We are going to have a look at what get VPN, what is a VPN, where is it used?
Get VPN is used over private Wan links.
Private van links or private land.
So private van links are the frame relay Mpls atm.
The most famous right now, Mpls.
Right.
But why do we need a VPN for that?
What is the private van do?
It connects two private networks together right across there.
Across the service provider.
The Why do you need protection?
Protect yourself from the service provider when you are on a private command.
You are not on the internet.
You're only going across the service provider to the other side.
Right.
So you have four different sites connected to the service provider.
It's not the Internet through an Mpls cloud and whatever labels or whatever they're using, it's not
up to you.
I mean, for you, it's just a big router in the middle.
You're just connected to one big router which routes your packet from one interface to the other one.
You can use private addresses as I'm using right now.
1921680 across the van.
Then connectivity.
You can run any routing protocol, right?
And your packets will move from your Loopbacks to the loopbacks or from your internal networks to the
internal networks.
This is a prerequisite, right?
You can run routing, you can do anything.
The restriction in Dmvpn that we had was we were on the internet.
Since we were on the Internet, we could not run normal routing between these routers because they were
going through the BGP net cloud, so you couldn't run routing here.
You don't have that restriction since it's all your own network.
The only one alien router here is.
The private one.
You need to make sure that your network is protected across Mpls.
You might hear it's also known as Mpls, VPN, Mpls, VPN.
Does that mean it is secure?
It's not secure.
It's a VPN because there's encapsulations happening, but it is still open.
Text.
Clear text.
If you telnet through, anyone can see what's inside.
If you're using frame relay, same thing.
It is also considered to be an L2 VPN frame relay, but when you send traffic through it again, anyone
who's there at the service provider can just click on it and see what's inside there.
Okay.
This past year.
It is costly.
We use big companies.
They use this because it's more secure.
Also, you're not on the Internet.
That's the best thing.
You're not on the you don't need to be on the Internet.
It's all on your own private cloud.
Right.
Now, the question is.
Now the question.
Another good interesting fact is yesterday we needed to do a lot of work to make the loopback stop here.
Routing protocol done, Communication is successful.
What happens in this case?
How you actually implement this is once you have connectivity between all your internal networks, once
they they're communicating to each other, you also make this guy communicate.
What you could do is you could convert your router, one of your routers into something known as a key
server.
Okay, so what does a key server do?
It the whole the sole purpose of a key server is to manage keys is to manage keys.
You will be creating the same IPsec tunnels.
The ones which we have been talking about for a long time now.
You'll be doing the same.
IPsec Tunnels.
Across the whole thing, but your eyes can remember the ice.
The key exchange will not be between the peers, will not be between the group members.
It will be between whom?
Between the key server and your group members.
And so.
So the key will be generated.
Where?
And then it will push this key down to all the other group members.
Whenever the group members are coming up, for example, R2.
R2 camp will be between R1 and R2.
They will negotiate on a a session and eventually at the end of that, he will have a session key.
Plus, they will negotiate on not negotiate.
It's called push down.
The configuration will be all configuration will be done where on the server, the access list.
The ACL will be configured on the server.
The set transform set will be configured where?
On the server.
Once the negotiate the IPsec plus the session key.
What the server does is push down the ACL and the transform set to him.
So let's say the transform set says that your encryption should be done based on S and your hashing
should be done based on Sha.
So the key server will push down telling him, listen, do a s and use a s and Sha and this is your
session key.
This black key.
Keep it there.
That's it.
That's all it will do.
Then we'll go to the other guy.
Then R3 will come up and register.
When R3 comes and registers and everything not negotiated, it is only negotiated for the ICM part only
For the first time.
The black key has already been created and it's kept where on the key server.
Whoever comes and registers now will be given which key.
This black key.
And the same transform set and the ACL is.
When both of them have created their tunnels.
Both of them have the same session key because the key server keeps track of it.
The key server keeps track of the key, and it's providing the same key to everybody who's coming and
registering.
So first our two came in.
I gave him one key.
Then our three came in, came in.
I gave him the same key.
The moment I gave both of them the same key, they can communicate.
If they're communicating across themselves, the moment they communicate, it will be encrypted.
Moment because why?
They have the key.
They have the encryption mechanism.
They have the hashing mechanism, both sides.
And plus they also have the ACL is the keying material, the keying material of remember the 3600 seconds,
the session key of 3600 seconds.
That's what's being sent down.
Hey.
To be a part of it, a part of the session.
Remember the whole you have a whole material out of that.
You take out small chunks every 3600 seconds.
You go back and take another chunk.
Then every 36, you go back and change it the same way.
The same one is being sent down.
Now the question arises is if, for example, if now this is your the first day you got stuck at this,
if they're communicating among themselves.
Right.
They're running routing protocols among themselves.
If I push down this key here and I push down and Sha, will he be able to communicate to the others?
I have not joined the other guys.
It will not be able to communicate.
Why?
Because now the traffic which will be leaving this interface will be encrypted.
And when it reaches the other side's it will be encrypted.
The other side's do not have the key.
They have not registered.
They will not be able to do what decryption they are not able to decrypt it.
They don't have the key.
They are not able to understand what you're sending them.
That's why from here, the first time when you're implementing in production, you will apply it only
in inbound direction.
Basically telling it only do decryption do not do encryption.
I will I'll show it to you how to do it.
Now, see, again, the question is a little bit of recap.
What is going to happen is R2 is going to come up and register to whom?
R1 Who is a camp across this camp.
R1 is going to send him what?
