In this video, I'd like to chat with you about doing
IPsec troubleshooting.
But instead of using IKE version 1, let's kick it up a notch
and take a look at how we would troubleshoot and verify
IKE version 2 using the same physical topology,
but a slightly different implementation of our IPsec
VPN.
So let's get the lay of the land for IKEv2.
I have a separate set of videos regarding
setting up a site-to-site VPN tunnel using IKEv2.
And it's the same physical topology
except for using tunnel interfaces.
So tunnel interface 0 here, and tunnel interface 0 here-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So tunnel interface 0 here, and tunnel interface 0 here--
and that tunnel interface has the network address space
of 10.12.12.0.
And over here at R1, we have .1 and over here at R2 we have .2.
And then I created an IPsec profile
that's been associated or applied
to those tunnel interfaces.
So effectively, instead of using a crypto map and crypto ACLs,
any traffic that's routed over this tunnel interface
is going to be encrypted, shipped over
to the peer, where it can be decrypted,
and then forwarded on to its final destination.
Up here, I included 10.1.0.0 and 10.2.0.0 as part of EIGRP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Up here, I included 10.1.0.0 and 10.2.0.0 as part of EIGRP.
I also included the tunnel interface as part of EIGRP.
So from a routing perspective, which is really important,
as we know, R2 is going to forward traffic for the 10.1
network over the tunnel, at which point, the IPsec profile
would kick in.
And they'd set up their security.
And the same thing for router 1.
If he needs to get to 10.2.0.0, he
would forward it, based on his routing table,
over the tunnel interface, at which point
the cryptography would kick in due to the IPsec profile
on the tunnel interface.
And here's a big difference between the previous version
of IKE and IKE version 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of IKE and IKE version 2.
With IKE version 2, we have an IKEv2 security association.
So we no longer have an IKE phase 1 tunnel.
We are now going to build an IKEv2 security association.
And then we're going to have children, children SAs.
So a child SA that can be spun off would be an IPsec SA.
And that's good news because all the debugs
and the commands we have regarding IPsec security
associations, those all still apply.
But we have some new commands and debug options
for IKE version 2 specifically, as we
take a look at this initial IKEv2 SA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
take a look at this initial IKEv2 SA.
So let's make a road trip over to R1.
We'll do a quick verification of how it's been implemented.
And then we'll walk through some of the show and debug commands
that we could use if we're troubleshooting IKE version 2.
So here at R1, let's do a show ip route.
We always want to check routing first.
And from R1's perspective, we have a default route.
We also have a route here learned
via EIGRP that says to get to 10.2.0.0,
we go ahead and forward it via the tunnel.
At which point, if you take a look at the tunnel interface
with a show run for interface tunnel 0,
it will show us the details for that tunnel interface, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it will show us the details for that tunnel interface,
its source, its destination.
And we have the IPsec profile applied
to that tunnel interface.
So what are some of the commands we could use to verify IKEv2?
We could do the show crypto session.
And that works with IKE version 1 as well.
And here it has the information regarding the IKEv2 tunnel,
which says from 15.1.1.1 locally, says R1, to 25.2.2.2.
And the port is 500, UDP port 500 that they're
using for that tunnel.
And it's active.
It's also showing here in this output of show crypto session
that we also have an IPsec tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we also have an IPsec tunnel.
And it's specifying all traffic because that's
applied to a tunnel interface.
So what this implies is that any traffic going into the tunnel
matches our encryption policy.
And we're going to go ahead and encrypt it.
Now, look at this, also.
This is a little bit of legacy.
It says crypto map.
Trust me.
There's not a crypto map anywhere in this configuration.
In fact, let's take a look.
We'll do a show run include map.
Yeah, and the word "map" never shows up.
We don't have a crypto map here.
However, in some of the output, even
for IKE version 2 and if we're not using crypto maps,
it still shows up sometimes. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it still shows up sometimes.
In fact, check this out.
If we do a show crypto map, here it's showing us
the show crypto map details for IPsec
even though we are not using a crypto map.
It's including the details regarding the transform set
that's being used.
And it specifies here the name of the IKEv2 profile,
as well as the IPsec profile that we're using on the tunnel
interface, and in the transform set that is being used,
the transforms involved for the actual IPsec or the child
security association.
So some other cool commands that we can issue are show crypto.
And check this out.
We'll do ikev2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll do ikev2.
