In a lab using DMVPN without any IPSec
is great, because we can look at the actual headers and so forth
with protocol analyzers, which we did in the previous video.
However, in this lab I'd like to do the DMVPN once again.
But this time, we'll put on the IPsec profile
to add encryption.
[MUSIC PLAYING]
So once again, this is the beautiful lab environment
that we get to play in.
These red addresses here represent the internal networks
at each of the locations headquarters where the hub is.
Site 2, site 3, site 4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Site 2, site 3, site 4.
These green IP addresses represent
the reachable addresses on this little pseudo internet
that we're going to be playing with,
and then the VPN addresses are the GRE tunnel interfaces
and that's going to be the 10 network.
So 10.0.0 one and two and three and four, respectively.
So this time, we'll do the similar configuration
for R1, 2, 3, and 4, but we'll do it
with the inclusion of IPSec.
So to the lab we go.
Let's go ahead and minimize.
This on DC Doug, our management computer with all the tabs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This on DC Doug, our management computer with all the tabs
open for the PCs and the routers.
Let's minimize that for a moment and bring up
this second document right here, which is DMVPN with IPSec.
So all the configuration that we did previously
is the same for DMVPN.
Except now, we're going to add cryptography on top of it.
Let me bring that a little bit bigger
and let me bring up the font too.
All right, so let me give you a crash course in IPSec.
In the old days we did crypto ACLs
and created a crypto map and applied that crypto
map to an interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
map to an interface.
It was a party.
It was a long party.
So now, we're still-- in this scenario,
we're still using IPSec.
And in this example, we're using IKE V one,
which includes two phases, IKE phase one and IKE phase two.
And we're still going to define what
we want to use for our security associations,
except we don't have to do crypto ACLs because all we're
going to do is create a crypto profile, an IPsec profile,
and attach it to an interface.
So let's share with you a few these commands and then we'll
implement it and we'll have DMVPNs along WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
implement it and we'll have DMVPNs along
with the IPsec profile.
So for IKE phase one, we're going
to negotiate, for the policy, how we want to do it.
And the way that I often still remember it as HAGLE.
Make sure I didn't cover that, great.
HAGLE.
They're going to haggle about the IKE phase one terms.
And anything that's not explicitly written out,
as far as the IKE phase one policy,
it use the defaults for the version of iOS that you're on.
So H is for hashing, the hashing algorithm such as SHA 256 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So H is for hashing, the hashing algorithm such as SHA 256
or MB5, something.
But it's not listed here, so it's taking the defaults
for whatever is on this iOS.
The A is for how do you want to authenticate,
and this is specifying that we want
to do pre-shared keys for the authentication.
And then the G is for the Diffie Hellman group.
Diffie Hellman is a great way for two peers
to negotiate secretly a shared King material.
Shared keys they can use for the actual tunnels themselves.
So here, we're using Diffie Hellman group
14, which is pretty darn good. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
14, which is pretty darn good.
And the L is the lifetime.
So I think the lifetime, by default,
is like one day, 86,000 seconds, I believe, or something.
I guess it's not if it's not specified it uses the default.
And E is the encryption.
And so it's specifying here AES encryption,
and there's a few flavors of AES we could do as well.
So that's for the IKE phase one policy.
Think of the IKE phase one as the private tunnel
that the two devices can use to talk to each other, like, hey,
how you doing good?
Hey, let's set this up for our IKE phase one tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Hey, let's set this up for our IKE phase one tunnel.
It's like a private party line between the two IPSec peers.
And then there's also an IKE phase two tunnel, which is also
known as the IPSec tunnel.
And that's the actual tunnel that's
used to encrypt and protect data that's being sent
on behalf of other devices.
So think of the IKE phase one as the private party
line between the two routers if they ever
need to talk to each other securely,
and the IKE phase two is the tunnel used to actually
send the users traffic across.
So this part here is referring to the IKE
phase two parameters.
So crypto IPsec transforms that, you just give it a name. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So crypto IPsec transforms that, you just give it a name.
And then we're specifying here AES, and SHA-HMAC,
which is a great way of verifying data integrity tying
it to the keys involved for that traffic.
And then mode transport.
This is required for DMVPN phase two and higher.
There's two modes for IPsec, you have transport and tunnel.
Tunnel is adding yet another header.
So we don't need to add an additional IP header.
And also, it's go-- in some situations, if you're
[INAUDIBLE] behind devices, it can cause DMVPN not
to work correctly.
