One of the elements that's going to help
you and I a whole bunch as we troubleshoot
IPSec VPNs is to realize that not every IPSec
VPN is created equally.
They're done differently.
They're implemented differently.
And having that awareness is going
to give us the assistance in correctly troubleshooting
the type of IPSec VPN that we're dealing with.
So as a quick overview of this topology, which
I'd like to use in this set of videos on troubleshooting,
I've got two sites.
Site 1 over here on the left, side 2 over here on the right.
We've got the 10.1.0 network over here
on the left, 10.2.0 on the right. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the left, 10.2.0 on the right.
Then I've got this puffy, little cloud
the middle that represents a public network
such as the internet.
Now, for the options regarding how
we could implement IPSec tunnels between these two sites,
we have options that involve IKE version 1 with those two
phases or IKE version 2.
And although either one of those can
be used for the site-to-site tunnel,
the actual shell and debug commands
are going to vary based on what we choose to use.
Other options are going to involve, is it site to site,
or is it remote access, which we've talked
about in previous videos. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about in previous videos.
But based on which it is, we're going
to vary our troubleshooting methods just a little bit
based on what we're looking at.
For the site-to-site, are we using the old legacy crypto
maps and crypto ACLs, or are we using virtual tunnel
interfaces, which would imply tunnel interfaces that
have an IPSec profile applied to them?
So for a site-to-site like this, we
could use a static virtual tunnel interface.
And once again, the troubleshooting approach
will be slightly different based on the type
of site-to-site tunnel that we're creating.
We also have options like DMVPN, which add more pieces. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also have options like DMVPN, which add more pieces.
So with DMVPN, we have additional technologies
and components that are being used,
such as the Next Hop Resolution Protocol.
We have to make sure that's working as well.
And then one other option I just want
to plug in as well is GET VPN, which is weird
because for IKE phase 1, we do the IKE phase
1 between the group members and the key server.
But we are not expecting between the group members
and the key servers, we're not expecting an IKE version 1
phase 2 or IPSec tunnel, because that's not how that behaves.
So this is the topology that we're
going to be using for many of the troubleshooting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to be using for many of the troubleshooting
videos coming up.
And here's the great news.
In the very next video, what we'll do is
we'll take a look at a troubleshooting methodology
as it relates to IPSec VPNs that we
can then apply based on the type of VPN tunnels
that we are using.
So I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.