In this video, you and I get to chat
about the use of a crypto map as far
as implementing IPSec on our Cisco devices.
So for decades, we've used IPSec to protect our IP packets
and one of the original ways of implanting IPSec
was using a crypto map.
And the reason the crypto map was so handy
was because we have several parts and pieces
we need to all put together.
For example, if we want to encrypt traffic that's
coming from 10.1.0 going to 10.2.0 and vise versa, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
coming from 10.1.0 going to 10.2.0 and vise versa,
if that's the traffic we want to encrypt,
we need to specify that that is the interesting traffic.
So we do that in the world of crypto maps by creating
an access control list and extended ACL that
has from R1's perspective, 10.1.0 as a source, 10.2.0
as the destination, and from R2's perspective,
it would be 10.2.0 as a source and 10.1.0 as the destination.
Also we'd want to specify for the IPSec, the IKE phase 2
tunnel, improving IKE version 1, we'd
want to specify what we want to use for encryption, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to specify what we want to use for encryption,
and also what we want to use for the hashed message
authentication code for data integrity.
And the way we do that is we create what's
called an IPSec transform set that
identifies the encryption and the hashing we want to use.
And then what we do is we take that transform set,
and also the crypto ACL, which is what that ACL is called
that identifies the interesting traffic,
and we bundle all of that up into a crypto map.
So a crypto map is like a container that
has the list of the engine traffic and also the encryption WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has the list of the engine traffic and also the encryption
and hashing to use for the IPSec tunnel.
The crypto map is also going to include
the peer, who the peer is.
And then what we do is we take that crypto map
and we apply it to an interface, and then
when traffic is routed through that interface or attempt
to be routed, the router sees it and says,
oh, my gosh, everything matches.
The crypto ACL matches.
So I need to go ahead, and if I don't have an IKE phase
1 tunnel, it'll build the IKE phase 1 tunnel based
on who the peer should be.
It'll then build IKE phase 2 tunnel,
and then it'll go ahead and start
sending the traffic over the IKE phase 2 tunnel, where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sending the traffic over the IKE phase 2 tunnel, where
R1 encrypts it, R2 decrypts it and forwards it
onto its destination.
So that's a legacy method of using IPSec or implementing
IPSec.
However, the command Show Crypto Map
is still very useful even if we're not
implementing crypto maps, which I'll
talk about in the very next video with VTIs.
And when we're implementing IPSec tunnels with a crypto
map, as far as the IPSec is concerned,
it's going to be in tunnel mode if we're
doing it site the site.
Now tunnel node simply means this.
We're taking the original IP packet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're taking the original IP packet,
we're encrypting the whole thing, we add a new ISP header,
and then we add on a new IP header
that has the IP address of R1 and R2 respectively in it.
And that is referred to as tunnel mode.
And that's called tunnel mode, because if this is the tunnel,
and we're going to shift this traffic to the tunnel,
basically we're wrapping it all up,
and we're carrying it over this part of the network
in the new IP header.
So it's the actual original payload
encrypted, encapsulated, and carried over IPSec WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
encrypted, encapsulated, and carried over IPSec
across this network.
And think of it like that traffic
going through the tunnel.
The other option is transport mode, and in transport mode,
we don't bother replacing the outside header.
So in a site to site tunnel, it will always be tunnel mode,
and that's the default for IPSec for an IKE phase 2 tunnel.
Because if we didn't put on the new headers for R1 and R2
as it crosses this network, the internet
is not going to appreciate having the source
and destination addresses 10.2 something 10.1 something
because those are private RFC 19, 18 addresses.
So tunnel mode implies getting a new header of VPN peers, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So tunnel mode implies getting a new header of VPN peers,
where transport implies don't bother adding a new IP header.
Use the original addresses.
So in this video, we've taken a look
at crypto maps, the magical glue that
takes the crypto ACLs and the transform sets
and everything else and allows us to apply that crypto
map to an interface, which tells the router, OK, I'll
pay attention to that traffic.
If I see it, I'll build the tunnels, and I'll encrypt,
and I'll do what you say.
Now that used to be the game for almost all IPSec VPN tunnels.
However, actually a long time ago, we came out with the idea WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, actually a long time ago, we came out with the idea
of, hey, why not use tunnel interfaces,
like GRE tunnel interfaces, and just tweak them a little bit
by putting IPSec protection profiles
on those tunnel interfaces?
So that's what we do a lot of times now,
and it beats the pants off of using a traditional crypto map,
and we refer to that as a virtual tunnel interface,
or VTI.
We'll take a closer look at that in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.