Sometimes is frustrating to watch somebody go through a process and go almost
all the way through like ninety eight percent of the way and then stop short
maybe somebody is going to college or they're taking a course they stop short.
They didn't get the benefits of all their work well we have the same situation
with krip with the ipsick tunnels because we planned our ike phase one like
phase two we implemented our ike phase one like phase two sort of.
You know what we failed to do or haven't done yet is apply the krypto map to
the outbound or the grass interfaces on the vpn pierce and that's the final WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the outbound or the grass interfaces on the vpn pierce and that's the final
step to making this process work and that's the one that a lot of people forget
to do.
So let's take a look at our topology will review our configs to this point and
then will activate our ike be sick policy and it doesn't work will troubleshoot
it together so we've implemented on our one the ike phase one policy and the
ike phase two transform sets the crypto maps and everything else.
And I also did the respect of work over on our two so if it doesn't go well as
because our two is not configured correctly that's totally on me i just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because our two is not configured correctly that's totally on me i just
replicated our work we did on our one.
Swapped up the peer dressing so forth and our tonight we should be good to go
so we're going to go to these interfaces on our one.
And our to be zero slash one on our one zero slash two on our two and will
simply the command crypto space map space and the name of the crypto map.
We do not have to say inbound or outbound it's expecting to be applied on the
interface where this router would use what if he's forwarding IP second crypto
packets over to our to and here's the play by play. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
packets over to our to and here's the play by play.
I'll include this off if if we apply the crypto map and our one gets a packet
from PC one this destined from 10 1 0 50 to 10 2 0 50.
Our ones going to say whoa whoa whoa I need to this matches my crypto ACL that
's included in the crypto map that's the plan is interface I need to encrypt it
and ship it over to my peer but it says in frustration.
It's brand new i just put it up i don't have a tunnel yet so it would kick into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's brand new i just put it up i don't have a tunnel yet so it would kick into
ike phase one.
They would do the whole negotiation they would in this case authenticate using
pre shared keys generate keys with the feeling that it's at the lifetime and
then using that ike phase one tunnel.
They would then kick in the ike phase two information they would build a
separate ike phase two or ike be sick tunnel and then the traffic would be
encrypted using the ike phase two tunnel.
The ike tunnel and sent over where are to then decrypt it so the tunnels are
not already in place all that work initially has to be done to negotiate and
build the tunnels for ike connectivity between those two peers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
build the tunnels for ike connectivity between those two peers.
So let's configure let's go over to our two first just to verify our work to be
good practice by the way show crypto ice account policy as well verify that we
have our policies there.
Yes to 56 for ike phase one.
Shaw to that we have our honor one.
Do show crypto ice account policy.
We are using okay i thought verify they were the same great great great awesome WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We are using okay i thought verify they were the same great great great awesome
so going back to our two we're using pre shared keys and.
If you have a group five lifetime of five thousand seconds to show crypto ice
account keys.
We are using the key of Cisco exclamation mark two three so is our one
fantastic okay and then as far as the ike phase two information to show crypto
map.
That's a very quick way of saying a lot of the details in that crypto map so it
's using a yes and shaw it's using perfect for secrecy with group fifteen. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
's using a yes and shaw it's using perfect for secrecy with group fifteen.
There's our crypto a seal from our two which is ten to zero going to ten one
zero and these are these are the details i would check if things were not going
well are that i p six tunnel didn't function.
Looking at the first details for ike phase one and then ike phase two and then
verifying where it fell off where it went wrong.
Now this is the same that our crypto map is not applied anywhere so let's fix
that based on our topology we will go to get zero slash two on our two and girl
get zero slash one on our one and that's where we'll apply the crypto maps. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
get zero slash one on our one and that's where we'll apply the crypto maps.
So on our to go to configuration mode interface gig zero slash two and crypto
map and the name is right here i copy paste it so i get syntax correct.
And then you'll notice there's no in or out there's an option for some
redundancy will cover redundancy in a separate video but the base the apply and
boom it's done.
And we have a little message saying hey i see camp is on and so now we do a
show crypto map.
There's the details and also shows us that it's applied to that interface gig WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's the details and also shows us that it's applied to that interface gig
zero slash two.
Couple of things we can do a show crypto ice camp essay that's short for
security association that's basically our ike phase one tunnel we don't have
one.
We haven't configured our one yet also do a show crypto ike be sick.
Essay for the security association for ike phase two look at this so it shows
that it has this crypto map is applied to get zero slash two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that it has this crypto map is applied to get zero slash two.
And it's showing the interesting traffic but there's no traffic encrypted or
decrypted and there's a couple reasons for that one is we haven't had any
interesting traffic yet we have generated any and secondly.
Are ones not yet set up so are one doesn't have the crypto map applied let's
fix that now so we're here are one will do a.
Config t interface gig zero slash one and we'll do a crypto map.
And it is called scrolling up right there.
A copy paste it make up a copy paste it and make sure i get the syntax correct WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A copy paste it make up a copy paste it and make sure i get the syntax correct
as far as the upper lower case paste it in and now it's applied.
And we have a message is a camp is now on ice camp again the internet security
association key management protocol doing a lot of the heavy lifting force.