The session key of 3600 seconds s and the set transform.
Set.
This will be applied to this interface.
Whichever interface you choose, that's how it registers.
When you choose the interface, it goes and registers itself.
The moment you choose this interface.
Now whatever is going to happen is based on the ACL, based on the access list, which will be from
loopback to loopback.
Whatever traffic is going to be sent will be encrypted and decrypted.
Now usually when you apply the crypto map, it's in both directions inbound and outbound.
Inbound means decryption outbound means encryption.
Now when traffic coming from, say, for example, tend not to will be what encrypted and go out as
encrypted traffic if it reaches this device will R3 understand it because it's encrypted right.
So we applied only in one direction.
We apply it only for decryption.
We say, okay, when you're going out, do not encrypt, let it be.
But when you're coming back in, if you have traffic coming back in, which is already encrypted, you
have the permission to decrypt it.
So we only apply in the beginning in production environments in one direction.
Only to decrypt the data.
Right.
We'll see how that is done.
For now, let's do the normal stuff.
Yeah.
So it would be saying will you be the first and Yeah.
Will be exchanged between them once the first guy comes and registers.
Right.
The will be exchanged from that.
I'll find out what the sessions that same session key will be used for everybody else so we can get
the best.
Yeah, yeah.
The thing about get VPN is Wireshark cannot capture get VPNs Exchange doesn't show you Wireshark doesn't
have the capability of it, just shows you data doesn't show anything inside that data.
So since you can capture it can capture what the key cannot be captured.
It is not secure.
Always was never secure.
Even in IPsec.
Remember, the public key was sent from both sides, but it was mixed with the private key.
So even if it's anyone can see it, exchange the secret key right there.
Also, we don't exchange the secret key there.
Also, secret key is not exchanged.
When they're exchanging, they're exchanging the edge.
They're exchanging.
They're exchanging the edge.
First four packets is the same.
The exchange.
You have your key.
I have my key.
Right.
We get the key eventually.
But but, yes, the good question.
I get what you are trying to ask.
What he's saying is first time you get the key right next time when the other guy comes up, I need
to send him this key.
When the other guy comes up, for example, here, I again, I need to send him the same key.
How do I do that?
I don't do it just as it is.
First they negotiate their own section of their own and then the tunnel is protected through this edge
because it's already protected with the other.
I will send this session.
Once attacking only the small amount of sessions after 30/602.
Key server keys.
We call it three keys.
Everybody else that really key.
The group members come and register again.
I'll show you the time, how it happens.
In.
Yeah.
The order of Easter when I create the keys.
Yeah.
Yeah, it is with the Keyserver.
Yes, it is with the Keyserver.
So the key server is the one who keeps on changing the keys, not the group members.
Group members have no control over the keys.
They do not have any control over the keys every 3600 seconds.
Even 5%.
Less than 3600 seconds.
The group members will go to the key server, reregister themselves five seconds 5% of the time before
30/602 will go and reregister themselves.
Get the new key.
Every 30/602 every hour.
Yes.
The create another use that to encrypt the key so the key is sent back to them.
Okay.
Said, Let's see how to do that.
Now, the good thing about this is your transform set.
ACL is configured where on the group members, all you need to configure is your Icap policies.
That's it.
And a little bit about groups.
We'll see that.
Yeah, that's another good question.
The thing is can are to be a key server and a group member himself, just like we did it in Dmvpn.
A hub could participate in routing in gate VPN.
It cannot.
A key server cannot be a group member.
A key server cannot encrypt the data.
It doesn't have the capability of doing it.
It can only because it has the key.
The main key is with him, right?
So we keep him separate, gives out the keys to others, but he itself should be isolated from the others
around.
It can be a router.
Yes.
Right.
Not hard to do.
What if R2 becomes the key server?
It has all the keys.
It's very dangerous to put him out there with everybody else.
Right.
The way they designed it was they kept it as separate, said, okay, this will be separate.
So you could have a firewall in the middle and stuff like that to protect it.
Now it doesn't have to be directly connected.
That's the good part.
A key server can be somewhere across, way ahead, somewhere far doesn't really matter as long as you
have connectivity to the key server.
Everything is good.
Prevent the first criteria is what?
The first thing that I need to make sure of is I should have connectivity across the whole thing.
So I'll be running a routing protocol all across this, which will share my internal networks.
Plus I also need to share which network I run because it's faster and quicker.
I'll run it to share everything.
So by the end of my configuration, everybody should be able to reach anywhere where they want to.
Okay, let's do that.
So it said, right, Let's check from R3.
Try it out.
So routing is done.
10.2.
10.3.
10.4.
10.5, ten.
11.
11 zero is also here.
Which is whom?
My actual server.
The key server.
Can I reach the key server?
I should be able to reach the key server.
I should be able to reach the all the loopbacks.
Even without the VPN being set.
You have to understand that this connectivity should be there and you need to make sure that all of
your group members should be able to reach whom the key server.
Whichever way is possible.
You want to do it on static routes with whatever way you want to do it.
We need to make sure that the group members can reach whom the key.
So when you go to the key server and you start configuring the key server, how do you do that?
The first thing is your policies, because why?
All the group members will come up and register to me through isocarp.
The first time, right.
What are the policies?
Anything.
Encryption.
Same commands.
The first See The first section will always again be the same.
Step one is crypto isotamm policy.
Then encryption.
Three There's authentication.
Pre-sense.
Do I need a key here?
I do need a key.
It's a pre-shared key.
Obviously, I need it.
If I have specified the authentication as pre-shared.
