03:19.540
and put in ESP, which is protocol 50 being used

83
03:19.540 --> 03:20.420
by IPsec.

84
03:20.420 --> 03:23.020
So in the output here, it's only going to show traffic

85
03:23.020 --> 03:26.340
if it is ESP traffic, meaning protocol 50,

86
03:26.340 --> 03:27.820
IPsec protected traffic.

87
03:27.820 --> 03:30.020
So let's bring back our two little VMs on the left.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:27.820 --> 03:30.020
So let's bring back our two little VMs on the left.

88
03:30.020 --> 03:32.060
I have the red VM on the right.

89
03:32.060 --> 03:34.180
I have the violet VM.

90
03:34.180 --> 03:36.540
And from the right to the left, let me go ahead

91
03:36.540 --> 03:40.740
and do an SSH, do dash L for login as root.

92
03:40.740 --> 03:43.860
And let's go over to the IP address of the right VM,

93
03:43.860 --> 03:46.540
which is 10440151.

94
03:46.540 --> 03:49.420
Also, before I press Enter here on the red VM on the left,

95
03:49.420 --> 03:53.460
let me head over to the right VM here, the site for VM.

96
03:53.460 --> 03:56.740
So we'll do a ping over to the IP address of the site 3 VM,

97
03:56.740 --> 04:01.060
which is 10.33.0.152.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:56.740 --> 04:01.060
which is 10.33.0.152.

98
04:01.060 --> 04:02.700
And then I'll press Enter on both.

99
04:02.700 --> 04:04.100
So we'll do an Enter there.

100
04:04.100 --> 04:06.980
And on the VM on the left, I'll press Enter there.

101
04:06.980 --> 04:09.300
And so one side is trying to SSH over,

102
04:09.300 --> 04:11.020
the other side is trying to ping.

103
04:11.020 --> 04:13.860
And so I'm going to go ahead and hit Cancel on both sides

104
04:13.860 --> 04:15.660
because we've already caught our traffic

105
04:15.660 --> 04:17.340
and let's take a look at the traffic.

106
04:17.340 --> 04:19.180
So I'm going to go ahead and stop the capture.

107
04:19.180 --> 04:20.620
I'm also going to go to the distributed switch

108
04:20.620 --> 04:23.300
in the background and tell it to stop sending me that data

109
04:23.300 --> 04:24.820
because we've got what we need.

110
04:24.820 --> 04:25.860
So we'll click on Edit.

111
04:25.860 --> 04:27.460
We'll stop the remote capture.

112
04:27.460 --> 04:28.500
Click on Disabled there.

113
04:28.500 --> 04:29.580
Click on OK.

114
04:29.580 --> 04:32.420
So back at our capture, if we take a look at the traffic here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:29.580 --> 04:32.420
So back at our capture, if we take a look at the traffic here,

115
04:32.420 --> 04:36.500
all of it looks like it's going between 231230.

116
04:36.500 --> 04:38.420
That's the global, readable address there

117
04:38.420 --> 04:43.020
that we're using on the T0 gateway at site 3 and 241240,

118
04:43.020 --> 04:46.180
which is the virtual IP address that we're using over at site 4.

119
04:46.180 --> 04:48.820
So this is just traffic going back and forth between site 3

120
04:48.820 --> 04:49.900
and site 4.

121
04:49.900 --> 04:51.500
And if we look at the details here,

122
04:51.500 --> 04:53.340
it's showing us that it is ESP.

123
04:53.340 --> 04:56.060
So in the IP header, it's pointing to the next protocol

124
04:56.060 --> 04:59.060
of 50, which is encapsulating security payload, effectively

125
04:59.060 --> 04:59.900
IPsec.

126
04:59.900 --> 05:01.860
And then we have the actual ESP payload.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:59.900 --> 05:01.860
And then we have the actual ESP payload.

127
05:01.860 --> 05:05.100
So it's anyways guessed now what's included in that payload.

128
05:05.100 --> 05:07.060
Is it part of the ICMP traffic?

129
05:07.060 --> 05:10.580
Or was the TCP-based traffic as part of an SSH session?

130
05:10.580 --> 05:14.700
It's really tough to know because all that data is encrypted.

131
05:14.700 --> 05:16.420
Also, check out these SPI numbers.

132
05:16.420 --> 05:18.620
SPI stands for the Security Parameter Index.

133
05:18.620 --> 05:20.540
Think of it like a numbering system

134
05:20.540 --> 05:24.820
to identify an SAS Security Association used by IPsec.

135
05:24.820 --> 05:27.980
So here we have the SPIs that are being used between those two

136
05:27.980 --> 05:30.860
peers ending in 1, 0, 2, and 3, 0, 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:27.980 --> 05:30.860
peers ending in 1, 0, 2, and 3, 0, 1.

