So we've done a lot of great work in planning, implementing, and then verifying
our IPsec
site site VPNs.
And I thought, well, you know what, we deserve a little bit of a celebration.
And to do that in the world of networking, we use packet captures to take a
peek at what
the packets are actually doing on the network.
So let's take a look at before encryption and then during encryption and then
after on
the remote side of the VPN tunnel.
So to do that, let's generate some traffic here from this PC and we can
generate some
ICMP traffic and some HTTP traffic over here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ICMP traffic and some HTTP traffic over here.
This is a web server that's also running.
And the cool thing is if we capture the traffic here, which we'll look at here
in just a moment,
we'll see the naked normal traffic as it normal is.
But once that traffic exits this interface, it'll be encrypted, shipped over to
this peer.
So we'll just see those external IP addresses of 1511 and 25222 on the outside
IP packet.
And then our two will decrypt that and then ship it off.
So PC too, we'll just see traffic coming from 10, 10, 50, destined to itself. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So PC too, we'll just see traffic coming from 10, 10, 50, destined to itself.
And if it replies, it would source it from its own IP address going to PC ones
address
as the destination.
Our two would see that traffic is also being interesting.
It would encrypt it, ship it over to R1 as encrypted data who then decrypt it.
So I've got a capture going here, here in the cloud and also here.
And let's go ahead and generate some traffic and then we'll share the results.
So here at this client, we'll go ahead and let's do some pings.
We'll send 100 pings over.
Actually, I don't need 100.
So let me go ahead and stop that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let me go ahead and stop that.
And then we also generate some HTTP traffic.
So we'll open up a browser and it'll go over 10.2.0.50.
And let me hit refresh a few times just to make sure we really are sending some
traffic
and for good measure, maybe some more ICMP traffic as well.
There's a few more of those.
Great.
All right, then we have something to look at.
Let's bring up the captures.
All right.
So here's the B4 picture.
This is captured on the local network of 10.1.0.
I've got a whole bunch of loopback messages sourced by the router itself.
Let's go down here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go down here.
We have some ICMP and here we have some TCP.
Fantastic.
So let's grab this one right here.
It's an HTTP get.
Fantastic.
Coming from 10.1.0.50, going to 10.2.0.50.
Now 512 is what it looks like as far as bytes on the local area network.
But once it gets encrypted, there'll be the new ESP header and a little
overhead for
authentication and everything else.
So we can expect it to be slightly bigger.
Now the key is we might not be able to even identify it because it's going to
be encrypted
once we look at it.
So it's an HTTP get request that the 10.1.50 client is making to the server at
10.2.0.50. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
10.2.0.50.
So let's take a look and see if we can find that same packet in the cloud.
So here we go to the cloud where I captured it and we have a whole bunch of ESP
traffic.
So ESP is the encapsulating security payload.
This is from R1.
There's layer three source address, layer three destination addresses R2.
And then it's pointing if we open up the header here, it's pointing to the next
protocol
of protocol 50, which is ESP.
So for the ESP payload, we really can't tell what's in that payload because it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for the ESP payload, we really can't tell what's in that payload because it
's all encrypted.
So if we try to find something that's close to that size, let's take a look
back again.
So we had an HTTP request of like 512.
Let's go back to the cloud.
And that could be it.
So with the extra authentication information and the ESP header and the tunnel
ing.
So there's no way to confirm that with this protocol capture because this is an
encrypted
encapsulated packet that's being sent from R1 or R2.
And then R2, when it gets it, it would decrypt it and forward it on its way to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then R2, when it gets it, it would decrypt it and forward it on its way to
the final destination.
And we have a capture of that as well right here.
So this is the capture over on the 10.2 network.
And what was this side?
Oh, there it is right there.
That's probably the same one.
HTTP get request.
And if we take a look at the details of that and let's expand the IP4 header
information
here.
It says here that the identification, it hears the hex.
Here's the decimal 62126.
Let's go check the original packet on the other side.
So here's that packet that I think it is.
If we expand that and nope, that is not it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we expand that and nope, that is not it.
That is 62133.
So let me do this.
Let me right click on that and say apply as filter and selected.
And then I'll just take that same filter.
Right click, copy it and we'll go to the destination network at site 2 and I'll
put
in that same display filter and press enter.
There it is right there.
Okay.
So that is the same packet on both sides.
So over at the site 1, there's the source IP and destination, the details for
that packet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that packet.
And here's that same packet after it made the journey over the cloud.
But for this journey across the cloud, we really can't confirm which packet
this is because
all the payload information is encrypted.
So we can't see the details of the original IP header because it's now part of
the encrypted
payload.
So I'd like to thank you for joining me in this set of videos regarding the
original
flavor of site to site VPNs on Cisco iOS routers that are using crypto maps.
If you haven't already done so, I'd also encourage you to take a look at the IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you haven't already done so, I'd also encourage you to take a look at the IP
sec
fundamentals set of videos and also the other videos we have on topics like
FlexVPN, GetVPN
and DM VPN, all of which are available here at CVT nuggets.
So thanks for joining me.
I'll see you in the next set of videos.
Meanwhile, I hope this has been informative for you and I'd like to thank you
for viewing.
[BLANK_AUDIO]