I would require a pre-shared key crypto.
I can Cisco authorize.
What address do I give?
I could specify all my group numbers separately, which I could say 192 160 8.6 20 6.2 and stuff like
that.
Or I could just say production.
What will you do?
See A7.
Will use Luterman.
Okay.
Isaac Sisko Address done.
Two steps are done.
What else do I need?
I need to push down a crypto IPsec.
Step three crypto 96 Transform set.
Set DSP.
Let's set three days DSP 95.
Number four access list one permit IP.
Now, this is a little bit tricky.
What access list do I push down going from which network to which network?
He flew back to Lubeck, but we flew back.
What networks do I specify?
See, the problem is that the same ACL, which I specify here in the keyserver, will be pushed down
to all of them.
If you push down to R2, will you push down to R3?
Goes down to.
All the group members,
right.
If I do, for example.
Ten .2.2.221.3.3.3.
The problem is they will be pushed down here as well as here.
He doesn't have the source of 10.2.
So problem.
If I push it down here, I could make it complicated.
I could say, okay, 10.2 to 10.3, 10.4, 10.5.
Then 10.3 to 10.2.
10.2.
Complicated, not scalable.
So what I do is I summarize it.
I say going from 10.000.
0.255 going to ten .000
and he would be a problem because then it will also encrypt your traffic going to.
Yes.
Your traffic.
But you only want your internal networks to be protected.
I know that all my internal networks are on the ten subnet, so I say anything going from ten networks
to ten networks should be encrypted.
Right.
What about two?
Perfect that one.
Why do we need to do that?
Control traffic.
Right.
I actually want to protect my data.
My data that will be sent across.
I want to protect that, not the control.
Control is okay.
It's just.
Can I do that?
Yeah.
Then you'll do encryption for everything from any to any.
Anything going out.
Anything coming up.
Should be.
Should be in.
Yeah, it's more safer, but more overhead.
Also more because you'll see five seconds, a lot of packets going through.
Every five seconds packets will be going out.
This is more efficient.
Good.
Back to you.
Back.
This will be pushed down.
The thing about your group is that when it's pushed down, it's not pushed down as an IPsec transform
set.
It'll be pushed down as a profile, just like you apply a profile to a tunnel.
Same thing here.
When you're pushing it down, you push it down as what?
As a profile.
Push it down as a profile.
So you need to configure it as a profile.
You say same thing.
Crypto IPsec Profile, high profile set.
What is coming in.
Access list.
Fail open and fail close.
What is that?
You can configure it any access here and get the same inbound and outbound same which we are going to
do.
There's something known as receive only receive only.
When you apply that list to a device, you will only receive that it will only decrypt the traffic.
It will not encrypt for the amount of time that you apply to all of them.
Then at one single time you will change it to both ways.
To open.
I have not heard of those terms.
Let's let's have a look at it.
Of what?
Of the terms which I have heard is receive only inbound and outbound fail open.
No, it's okay.
We have the Cisco Docs.
Right?
Fail open.
Fail.
Close access.
Yeah.
Since the failed close function can also be investigated in the traffic passing through, the group
members will be sent in clear text until registered with the case.
This is because the crypto ACL is configured on the case and will get information only after registration
is successful.
If fail close feature is configured, all the traffic passing through the GM will be dropped until the
GM is registered successfully.
So basically the GM will not be able to communicate as long as he doesn't register himself.
Right now, they are communicating, right?
Right now, the group members are communicating even though they have not registered themselves to the
keyserver.
But what you could do is you could change it and keep it as a fail close mode where they will not be
able to communicate as long as they don't come up and register.
We'll have a look at it later in advanced features.
No group member is group member.
CS is keyserver.
There's only two things key server and group members.
So coming back to the ACLs, I've configured my ACLs.
I've configured my profile.
I need to paste it.
So.
It says it doesn't exist and copy it from here.
So run section.
Ah, this is good.
Transform set is fine.
D set.
I am setting transform set as D set.
Correct.
What do I need to do now?
I need to apply it.
I need to configure it in something known as a get group.
That group and that group will be pushed down to people who register.
How do you create a so-called crypto gdoi group and you call this group something Gdoi is the protocol
just like Isakmp is the protocol.
Gdoi is also a protocol, but it's nothing but an extension of ICANN.
It is an extension of ISoc.
When the group members come and register, I'll show you how it is an extension of the ICP.
It works.
It works on UDP port numbers 500 Gdoi works on UDP port numbers 848848.
UDP 848.
Yeah.
Nat doesn't have Nat?
Private networks.
Private private communication.
That would go back.
Yeah.
To 4500.
That works the same for Nat.
Works the same for all.
Good enough.
Crypto group.
Call the group anything.
The name is local.
The name does not make a difference.
But yes, production.
You will try to keep the name.
Same on all the group members as well as the key servers.
So let's say this is for my IT department, so I'll call it group ID.
The name doesn't matter.
Let me just change it.
I'll call it it.
It's.
IP on the server just to make sure you understand that the group name doesn't have to be the same.
What has to be the same?
What has to match is identity number.
Just exactly like your network ID.
Exactly like your.
Autonomous system number.
Identity number should match on all of them.
And this is how they see if they belong to the same group or not based on your identity number.
Now, this number could be anything between 0 to 2 1 million, just like your loopback.
You can choose anything that you want.
Let's choose 150.
A random number.
Okay.
Simple stuff until now, right?
He added a group and assigned it a identity number.
What else I could do is I have certain other features here.
