In the previous video, we set up some really great security
associations, one for IKEv2, one for IPsec.
They're all in place, but they're not being used
and the answer or the reason for that is because of routing.
Those two routers, R1 and R2, have
no reason to forward traffic through those tunnel
interfaces.
So in this video, we're going to address
a couple of different ways to solve that,
and then we'll implement a solution together.
So here is our tunnel.
And it's encrypted with IPsec.
We're just going to send some traffic over it.
We have tunnel 0 on R2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have tunnel 0 on R2.
We have tunnel 0 on R1.
And if we want to protect the traffic,
the 10.1 over here, the 10.2, the traffic back and forth,
we could use static routes.
We could tell R2, hey, to get to 10.1,
send it this way through the tunnel.
And we could tell R1, hey, to get to 10.2,
send it through the tunnel.
Or-- that doesn't scale very well.
Or we could use a dynamic routing protocol.
And almost any routing protocol would work here.
So we could just for--
EIGRP converges super quick, and it's super easy.
We don't have to wait 40 seconds for the initial neighborships WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We don't have to wait 40 seconds for the initial neighborships
and stuff to come up.
So if we use the EIGRP, we could include the 10 network.
And that would include this interface.
Oh, we're also using 10.12.12 here as well.
So that would include this network and the tunnels.
So they could become adjacent and neighbors,
and this network.
Let's do that.
So once we enable EIGRP just for the 10 network,
we should have reachability from R2's perspective of 10.1
via the tunnel, and vice versa.
R1 should be able to reach 10.2 via the tunnel.
And then we should have some encrypted traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we should have some encrypted traffic.
So on R1 let's do a-- actually, let's do this.
Let's do a show ip protocols just
to see what we have currently.
So we have no-- we don't have EIGRP running yet,
so I'll do a config t, router, eigrp, autonomous system 1.
We'll make that match on both sides so they mean the same AS.
And then we'll just do network 10.
Now, because it's the 10 network,
we're just going for the first octet.
We don't have to use a wildcard.
Just press Enter, and we're done.
We can verify that with a show ip eigrp interface.
And sure enough, we got the gig 03. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And sure enough, we got the gig 03.
That's the internal network.
And we have the tunnel 0, which is heading off
across the transport network.
Fantastic.
Let's do the same thing on R2.
So on R2, let's do a debug ip routing.
So we can see those routes come in.
That's always fun to watch.
And config t router eigrp autonomous system 1,
and network 10.
And so close.
There we go.
So there's our neighborship.
And we just added the 10.1.0 network via EIGRP.
So there's the administrative distance for EIGRP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So there's the administrative distance for EIGRP.
There's the feasible distance for that route, also known
as the composite metric.
And now let's do a show ip route.
And there is our EIGRP learned route.
And it says, hey, to get there, go over the tunnel.
So now if we do a ping that's going
to go over the tunnel to 10.1.0.1,
that's the IP address on R1 on the inside.
There's also a host there at .50.
Let's ping that.
And let's also do a trace to that as well.
Trace to 10.1.0.50. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Trace to 10.1.0.50.
And sure enough, there you go.
The next hop is 10.12.12.1, which
is the other end of the tunnel.
So that traffic was protected.
And if we did a packet capture on that traffic,
it would look something like this.
So here is the traffic.
So the 25.2.2.2 is one end of the tunnel going to 15.1.1.1.
That's the other end.
And there's responses back.
So with that trace route that we just did,
which would be using UDP as the headers,
we can't see any of that, because it
got encapsulated in IPsec.
And at layer 4 it says, hey, it's protocol 50 ESP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And at layer 4 it says, hey, it's protocol 50 ESP,
but it does have here in the header-- check this out.
It has the ESP SPI, the Security Parameter Index,
which is 0x for hexadecimal, 83a96616.
So if we take a look at R2 on the-- this is going from R2
over to R1--
we should be able to verify that SPI.
So here in R2, if we do a show crypto ipsec Security
Association, or sa is the syntax.
Check this out right there.
This is the current outbound SPI,
0x 83a96616 in hexadecimal. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
0x 83a96616 in hexadecimal.
And we can also see that we have packets
that are being encrypted and decrypted
as we send traffic back and forth over the tunnel.
So in this video we've taken a look
at adding routing to make those tunnels useful so we can
actually use IPsec to protect the traffic going
through the tunnels.
So thanks for joining me in this video.
And I'll see you in the next one.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.