137
05:30.860 --> 05:36.460
We can also verify that SPI number at the CLI for the edge nodes

138
05:36.460 --> 05:39.540
who are actually doing the work of the IPsec tunnel between site

139
05:39.540 --> 05:41.180
3 and site 4.

140
05:41.180 --> 05:42.900
So if we go back to edge 2 and I timed out

141
05:42.900 --> 05:45.900
Sol Press Enter to reconnect, is the active edge node,

142
05:45.900 --> 05:48.340
or at least it was a few minutes ago when we looked at it?

143
05:48.340 --> 05:51.340
So if we type in get IPsec VPN and a question mark,

144
05:51.340 --> 05:54.460
and if we wanted to take a look, for example, at the IPsec

145
05:54.460 --> 05:56.740
SA, short for Security Associations,

146
05:56.740 --> 06:01.180
we can type in get IPsec VPN, IPsec SA, and press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:56.740 --> 06:01.180
we can type in get IPsec VPN, IPsec SA, and press Enter.

147
06:01.180 --> 06:03.180
And that's going to show us our security associations.

148
06:03.180 --> 06:04.940
And here at site 4--

149
06:04.940 --> 06:08.700
and this is edge 2, which is the active edge node for site 4.

150
06:08.700 --> 06:11.980
Here in the output of the command get IPsec VPN, IPsec

151
06:11.980 --> 06:15.580
SA, which again, the SA is short for Security Association.

152
06:15.580 --> 06:17.260
Here it has a session ID.

153
06:17.260 --> 06:19.660
Here it's specifying exactly what's going to be encrypted.

154
06:19.660 --> 06:22.980
So effectively, this has any IPv4 traffic that

155
06:22.980 --> 06:26.420
goes over the tunnel is going to be encrypted.

156
06:26.420 --> 06:29.660
And then if you continue to go down right here at the SPI in

157
06:29.660 --> 06:32.620
and SPI out, take a look at those SPIs, those security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
06:29.660 --> 06:32.620
and SPI out, take a look at those SPIs, those security

158
06:32.620 --> 06:33.860
parameter index numbers.

159
06:33.860 --> 06:37.620
We have one ending in 301, and we have one ending in 102.

160
06:37.620 --> 06:39.820
And if we go back to our Wireshark capture,

161
06:39.820 --> 06:41.420
that's reflected here as well.

162
06:41.420 --> 06:44.980
We have one of them ending in 102 and one ending in 301.

163
06:44.980 --> 06:48.780
So each peer has an inbound and an outbound security

164
06:48.780 --> 06:50.900
association for IPsec.

165
06:50.900 --> 06:52.900
It's also showing us the endpoints involved.

166
06:52.900 --> 06:56.700
So from site 4's perspective, the local endpoint is 24, 120,

167
06:56.700 --> 06:59.140
and the remote endpoint is 23, 120.

168
06:59.140 --> 07:01.260
And here it's showing us the protocols that are used for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:59.140 --> 07:01.260
And here it's showing us the protocols that are used for

169
07:01.260 --> 07:02.260
that IPsec tunnel.

170
07:02.260 --> 07:05.300
So if we modified or changed the profiles that we're using

171
07:05.300 --> 07:08.140
for IPsec on both sides, we could also see the difference

172
07:08.140 --> 07:09.980
right here at the CLI.

173
07:09.980 --> 07:11.980
So because that would only take a moment to demonstrate,

174
07:11.980 --> 07:12.820
let's do that as well.

175
07:12.820 --> 07:15.460
This is the NSX manager for site 3.

176
07:15.460 --> 07:18.220
So with networking selected, if we click here on VPN,

177
07:18.220 --> 07:19.900
and then we'll click on IPsec sessions,

178
07:19.900 --> 07:22.700
and let's edit our details that we're using over to site 4.

179
07:22.700 --> 07:24.820
So we'll click on the three dots, click on edit,

180
07:24.820 --> 07:27.380
and then we'll scroll down under advanced properties.

181
07:27.380 --> 07:30.300
And then for the IPsec profiles, instead of using the default,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:27.380 --> 07:30.300
And then for the IPsec profiles, instead of using the default,

182
07:30.300 --> 07:31.940
let's go ahead and create a new one.

183
07:31.940 --> 07:34.220
So we'll click on create new, and let's just go ahead

184
07:34.220 --> 07:35.060
and change one value.

185
07:35.060 --> 07:37.980
So instead of using AES GCM 128, let's go ahead

186
07:37.980 --> 07:41.420
and use AES GCM 256.

187
07:41.420 --> 07:43.940
And we'll click on save and click on save.

188
07:43.940 --> 07:44.900
And that's done.

189
07:44.900 --> 07:47.860
Let's make this similar change over at site 4.

190
07:47.860 --> 07:50.980
So here in the NSX manager for site 4,

191
07:50.980 --> 07:53.700
with networking selected, we'll get down to VPN.

192
07:53.700 --> 07:55.820
We'll go to our IPsec sessions.