So we're guess was like mode transport as opposed to tunnel, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're guess was like mode transport as opposed to tunnel,
and that's regarding the IKE phase two or the IPSec tunnel
itself.
And then we're creating a profile.
So this crypto IPsec profile, or IPSec prof,
says I want to set the transform set to this transform set.
And we're going to apply that IPSec profile to the tunnel
interface and that turns it on.
So once traffic-- once this profile is applied, if traffic
goes through that tunnel interface
or tries to go through that tunnel interface,
the router is going to say, oh my gosh,
do I have a security association set up with the other side? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do I have a security association set up with the other side?
The other end of the tunnel?
If not, it throws over all of its IKE phase
one policies it's willing to do.
They negotiate, they agree on the IKE phase one,
then they go and they build the IKE phase two.
That gets set up as an IPSec security association
and that enables IPSec protection
for all the traffic going back and forth over the GRE tunnels.
And if we scroll down just a little bit,
let me show you where it's applied.
It's right here.
So tunnel protection IPSec profile, the name
of that profile, and boom.
That enables that on the interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That enables that on the interface.
Everything else is the same as we did in the previous lab.
So I'm going to go ahead and bring up the terminal window
and let's grab the config for R1 including
the exit, because we're going to go in router configuration mode
again.
And we'll right click and paste that on R1.
And then we'll exit all the way out and just log back in as Bob
and we are in business.
So this guy right now has no end point to his tunnel.
He's waiting for people to register, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
He's waiting for people to register,
and let's give him a customer.
Let's give him R2.
So R2, we'll grab that config.
Same exact IPSec policy, by the way.
Every iota is identical.
In the IKE phase one policy, we're
saying we want to do pre-shared keys for authentication.
And this is actually specifying the key.
So we're using ourkey!23.
And this 0.0.0.0 is simply saying
we will go and use this key with anybody who
wants to appear with us.
So in DMVPN, because you have spokes
that are coming from almost anywhere, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that are coming from almost anywhere,
we're not sure what their IP addresses are, is needed.
Because we can't identify what IP address
you're going to come in from guarantees, especially
if its dynamically assigned by the service provider.
All right, so that's that piece as well.
So let's grab the config for R2.
[HUMMING]
And copy that, and we'll paste that on R2,
and then I'm going to exit out and log back in as Bob.
So we have some good messages here.
ISAKMP is on, meaning the internet security
association key management protocol, part of IPSec, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
association key management protocol, part of IPSec,
is enabled.
That all looks great.
Let's go to R3 and continue the journey
and there's R3's configs.
We'll grab that.
Copy paste.
And again, we'll exit because I need to
in this lab environment.
And we'll log back in as Bob.
And if you do a show IP NHRP, check this out.
So as the spokes are registering,
notice the type static.
That's because we configure it on the spokes
as part of the DMVPN.
We configured the mapping with the next hop server WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We configured the mapping with the next hop server
and what this address was.
And if we go to the hub and do that same command of show IP
NHRP, you can see here it shows them
as being dynamically learned.
Because we didn't statically code these up at the hub,
they are dynamically learned as these devices
are coming online.
So let's go to R4, that's our last one.
We'll go to R config, and we'll copy and paste that as well.
All right.
So here we are in R4.
And we'll exit out and we'll log back in as Bob. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll exit out and we'll log back in as Bob.
Great.
And everything that we discovered and learned
in the previous videos about DMVPN
still works now, except now we also
have IPSec protecting all the traffic.
So if we went to R2 as we did previously and do a show
IP NHRP, and we did a show IP route NHRP.
If we were going to send a packet
to a host on the 172.16.3 network the next hop is three.
If we scroll up a little bit, we don't
have a mapping for 10.0.0.3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have a mapping for 10.0.0.3.
So we're going to make a request and build a new GRE
tunnel or a new logical tunnel and also on top of that,
build the new IPsec tunnel and negotiating with that.
So let's actually, before we do the command of the ping,
let me show you the tunnel.
So show crypto engine--
I haven't used this command in a long time.
Connections active.
So show crypto engine connections active.
That's a nice, tight picture, which is pretty good.
So this is referring to the IKE phase one policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is referring to the IKE phase one policy
that we have between ourselves and R1
that's protecting the GRE tunnel between ourselves and R1.
And the IPSec has two SAs, two security associations,
ones for outbound, ones for inbound.
If you click on the details that you need to show crypto
ISAKMP SA detail.
So that's the IKE phase one information,
including pre-shared keys, the hashing we're using,
the encryption, and the Diffie Hellman group.
