So now that we have the IPsec tunnel up, it's time to verify that it really is
doing what we
wanted it to do and that is to protect all the traffic that's going out from
this T0 gateway.
If that traffic is coming from 1033-0 and going to 1080 to make sure that it's
going
over the IPsec tunnel, which gives it the protection. So again, if this was
like the internet and
that traffic is all being said over the internet, if we're encrypting
everything,
and eavesdroppers are stealing those packets or getting copies of those packets
, because they
are encrypted, they are meaning this as far as the contents and the payloads of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are encrypted, they are meaning this as far as the contents and the payloads of
those packets,
because the hackers cannot decrypt that traffic. The only two entities that can
decrypt it are
the T0 gateway and the Cisco router on the other end of that same IPsec tunnel.
Let's go to this
VM right here and start sending some traffic over to the IP address 1080.10. So
here the vSphere
client for the red portion of my lab, let's go to the networking tab, let's go
to our red 3
segment 33. And I've got two VMs there, one that's on a host number one, one's
on host number two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on host number two.
Let's bring up red one. So we'll right click on red one, click on power and
power it on. And while
it's powering on, let's also bring up a remote console by right clicking, then
from the menu
clicking on open remote console. Now before we send any traffic from this
little red VM,
which is sitting right here, let's also go back to the NSX manager and just
confirm what the
current hit counts are for traffic over our IPsec tunnel. So back at the NSX
manager, if we click on
networking and then on the left under network services, we'll click on VPN. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
networking and then on the left under network services, we'll click on VPN. And
then to take a
look at our IPsec session between our T0 gateway and our Cisco router, we'll
click right here on
the sub tab of IPsec sessions. And then from here, we'll go ahead and click on
view statistics right
there. So I'm still expecting all that to be zero because we haven't sent any
traffic specifically
from the 1033 zero network over to the 1080 network. And let's now change that
by going to our red
VM, which is right here, slowly make that a little bit bigger. And from this
red VM, let's go
ahead and do an I have config just to confirm its IP address. So I have config WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and do an I have config just to confirm its IP address. So I have config
ethernet zero,
press enter, and it has the IP address of 1033 zero dot 151. So we did a ping
over to the IP address
of the router on that subnet of 10 dot 8 dot 0 dot 10, that traffic coming from
1033 zero
151 going to 10 8 0 10, that should match our policy that we have set up for
our IPsec session.
And the hit counts should increase for traffic going over the tunnel. So let's
first of all verify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
first of all verify
that it works. That's always a fun thing that it actually works. And now that
it's actually running,
let's go ahead back to the interface. And let's click on refresh right here. So
we should see
in packets in and packets out for the ping request and the ping responses, that
should be incrementing.
And it is. And so as that ping continues to happen to the background, if we
click on refresh again,
this hit count should increase. And that absolutely is the case. And if we went
back over to the
Cisco side just to confirm and hit the up arrow key and did the appropriate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Cisco side just to confirm and hit the up arrow key and did the appropriate
output here on the
Cisco router, that's also going to indicate that packets are being encrypted
and decrypted.
And because that ping is still happening in the background, if we hit enter
again and do that
same command again, those are continuing to increase as well. Or if we hit the
up arrow key a few
times, you'll show crypto IPsec SA, those numbers are also reflected up here
for encrypted and
decrypted packets that are going over the tunnel. Again, this side would be
from the perspective
of the Cisco router. One other aspect that we kind of fun to do would be to
capture that traffic
and take a look at the payload. So even though there are pings, it could be SSH WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and take a look at the payload. So even though there are pings, it could be SSH
, it could be anything
else. If people are capturing that traffic as it goes over the tunnel, because
of IPsec doing the
encryption, the attacker or anybody who captures that traffic would not be able
to identify what
that payload is actually carrying. So to capture that traffic, let's go to the
switch that is
currently being used by the edge nodes, because behind the scenes where the VPN
services is the
edge nodes doing the work. So here's my switch that my edges are using for the
transport network.