The only one option that you have available to you is you need to configure the server.
Now, depending upon who's the server, who's the server right now, R1 is the server.
So when I use the server command, what do I specify?
The server is local.
Once you do server local, you'll have to configure it.
If it was some other guy, you wouldn't have to configure it.
Server is this guy.
But since here the server is local.
When you click, when you press enter here, you will go into the configuration of server sub configuration
of server.
You're inside the server, right, guys?
So.
848 is.
Right, then you need to configure the server.
Now, there's a lot of things that you can do here.
The most important one is the first one.
Do not forget that
address.
You need to specify what address should people come up and register to me as.
Yeah.
Now if you have a loopback if R1 had a loopback which was also routing, you could choose that also.
But right now I don't.
I'll use that in dual hub.
Right now I'll just say ten 1111 dot.
Physical address.
This is.
This is the physical address.
1011 one is my address on my interface.
This interface, that's what I'm using, right?
So I specify the address of how people are going to come up and register to me.
What else do I have right now?
Don't need anything like that.
Redundancy.
No need registration.
No need Rekeying.
No need.
The first.
I'm talking about the most basic kind of VPN, which is very little secure, very less secure.
Right?
The we configure what security association which should be pushed down.
What should you push down if people come up to you, if they use your server's address, which is ten,
11, 11, 11, if they have the same identity number as you, then everything matches.
If it's matching, what should you push down to them?
I say, I say, then receive only is right here.
If I choose receive only, then I'm only pushing down the receive only part of it.
The decryption part, not the encryption part.
If you're using IPsec, you're putting it down, pushing down the complete inbound and outbound.
If you're pushing down, receive only you're only pushing down inbound.
First, let's do the IPsec, then we'll see the receive only part and I have a different one for encrypting
and for encrypting different or different key for encryption and decryption for encrypting different.
You can can do that because once the guy will encrypt decrypt using three days, the other side should
decrypt also using three days.
Right.
You cannot encrypt using three days.
The other side is decrypting using as the algorithms don't match.
The only point of doing it is to escape them to make sure that the connections don't go down.
Because in production environment, if you're supposed to deploy it, you know you don't have time down
time.
You want to make sure you have as little as possible, so you deploy it for everybody first.
Once it is already deployed in receive only direction, then you go to the server and change it to both.
So automatically go to all of them and change it to both.
So whereas the Spy, whereas here you don't have to worry about that.
We'll see when you can revert the tunnels.
When you see the tunnels, you'll see how many tunnels will be created.
Right.
For right now I'm choosing IPsec ten.
You have to just like crypto maps have sequence numbers.
Right?
Ten, 20, 30, 40.
Just choose any sequence number here and then specify.
The profile that is supposed to be pushed down.
What is the name of that profile and what else should we push down?
Match address.
IPv4.
What is the number?
One zero.
No.
Again
after I do this.
Step five would be what?
Crypto gdoi group name it anything called it.
It is.
The important part is the address.
IPv4 is 1011, 11.1.
Again, the most important part is identity number 150 Then we go to server is local inside server local.
I specify this should have been done here.
The address is here.
Then say IPsec.
Then the sequence number.
Profile is off and match address.
IPv4 one zero.
That's it.
You're done.
You don't need to apply it to an interface.
You don't.
You just need to keep it there.
848 should be open, which it is.
Now a request coming on UDP.
848 you will reply to it when you give an IP.
It's bidirectional.
Is bidirectional.
So it wouldn't work.
It wouldn't work when somebody else is sending the traffic.
It's.
What do you mean?
You said we need to apply the description for the first year.
Yes.
No, for the.
For the first case.
I'll apply it both ways.
Then we'll do it one way right now.
Otherwise I'll have to use a receive only.
As they only receive one and send it down, he said For the first time, I said in production environment,
when we're doing it, we'll use receive only.
But here I want to show you the first tunnel.
Come up first to make you understand the other concepts.
Then we'll go back and see this concept of receive only how it works.
Because right now you still have to key the key, how the key comes and registers how the group members
come and register and those things.
Okay.
Is this clear of what I've done right?
So now the only criteria that should match from the group side is they should have the same identity
number.
They should be pointing to the same server and their policies should match.
That's it.
And their policies match.
Everything is okay.
I can do this?
Yes.
One?
Yes.
I would think when football you that I will have to change the groups then I will get out on the group
members.
I will have to on the groups you can have.
But that will be cumbersome because if you have, for example, 50 groups, you have to go to each of
them to configure.
If you just do receive only from your key server, then it's easier because you send it to 50 members
altogether.
Right.
That will also work.
But if you have a lot a bigger design, then it'll be too much work.
Yes.
This way is much easier if you just do it from the key server side.
But yes, we do use different groups.
If you have the same key server managing two different domains, we have one five routers here which
are a part of one company and five routers here which are a part of another company.
I can have only one key server, but two different identity numbers.
One identity number for this company.
One identity number for the other company.
So I'll have separate set of policies and down here a separate set of policies and they will not be
able to communicate to each other, which is okay, because these are two separate, separate companies
companies.
Each server is each server can be.
It depends.
It depends on how you do it.
Maybe two different branches of your same company, but you don't want to communicate to each other,
but you want connectivity between them.
So you want connectivity like that, right?
But you are in the middle.
The same key server handling two different.
Yeah.
Guys, we will do it for you.
But Keyservers should be managed by you, right?
To make.
Yeah.
The hosting, but I think Key server is your character.
It's local.
It should be locally on the company because if they have the key server, you lose the whole point of
it because whoever has the key server has full information about the network.