And then there's a whole bunch of options after this as well.
But if we wanted to look at the IKEv2 security association,
we just type in show crypto ikev2 sa.
There is also an option for detailed
if you want to get all the nitty gritty.
But show crypto ikev2 sa by itself will give us plenty.
And if we scroll a little bit over to the right,
it's showing us the details regarding that IKEv2 security
association.
And if we do the command show crypto engine
connections active and pressed Enter,
here it's showing us our IKEv2 security association. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here it's showing us our IKEv2 security association.
And then it's showing us our individual SAs,
one for each direction for IPsec that is currently in use.
And the traffic that we're seeing
encrypted back and forth here is because EIGRP is running.
And the EIGRP traffic going over the tunnel is being encrypted.
So if we hit the Up arrow key, that's
going to increment alone just based
on the EIGRP packets being sent back and forth.
And if we want to see the details
for the IPsec SA, the child SA, we
could do a show crypto ipsec.
And this is very much like it was with IKE version 1, show
crypto ipsec SA, press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
crypto ipsec SA, press Enter.
So because we're not using the crypto map
but we have an IPsec profile associated with a tunnel
interface, we're encrypting all traffic
that's going over that tunnel interface.
Here's our peer information, with UDP port 500 identified
as being used, and packets encapsulated and deencapsulated
and encrypted and decrypted, and send errors being 0.
And so if we scroll up a little bit,
we have the inbound security associations.
And we have the outbound security associations.
And if we hit the Up arrow key a couple times,
do show crypto connections active.
And that's representing these two right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's representing these two right here.
One of these is inbound.
One is outbound.
In fact, the connection ID 5 right here
for outbound, that means this is the outbound security
association.
And if we scroll up, the inbound one is connection ID 6.
And that's this bad boy right there.
And regarding debugging, there's some special debug commands
regarding IKEv2.
It's debug crypto ikev2.
And then we have some additional options.
Or we can press Enter here.
And then if-- in fact, let's do that on both sides.
We'll go over to R2, debug crypto ikev2.
And let's go ahead and shut down an interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go ahead and shut down an interface
and bring it back up.
So because we're using our tunnel interface,
we'll go ahead and shut that.
And give that a moment to cry.
So EIGRP is timed out.
And the security association is having problems
because the interface is down.
Now, the cool thing about IKE version 2,
it's pretty aggressive as far as if something goes down,
it does a lot better job of identifying that there's
a problem and try to establish that, as opposed
to IKE version 1, which was less aggressive.
So there is a ton.
There's like 15 pages of output here.
So instead of trying to scroll up and down WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So instead of trying to scroll up and down
through all of that, let's just go take a look at the logs.
Let's do a show log and make sure it's in there.
Yep, we're logging to the buffer.
That's fantastic.
And then we can sort through this that way.
So if we scroll through some of this--
there's just a lot of output here--
verify peer's policy, peer's policy
verified, including the peer wants
to go ahead and authenticate via preshared key.
And then we go through the process
of using our preshared key for the authentication.
And if we take a look at router 2 also,
which is running the same debug, and scroll up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is running the same debug, and scroll up
through the output--
here, as part of the output, saying IKEv2 security
association created, which is a good sign.
And we can look at all the details leading up to that
previously in the output.
And again, some of the show commands
we could would be show crypto session,
and show crypto ikev2 sa.
And then show crypto ipsec sa for the IPsec child
SA that's been created by IKEv2.
So from a troubleshooting perspective,
this is very similar to what we had with IKE version 1.
We'd want to make sure we have routing in place-- critical.
We'd want to make sure we have connectivity
between the two devices, the two endpoints of the VPN tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between the two devices, the two endpoints of the VPN tunnel.
And we'd also want to make sure that we
have that parent SA, the security association put
in place.
So whether it's the IKE phase 1 tunnel with IKE version
1 or the IKEv2 tunnel with IKE version 2,
we'd want to make sure that's in place first.
And if that's not working, troubleshoot that.
And then with the parent tunnel up,
if the second tunnel, the child tunnel, in this case,
with the IPsec SA, if that's not working,
we could troubleshoot that using our troubleshooting
technologies and the debugs that we talked
about in the previous video, like, debug crypto ipsec sa
and so forth.
All right, so in this video, we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so in this video, we've
taken a look at some tools and some commands
that we could use with IKE version 2.
I'm glad you joined me.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.