And let me go ahead and edit the switch and set up mirroring. So with that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let me go ahead and edit the switch and set up mirroring. So with that
switch selected,
we'll go to configure, go down to port mirroring, and click on new. And I'm
going to choose
encapsulated remote mirroring, click on next, it's going to use GRE to ship the
traffic over.
I'll click on next, because I'm not sure which edge node is being used. And
then I capture the
traffic from both of the edge nodes, click on next. And for the destination, I
'll click on add,
and I'm going to add the IP address of my management computer, which is 192.168
.1.151,
click on next, and click on finish. And now that it's here, it's disabled by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click on next, and click on finish. And now that it's here, it's disabled by
default,
I'll edit it, and I'll set it to enabled and click on. Okay, so that ping is
happening in the
background. And now let me go ahead and run some software on my local
management computer, so we
can go ahead and collect that data. So to collect it, I'm going to use wire
shark. And let me put a
quick filter in place, IP protocol 47, which is GRE traffic. And that way only
the GRE traffic
is going to show up inside the capture. And I want to choose this interface
right there.
All right, and there it is. So now that it's run for a moment, I also want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, and there it is. So now that it's run for a moment, I also want to
confirm that my
pings are still running, which they are fantastic. Let me go ahead and stop the
capture. I'm also
going to turn off the port mirroring. So I'm going to edit that session and say
disabled and okay.
And let's go ahead and take a look at our capture. So there's a ton of traffic
here. In fact,
there's over 17,000 packets. So let's go ahead in the display filter. I'm going
to type in ESP.
ESP is one of the protocols used at layer four for IPsec. It's protocol number
50.
So with this display filter in place, it's only showing us ESP traffic. So here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So with this display filter in place, it's only showing us ESP traffic. So here
in this one packet
going from 780060. That's our T zero external address going to 780010, which is
the router address.
Let's take a closer look at the details for that packet. And here it is. So the
first four entries
is just the encapsulation of the distributed switch shipping this content over
to my management
computer. As far as what was captured on the wire, we have an ethernet header.
And based on the
Mac addresses, it was sourced from a VMware device based on the layer two
address going to a Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address going to a Cisco
device. And that's wire shark in the background, helping us with identifying
based on the first six
hex characters of the Mac address regarding who the vendors are. Then the next
layer is the IP header,
which shows us the source and destination for the IP traffic. And then inside
the IP header,
it specifies what the next protocol is. So instead of saying, Hey, it's ICMP or
Hey, it's UDP or TCP,
it's showing us that the next protocol is protocol 50, which is the number for
ESP.
And then we have the ESP payload right here. And it has the SPI, the security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we have the ESP payload right here. And it has the SPI, the security
parameter index.
But the contents are all encrypted. But as far as the payload goes, anybody who
captures this traffic
doesn't know if it was an SSH session or a telnet session or HTTPS session. So
for the payload,
as part of ESP, all that content is encrypted. So if we close that, that story
continues back
and forth for all of those pings. So right here from the client, if we tried
using an insecure
protocol, for example, like telnet, and we tell that that router rests on that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
protocol, for example, like telnet, and we tell that that router rests on that
protected subnet of 10
dot eight dot zero dot 10 and press enter, you'll notice that we are connected
to that router.
So we do it, for example, show IP interface brief, or if we did a show crypto
map, we are connected,
using a very insecure protocol like telnet to the IP address there on the
router. And again,
the benefit is as that traffic goes over the tunnel, the payload, even though
it's telnet that the
client is actually using, which is not safe, as that traffic goes over the
tunnel, anybody eavesdropping
over the tunnel is not going to have a clue about what the protocol is that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over the tunnel is not going to have a clue about what the protocol is that's
been encrypted,
because it just looks to the attacker or to the unauthorized eyes as an ESP
payload,
which once again has been encrypted by this t zero gateway before it shipped
over the tunnel,
and then decrypted here at the Cisco router. And because we are going between
the two protected
subnets, all the payload back and forth over that tunnel is protected as it
goes over the transport
network, which in our case is our VLAN 78 here in this lab.
[BLANK_AUDIO]