And we do a show crypto IPsec SA.
There's a lot more output here, but it's worth looking at. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's a lot more output here, but it's worth looking at.
Here's the command show crypto IPSec SA.
This shows us the two end points,
which is 22.2.2.2 and 11.1.1.1.
And packets encrypted and decrypted.
Just verifies that IPSec is at work.
And if you do a show crypto map.
Now, even though we did not create a crypto map,
this command still rocks because it shows us who our peers are
and the technologies we're using for IPsec with them.
So it's fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's fantastic.
It also helps to confirm that we've got IPsec enabled.
Also, oh, one other comment.
If we go to the hub and that was just this message right here,
as well.
The IPSec hadn't fully been configured on one end yet,
it was just coming up.
So let's do a show DMVPN.
It's another winner.
So this is going to work whether we have security or not
on the tunnels, but this shows us
who's registered and their logical addresses,
and how they got in.
The D represents dynamic.
All right, so if we go back to R2 and we do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so if we go back to R2 and we do
a show cryp-- let's do a show crypto engine
connections active.
You noticed we have--
all right, let's do--
let's do the SAs.
We have tunnels, IPSec tunnels, between ourselves and R1.
That's it.
So if we look at all the output here,
we don't have anything else with any other peer.
But if we do this, show IP route EIGRP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But if we do this, show IP route EIGRP,
and we did a ping to 172.16.4.10,
that's a host sitting behind R4 on that network.
The next hop is 10.0.0.4.
We don't know about it yet.
So everything we did before is going to happen again.
This client is going to make a request with an HRP.
Goes up to the server, server sends
that request down to R4, R4 responds back to us.
But before I can respond correctly,
it's also got to build a GRE-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's also got to build a GRE--
or establish the GRE tunnel and also build the IPSec.
So all that happens in just a nanosecond.
Let's do it.
Oh.
And so, sometimes you see one ping that got missed
but not this time.
It didn't receive that ping.
Oh my gosh, so if we do a--
oh my goodness.
So we do a show crypto engine connections active.
Check this out.
Now we have IPSec SAs in both directions between us
and R1, and also now us and R4, and we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and R1, and also now us and R4, and we
can verify that with this guy.
Show IPSec-- show crypto IPSec SA.
So this is our secure association between us and R1.
And if we hit the spacebar a few times,
this is our security association between us and R4.
And if we look at the packets encrypted and decrypted,
let's go out and do some more traffic there.
Ping, and we'll say repeat 100.
Let's do 75, something less than 100.
Because 100, like, well, it's hard to see that digit change. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because 100, like, well, it's hard to see that digit change.
So while that's cooking, if we go over to R4,
show crypto IPSec SA, and we look at that, that's going up.
So now 77 and now 79.
So it's just increasing because all that traffic is being
encrypted between those peers.
All right, it's amazing.
It truly is amazing.
DMVPN, if we do a show IP NHRP, it's now got the mapping.
It learned about it.
And the same thing if we pinged 3.10, same thing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the same thing if we pinged 3.10, same thing.
Would it send a request up to the hub,
hub will send down to R3, R3 send it back to us,
but not before it started building
the tunnel in the IPsec and establishing it.
In fact, I think we could do a debug.
All right, last thin-- this is like a playground.
So fun.
Let's do a debug crypto ipsec unless it gives us
too much output.
All right, it's good. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, it's good.
It's kind of quiet, that's good.
Let's do a ping to R3.
We don't have a tunnel yet to R3,
but we're going to build one.
All right and IPSec it comes.
All the IPSec.
If we did debug for ISAKMP, it will show us all the IKE phase
one stuff as well.
So they've negotiated and they've
built their IPsec tunnel between them.
And if we did a trace to that same address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we did a trace to that same address
it's going to go straight to them.
It's not going to go through the hub.
There it is, the next hop is 10.0.0.3 using the GRE
tunnel and the IP protection of that GRE tunnel
to secure traffic on its way.
All right, I've had a lot of fun.
So in these two labs we've had the opportunity
to implement DMVPN.
Once with no IPSec profile, once with an IPSec profile,
but besides the security the logic
works the same for those spoke-to-spoke dynamic tunnels
that can be set up so they can actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that can be set up so they can actually
reach each other and forward traffic directly.
In the next video, I'd like to share with you
a few other details about DMVPN including the phases of DMVPN.
DMVPN phase one, which we don't use too much anymore,
DMVPN phase two, which is quite popular,
and DMVPN phase three so you know
what those differences are.
So I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.