193
07:55.820 --> 07:58.740
We'll edit our current existing IPsec session

194
07:58.740 --> 08:00.100
by clicking on edit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

194
07:58.740 --> 08:00.100
by clicking on edit.

195
08:00.100 --> 08:02.020
We'll scroll down to advanced.

196
08:02.020 --> 08:04.540
And instead of using the default IPsec profile,

197
08:04.540 --> 08:07.500
we'll click on the three dots and click on create new.

198
08:07.500 --> 08:08.900
We'll call this our IPsec.

199
08:08.900 --> 08:11.300
And then we're going to change the encryption algorithm.

200
08:11.300 --> 08:14.340
And we'll set that to AES GCM 256.

201
08:14.340 --> 08:16.460
And we'll get rid of the option of 128.

202
08:16.460 --> 08:18.380
So if they both support like two or three,

203
08:18.380 --> 08:20.900
and they have one common, they can negotiate and land on that.

204
08:20.900 --> 08:22.420
But just to make it nice and clean,

205
08:22.420 --> 08:24.980
I'm going to only give them one possibility on each side.

206
08:24.980 --> 08:27.860
And that is the AES 256 flavor.

207
08:27.860 --> 08:29.820
And with that selected, we'll click on save.

208
08:29.820 --> 08:31.100
And then click on save.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

208
08:29.820 --> 08:31.100
And then click on save.

209
08:31.100 --> 08:33.940
And that says been updated successfully, fantastic.

210
08:33.940 --> 08:36.660
So let me bring back my client on the right-hand side.

211
08:36.660 --> 08:39.020
This is the site for Violet VM.

212
08:39.020 --> 08:40.260
And let's try a quick ping.

213
08:40.260 --> 08:42.060
And that ping is working.

214
08:42.060 --> 08:42.540
That's great.

215
08:42.540 --> 08:44.940
That implies that our tunnel is up and running.

216
08:44.940 --> 08:46.900
I'll go into a control C to stop that.

217
08:46.900 --> 08:51.740
And let's go back to the CLI at the edge node over at site 4.

218
08:51.740 --> 08:54.820
So here at the edge node at site 4, a moment ago,

219
08:54.820 --> 08:58.820
it said that we were using AES 128 GCM 16.

220
08:58.820 --> 09:02.020
And now, if we hit the up arrow key and press enter,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

220
08:58.820 --> 09:02.020
And now, if we hit the up arrow key and press enter,

221
09:02.020 --> 09:02.900
it should reflect.

222
09:02.900 --> 09:06.220
And it is that we are now using AES 256,

223
09:06.220 --> 09:09.780
as opposed to the earlier AES 128.

224
09:09.780 --> 09:12.260
And the reason it's important to be aware of the CLI

225
09:12.260 --> 09:14.780
is it's a great way to do step-by-step testing.

226
09:14.780 --> 09:17.500
If we think something's happening, we want to confirm it.

227
09:17.500 --> 09:19.420
We can go into the interface at the CLI

228
09:19.420 --> 09:21.980
to the active edge node and just confirm it.

229
09:21.980 --> 09:23.980
Also, as demonstrated, another great option

230
09:23.980 --> 09:26.580
is to capture that traffic and take a look at it

231
09:26.580 --> 09:29.100
to see what the actual content is of those packets.

232
09:29.100 --> 09:32.420
Just to confirm that what we think is happening is happening.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

232
09:29.100 --> 09:32.420
Just to confirm that what we think is happening is happening.

233
09:32.420 --> 09:35.060
Also in this output here, notice that the essay uptime

234
09:35.060 --> 09:36.420
is only 44 seconds.

235
09:36.420 --> 09:38.780
And that's because when we changed the parameters,

236
09:38.780 --> 09:40.900
it had to renegotiate that tunnel.

237
09:40.900 --> 09:42.700
And as a result, this is a brand new tunnel.

238
09:42.700 --> 09:44.180
And that tunnel reflects the difference between

239
09:44.180 --> 09:46.860
when the tunnel first came up and when I did the get command,

240
09:46.860 --> 09:50.500
the getipsecvpn, ipsec essay command.

241
09:50.500 --> 09:52.700
And another way to verify that our ipsec sessions

242
09:52.700 --> 09:55.700
are up and active, of course, is through the NSX manager,

243
09:55.700 --> 09:57.180
going through the networking tab.

244
09:57.180 --> 09:59.380
And then under network services, click on VPN,

245
09:59.380 --> 10:02.700
and then expand our existing ipsec sessions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

245
09:59.380 --> 10:02.700
and then expand our existing ipsec sessions.

246
10:02.700 --> 10:04.300
And then take a look at the details right here.

247
10:04.300 --> 10:06.220
And if we click here on view statistics,

248
10:06.220 --> 10:09.860
it can show us the details about the ipsec tunnel.

249
10:09.860 --> 10:19.860
[BLANK_AUDIO]