So you can go to the key server, take out the private keys and do a lot of stuff, right?
Right now we have not gone to high security mode.
This is low security mode.
So there is a.
It's not now.
Not right now.
Right now.
I'm using a simple mode right now.
It's symmetrical.
Yeah.
Tomorrow or on Monday, we'll see asymmetrical portion of VPN where we'll add more security on it using
asymmetrical keys.
So we'll have double encryption happening.
The same key will be encrypted twice.
She was not with the car with the key.
So we'll see how that is done.
It's very good.
And.
In the middle.
Yes.
I'll add another key.
Not IPsec.
You see the the encryption key where I'm using the session key when I'm pushing down the session key.
Right now it's not as secure because it's going through the edges.
But if anyone has access to that session key, we'll have access to the whole VPN domain.
So I want to have another key, not the data.
IPsec I'll use the same session key, but while the key server is sending it down at that time, I'll
use another key to encrypt it again so that no one can see it.
The original key will be the same, but it'll be encrypted twice to protect it.
We'll see that right.
For now, let's bring it up from the group member side.
The server side is set.
Let's go to the group members.
What do I need on the group members?
First step, do I need my policies?
Why do I need my policies?
Because I need to create the tunnel with the right.
I need my second policies.
What else do I need money for?
Crypto to crypto key Cisco address is what?
It's 710, one one.
This is the concept.
It's not zero because they will only be creating it with whom they serve.
The keys will only be exchanged with the.
So then what do I need?
Do I need a transform set?
No, I don't need a transform set.
Do I need an ACL will be pushed down to me.
What do I need then?
Dynamic is the only multipoint VPN multipoint IP.
So everything?
Yeah.
Yes, everything will be pushed down to the profile, but I need to form that group.
Where will be?
Will it be pushed down?
It will be pushed down to crypto Gdoi Group it alcoholic.
The name does not matter.
The only thing that matters is identity number is 150 should match.
Let me show you that part.
So let's go to R2, for example.
Paste it here then server cuz my server.
It's not local, it's not local server has an address which is IPv4 ten.
That is exactly why you need reachability to the server.
Do I need to configure the server?
No, I just need to point to him.
Identity number is done.
My work here is done.
My work here is.
But you notice that it has not registered itself yet.
Why?
I need to apply it to an interface.
I need to apply this group to an interface.
Once I apply it to that interface, it will go and register itself.
Now, group cannot be directly applied to an interface.
It can only be applied through a crypto map.
It can only be applied through crypto map.
So I'll say crypto map I map ten of which type is not binding.
IPsec To escape it's binding.
And what is the group name?
IP.
Let me do this again.
The first nine packets in everything.
Not nine packets.
Now, this is a completely separate protocol, although it has the same policies.
It will not have those nine packets.
That's why it's called Gdoi.
It's not a scam.
It's not running on UDP 500.
It's a separate protocol, but it's an extension.
When I say extension, I mean to say it still uses the same policy, still uses the same, but in a
slightly different way.
And why did we.
By extension.
That's what I'm saying.
Extension.
Of Isfahan when we use the same parameters.
But the way it exchanges them is different.
There's an exchange that we're saying, no, not nine.
We'll see the exchange.
Right?
Crypto map.
Since I need to apply to the interface, I'll call it I map ten.
It is not Isakmp IPsec.
It's Gdoi Set group.
What is the name of the group?
It.
I'll go to the interface serial zero zero.
The outside interface.
Because I want encryption to be done on the outside interface.
As a crypto map.
Now see what's going to happen.
The moment I apply this map to the interface crypto map is going to be called in the crypto map, what
do I call?
It's going to go to the group.
On the group, it says Identity number is 150 and your server address IPv4 is ten 1111 dot.
The moment it sees that it's going to try to create a session.
With whom?
What session is a session?
The first tunnel, the control session.
And when it goes there, first of all, to create that session, he requires the same set of policies.
So the policy should match.
It requires the key, the pre-shared key.
The key should match.
Once all of that matches, it goes about and tells him, listen, my identity number is 150 and policies
are matching my identity.
Number is 150 and I'm pointing to ten, 1111 one.
What is the server going to do?
The server will check its group, set the identity number of the server address also matches.
So he pushes down the policies, the access list and the key doesn't listen.
These are the three parameters which you will need and gives it to R1, R2.
R2 will use it.
Then he has the ACL, he has the key.
He knows what mechanisms to use.
It's finished.
That's all you will have to do.
Let's try and see if this is working.
Start.
Registration.
Two.
Ten.
11.
Registration.
Two.
Ten.
11.
One is complete for group item using the address of 192 168 26.2 y 26.2 Because I applied the map to
I'm doing so the packet that was created when it went to create the tunnel was 190 2.1 68 dot 20 6.2
going to.
Using UDP
8482848.
You can have a look at it too, if you want to.
Number and identity number is encrypted.
This is your exchange.
Fun facts.
Is your exchange.
The first four packets look identical policies because the two packets look the same.
Right?
After that is the policy is being sent down the IPsec profile.
So it's not like your traditional IP cameras in traditional Cam IPsec is negotiated using the quick
mode here.
It won't be negotiated.
The negotiations only last until the fourth packet, but you apply the interface going down.
Going down.
Why did I apply going down?
Because I want encryption to happen when traffic is leaving from here.
Now how is hard to communicate?
It doesn't communicate.
It just sends the packet.
It just sends the packet from this interface to this interface.
Routing is done.
Routing is set right.
R1 goes knows this network.