Dynamically in the background for us regarding key exchange and key negotiation
so we show crypto ice camp essay.
Wow we don't have we don't have a ike phase one tunnel show crypto my favorite
commands show crypto engine connections active is a great one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
commands show crypto engine connections active is a great one.
Show the solver tunnels are in place we've got nothing no tunnels what is that.
There's a good answer for that with i p [garbled] site site to site vpn tells a
traditional way which we just did if there's no interesting traffic.
If there's no traffic that matches the crypto a seal that's part of a crypto
map on that interface for our one or two.
It is there i don't need to build a tunnel traffic needs to go but once we
generate traffic then they'll go ahead and i'll kick in the negotiations for a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
generate traffic then they'll go ahead and i'll kick in the negotiations for a
phase one if they haven't built that so yet they'll build up.
They'll kick in the negotiations for a phase to build that and then they'll
send the traffic so we can actually watch all that to do that with some debug.
So if we do a debug crypto ice camp and that'll be good so we'll see all the
ice camp information flow here and i'm sitting at the console so they'll come
to the console and we can also a debug crypto i p sec.
Enter so those debug is going to be a lot of information but it'll be fun we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Enter so those debug is going to be a lot of information but it'll be fun we
can now see once the tunnels are established the details are going on behind
the scenes.
For both like phase one like phase two now this can become important if we're
troubleshooting network we didn't configure or maybe we don't have access to
both sides.
By doing a debug we can see where it goes bad so if i phase one completes and
then i phase two says i can negotiate transform.
We might say well you got incompatible transform for like phase two or if it's
doing like phase one is not completing it.
And it's because once i want to do our say and i want to preshared you can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's because once i want to do our say and i want to preshared you can
actually see that in the negotiations and troubleshooting by correcting the
config.
So with this debug on let's bring up our friend right here and we did a trace
earlier i just haven't moved this machine since then so if we do is just a ping
.
To ten dot two dot zero dot fifty well actually the same trace because what's
going to happen is the tunnels don't exist yet so the first packet or two is
probably going to be drops will do a trace and.
The reason it's not continuing right now is because the tunnel in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The reason it's not continuing right now is because the tunnel in the
background is being built.
Oh look we find so if we did again now the tunnels are all up now says yeah i
sent my default gateway and then he shipped over to twenty five two two and
then.
Final to the final destination so now this is actually encrypted traffic that's
being sent.
Now if we look at the tunnels let's go back to the seal i have got the bugs gal
ore some do an on all.
And let's do a we go back to the debug in a moment to show crypto ice account
essay for security association. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
essay for security association.
So this is showing that our ike phase one tunnel is established we can also
throw in the keyword of detail there.
And that was show us the methods that we use so a yes and shot to do six and
pre shared key and if he hung group.
All showing up as part of that and share it says.
A qm idle quick mode idle that's a good sign that means it's not trying to
actively build the tunnel established is all good to go.
So we can also show crypto.
I piece sec.
Essay for security association press enter and that was show us now that we've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Essay for security association press enter and that was show us now that we've
got from our ones perspective.
We're using this IP address for the crypto map is applied there's our
interesting traffic specified by the crypto acl.
We've got a current peer twenty five two two two and showing us here that the
encapsulations and the caps now right here we have an uneven number for sends
and receives and that was because.
During the initial flow of traffic it was building the tunnels so we wanted to
check that what we could do is let's go back to our Linux box to a ping.
And let's do a count of let's say ten that be great and we'll go to ten dot two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do a count of let's say ten that be great and we'll go to ten dot two
dot zero fifty and that's just an exactly ten fantastic and if we go back to
the counters previously in our one it showed thirty five and ten it should now
be forty five and twenty.
So hit the up arrow key for show crypto IP sec essay and sure not so now we're
not losing you know packets because on the initial bill to the tunnel.
The tunnel was established in some of those packets were dropped while it was
negotiating the tunnels.
So here's the beginning of the debug and there's a lot going on but it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's the beginning of the debug and there's a lot going on but it
basically boils down to this there was traffic that was sent on the interface
for the crypto map was they didn't have any tunnels established.
So they negotiate the tunnel so that involved sending over here we have our
priority five policy for ike phase one with the details there.
Based on this message there is a it's acceptable meaning they matched on both
sides the details of the policy so they agreed they're going to run diffy hel
man they did authentication here's the pre shared key matching the other peer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
man they did authentication here's the pre shared key matching the other peer.
So they did the whole pre shared key authentication thing as we scroll down to
all the messages here ice account it was successful we then kick into IP sec
which is basically the ike phase two.
So they begin the negotiation of ike phase two based on the transform sets
including this guy a yes and shot three four h mac they create the ike phase
two tunnel and then now they're starting to forward traffic on that tunnel.
Another thing really fun for you and I do is let's take a look at with a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another thing really fun for you and I do is let's take a look at with a
protocol capture and take a look at the packets before they had ike sec and
then during and after so we can take a look at what the packets look like
before they're encrypted after their encrypted and then after their decrypted
by the other and
we'll do that in the next video meanwhile I hope this has been informative for
you and I'd like to thank you for viewing.
[BLANK_AUDIO]