The R1 has the network
find.
Yeah, that would be a problem if there was no routing if they were on the same network.
R1 Nos.
The network R1 nos in his table.
If you check your IPsec, if you check your routing table, our Nos 26 not directly through three.
Right.
It knows all of these networks so it can send packet to any interface R1 wants.
You can send it to this interface, this interface, this interface, this this.
Any one which you choose, it should be able to send.
This would be a problem on an RSA.
An RSA doesn't let packets come in like that.
So packet coming to the RSA is outside interface.
Going back is not allowed.
It's stuck.
RSA doesn't let return traffic come in.
Yes, they will not let it come back again.
Return traffic is not allowed on the AC for security purposes, but here it's fine.
You can come in like that.
Right?
The policies will be applied to this interface now.
You look at it?
Yeah.
That has no see, that has no correlation to anything.
When you apply to the interface, the packet will look like this.
It will not be encrypted.
This is not IPsec packets.
This is UDP packets.
192 168 dot 20 6.2 going to.
Will this not go?
It's UDP eight for eight.
That's that's exactly how the packet looks like.
That's supposed to go from the.
Why?
Queen consort Frederick.
Yeah, but the crypto map.
Where do you apply the crypto map?
That is the question.
You apply my crypto map here.
If you don't apply, then how do you form that negotiation between whom you see?
Wherever you apply the crypto map, that interface will go and register itself wherever you apply the
crypto map and you have to see where do you apply?
I will apply it here because I want encryption to happen.
When this guy wants to go out.
I cannot do it here.
Right?
Do not apply the crypto map here.
Then how does how to exchange policy?
It is also R1 R2 interface 26.2 is also R2 interface is in it.
Yeah.
R2 is interface.
So R2 is another interface is going.
It is still communicating to R2.
When the guy replies, he is replying to this interface, but this interface belongs to whom it still
belongs to R2.
Feeling it is because the crypto see, for example here, when you apply the crypto map, here he goes
and registers using which interface?
No, that's correct.
Exactly.
I mean that's that's the rule.
The whichever interface you apply, the crypto map to that interface will go and register itself with
the keys of whichever interface you apply the crypto map to find the words.
It doesn't have to find it's not you're not applying it globally.
You get VPN, you're not applying it globally.
If you have applied it globally, then it will check in his routing table, whichever is the closest
one.
So you're statically binding the crypto map here.
You're telling him this is the only part of you get VPN.
This interface should participate in get VPN.
Not this.
It has nothing to do with get VPN.
Do you understand?
How does R2 has to establish this second channel with with item?
Yeah.
If I apply the download now because routing is done.
This is see this is which interface 26 dot.
It is a downward interface.
Yes.
But interface still belongs to whom?
When he pushes down his policies, when he pushes down his policies, his policies are meant for which
interface the serial he doesn't want to push down.
He doesn't want to push down interfaces from 10.2 because 10.2 when it goes to 10.3, which interface
will it go down from this interface?
Whichever interface you are applying the crypto map on, remember when you apply crypto map somewhere,
then interesting traffic matters, then you're interesting traffic hits that interface encryption starts
to happen.
Right?
That's why I need to apply it here, because the access that will be pushed down, that will be pushed
down, should be applied to this interface so that when the interesting traffic hits this interface,
it will be.
It will go and register with this interface only.
The thing about get VPN is your full routing is done so you don't have to worry about that one.
As long as that one has the route to this network, it will go and register.
Right now.
The question is right now will our to be able to communicate to anybody else.
Ten, ten, three, three, three with the source of 10 to 2.
Communication of R2 is lost.
It's not able to communicate to everybody else.
So R1 it can because it's not protected.
If I use the source and try to go anywhere,
I will be able to because that won't be encrypted.
Yes, whatever you pushed down.
But now your internal networks, because these in real life would be your internal networks, all of
them will lose connectivity to everybody else.
Which you are not supposed to do.
Right.
Let's go ahead and go ahead and register our three.
Okay.
Them to fall back on.
You can do that.
But again, on the second cloud also.
They should be running on both of them.
You're doing load balancing between this and the cloud.
You have two links and you're doing load balancing between the clouds.
So are you using it as two separate links, two different IP addresses, but the same ISP, but two
different IP addresses on two different links, two different IPS at that time.
You will have to apply it on both.
On both?
Yes, you can.
You can.
Two different interfaces will attach themselves and register themselves separately because it's interface
based.
But if it's the same IP, then you just need to apply it
as a multi link.
What?
Only one if you're bundling it.
If you're bundling links together, then you just apply it to the bundle, not separately.
Yes.
Not individual links.
--.
Yeah.
It doesn't make any sense.
See, it's a layer three character crypto map is a layer three character.
So when you're applying it on an interface, you're applying it on layer three.
So if whichever thing has whatever has an IP address, whatever thing, whatever physical interface,
you can supply an IP address, even if it's a virtual interface, but you're giving it an IP address.
If it can be given an IP address, it can the map can be applied to that one IP will go and register
it as one IP, Right?
Back in between here you have a port channel.
No, no problems.
The port channel has one IP.
I'll go through that based on the IP.
Okay.
Now I'll go and register room R3.
What do I need to do?
What do I need to change on R3?
Do I need to change this?
This.
This?
Nothing.
I don't need to change anything.
The same characters.
You could change the group name if you want to.
Group number one.
Group number two.
Group number three.
But really, no need to.
Let's copy this.
Go to all of them.
R2 is already registered as registered R3 starting.
No, we have not talked about ESP yet.
In fact, it's the first package.
Yes, those were eight for eight.
Now, I have the key.
But I want you to understand this.
Check your first IPsec essay on R2.
I created it about five minutes ago.
So Crypto IPsec going from ten 0 to 10 zero will be encrypted.
Origin is ACL.
You have endpoints, right?
Remote endpoints.
You don't have any remote endpoint because it can be anything.
It's a multi point tunnel.
Local endpoint will be 192 one 6820 6.2.
But check this out.
What is the key?
What is the key length lifetime left?
2950.
If you go to the other one show Crypto IPsec and you use your show Crypto IPsec.
Although it was just created, this was just created, right?
The key is 2900.
Yes, same key.
The thing is we have to understand the same key that was pushed down five minutes ago to R2.
It has been pushed down.
To me, the key has not changed.
So now if you will go register for although the time event, not eventually the timer should be if you
register a new key, right.
The timer should be what, 3600 seconds.
But if you check show crypto IPsec it's also the same key, the same key on all of them.
So our five also register this only shows you what.
Show you that all of them now have the same key.
This is the only IPsec MultiPoint VPN outfit.
When I say IPsec MultiPoint, they're not creating a gap between them.
They're not even creating the second tunnel between them.
The second tunnel is being dictated by the key server.
Key server tells the group numbers Listen from here to here, encrypt from here to here.
Encrypt all of them.
Right now, if you check one, three, three, three going from ten, four, four four, we will encrypt
show crypto IPsec section gaps.
Encryption is taking place even if I go to $10.
What does that say?
What they say is already there.
The Keyserver is there.
All of them have the key.
Same key.
No, no, no, no.
Directly.
Whenever I send a packet to from 10.2 to 10.3, What?
The traffic will come here.
It'll get encrypted using the key.
Right.
Get encrypted.
It will have a public header, not a public header.
The outside header which will guide it to 10.3 for 10.3 to decrypt it requires the key.
Does it have the key?
Yes, it has the key.
It will decrypt it to receive the.
IPsec tunnels between between R2, R3, R4.
Is going on ESPN.
It uses the same esp if you verify if you want to verify, the second tunnel is exactly the same.
The second tunnel is exactly as it is.
No problems with that.
Check this out.
This is going clear text.
This is what?
Yes people.
Think about it.
Can you put it in transport?
So think about how the encryption is taking place.
From, let's say, our three to our five.
Your traffic, when you bring you're bringing from ten .3.3. going to.
What do you protect it using?
What is the outside header that you use?
192 or do you just use.
Another.
You don't need to use the private IP.
The 192 we can use.
You can use the transport.
Do you understand why?
Because.
Why do I not need the outside IP?
Because the routing is already done for me.
Get VPN routing is already done.
Earlier, I needed the outside IP because I couldn't route through the internet, so I needed the public
IP to take me across the internet here.
The inside and the outside headers are the same.
Inside.
You can see that in BioShock.
Also, when you open Wireshark, you see that your ESP packets.
So for a normal side to side, if I use a routing protocol instead of the default routing everything,
can I still use the transport?
If you use routing, you cannot use routing protocol then because you are connected you on the internet.
How you run routing on the internet for the lab.
For the lab, you can use the transport.
If you are running routing already, you could do that here.
See you check what this is.
What is your question again?
Like you have a site to site a normal a normal site to site VPN.
Yes.
We use the static default routing to encrypt to the one.
Yes.
We use a routing protocol there.
Can I use the transport?
So you have to understand that all depends on your set here.
What is your set here?
Because that will be your outside header.
That is the outside.
If it is the same as inside, you can't if you use the set as the loopback, you can write.
As long as you have reachability to the loopback, you can say set pair as the loopback.
Then if you have reachability in real life you wouldn't.
But you want to do it on the lab, right?
You will run routing after routing you will have reachability so you can set the site as blue-black.
So you'll go from shabtis.
But practically it's you don't use it side to side practically.
You wouldn't use it.
See what is the outside header?
10.3 to 10 dot.
It just copies the header from the inside and outside.
It's very easy for this guy to encrypt it.
Get VPN is the simplest one out there for the guy.
Whoever is encrypted for these routers, why, All he has to do is he gets a inside header, he has
the key, he uses the key to encrypt it, copies the header on the outside and forwards it on.
Routing is already done.
Everything is already set.
You want to use the transport mode.
All you need to do is change it on the key server.
I'll say crypto IPsec transform set te set DSP esp three days, DSP edgemoor.
I'll say mode is.
But yes, when you do that you need to make sure that all of them reregistered themselves.
How do you do that?
The command is clear.
Crypto GDI.
Yes.
Player crypto.
Right.
So you.
Now, if you check, they're already registered.
I'll send the same thing again from R3 to R5.
So my advice to.
Yes.
I said the same thing.
The size was 156 before.
Let's exercise now.
It's still 150.
Has it moved So crypto IPsec se the more digital tunnel it has not moved.
I need to yes I need to clear it from the group on the server also gdoi.
I need to clear it from the server.
IPsec.
I see.
Campus.
Where in where?
Yeah.
I will be here.
I told you, it's an extension of the same thing.
Right.
If you check.
But it will not be idle.
We don't call it idle.
It's called.
It's not the same.
The first control plane tunnel.
It is the control plane tunnel.
Right.
The ten packet exchange.
Since two different tunnels are being created, it is getting transferred.
That is called.
What?
Not your normal escape tunnel is a tunnel.
Right.
Let's reregister again.
Our three.
Right.
So what do we see more transport now is.
Now let's bring again.
And check the size.
The size is 140, which is which is not right.
Right.
We figured this out last time is 20 is four byte IP.
This IP header should be 20 bytes.
Should be 20 bytes.
20 bytes should have been required.
But that's okay.
I mean, you understand that transcode mode is reducing the overhead in your packets?
Correct.
Any questions?
Until now.
So here is the protocol used for replicating.
Yes.
This is for replication policy to be replicating the policy.
What do you mean by replicating?
Pushing down the policy that is done by the group is the key.
The whole protocol.
See, it's a different protocol.
It's not like I say, can I say you need to do everything on both sides?
Here you do everything on the server?
Yes.
As a protocol does that.
What happens between R1 and between R1 and R2?
Yeah.
Let's have a look at that.
See between R1 and R2, let's say, when it's coming and registering itself.
Right.
R2 is the one who will send the request and the request will be all camp policies, right?
First packet r4 R1 will reply back with his policies.
The set of policies.
By the way, I forgot to show you this.
The small issue with this is if you open it, you're not able to see anything from the first packet
onwards.
It's not just it was visible, right?
Policies and all of those things I would is hard to send something to because it's not applied to that.
It is applied to which interface for you to send the policy.
So it should be applied to the Ethernet interface of R2.
Right?
Not this interface doesn't go, this interface goes and registers to itself.
The other interface doesn't go registered.
I'm telling you, it's not R2 as R2 going.
You've applied it to this interface.
So this interface is going.
Right.
So again, 192, 168 whatever, dot, whatever.
If we check right now, who's going 192 168 .26.2 is going ten 1111 R2 is not going.
Right.
So when it goes up, what does it say?
It says, I have these policies, I have this set of policies and we have a normal side to side between
R1, R2.
And can I apply this to some map so we can do another loopback crypto map.
You apply to the loopback depending upon your set pair condition will go.
Yes you can.
It would still work.
It doesn't have to, but that will be a problem because you'll be encrypting from this side.
You will not be encrypting from this side.
You will not be facing each other.
Right.
That's the same problem we have here.
It's not encryption.
See, the problem with that?
The one which you are talking about is you have to.
Right.
You need to apply it here because encryption should be this way.
Encryption should be this way.
That's why you apply it on that side.
You can apply it this way.
The problem is you'll be encrypting from this side, encrypting from this side.
We will decrypt this traffic.
Here.
The problem is that encryption should be this way, but your issue is on the opposite direction.
And now am I applying anywhere in Auburn?
Am I applying to the Internet in the IRA and I don't apply it anywhere in R1.
I just keep h48 open so that it responds to the request.
I don't apply to any interface.
And how does it work?
It knows that the request should come to.
If a request comes to ten 1121 add code number 848 it will reply I showed you the port.
848 is open, right.
So if a request comes to 848 destined to the address of 1011 which you specified in the server address,
it will reply.
The moment you talk it in three or 4 or 5, it will they will send the request.
Or should I send an interesting.
No, no, you don't have to.
The moment you apply the crypto map to an interface, it goes and registers itself to the case.
What is what it is doing right now?
Right.
So it goes with its policies, right?
What does the server respond with this set of policies that he's choosing?
So you can set 20 policies here.
Out of that, only the server side will choose the one which has the highest priority.
So we'll come back.
Then the will be exchanged between the two.
If it is the first guy, if it is the first device which is registering the session key that will be
created will be used as the session key for everybody else.
Yes.
The first guy who registered.
So they register themselves.
They save the session key between our two and ours.
That's what I'm showing you.
I see.
Camel, this is Cam.
Packet number three and four are exchanging right.
At the end of the day, the keying material is saved.
Where?
On R1 and plus, it also saves a little bit of it because it needs to protect this tunnel first.
And this to say protect this tunnel first.
Remember, the key material is different points.
One part is used to protect the tunnel.
One part is used to protect the IPsec Tunnel.
Those key sets are known as Adi.
There are different names for that also, but not really important for you guys right now.
What it's important is it protects that tunnel.
Once that is protected, then the key server, then this client will go to this key server and tell
him what my identity number is.
150 Please give me everything that you have for 150.
The server sees the identity number checks the IPsec, which corresponds to that identity number, pushes
it down, pushes down.
The ACL is basically pushing down the transform set and the ACL Back to whom?
Back to what?
Sorry.
Before that happens, the Pre-shared key is also used in the fifth and the sixth packet.
The Pre-shared key is also exchanged.
Then earlier in the seventh, eighth, ninth packet, what used to happen quick mode instead of quick
mode happening, I send the identity number.
He sends me downward all the policies that are supposed to be sent down.
R2 and R1, the first control traffic tunnel.
Yeah,
he was not participating in anything, just routing.
So it wouldn't have it will not have an AC.
It is just routing.
Just routing, right.
USA is you have to understand that your tunnel is complete between R2 and R1, but based on which interface
this interface from the other end, there is no problem because the interface that is registering is
also the one which is encrypting and it is also the one which is facing R1.
So they will do the same thing.
Pre-shared key after Pre-shared key instead of quick mode is easy mode.
What do you mean by that?
The policies will not be exchanged.
It will be sent down.
The only thing that will be exchanged is the identity number.
I'll tell him the identity number exchanges won't know.
It will be from packet number four onwards.
It doesn't have any other side.
It has an essay From this end.
Write encryption happens on which layer in cam less seven.
Okay.
It doesn't happen on the on the IP header.
The IP header will still be as it is UDP 848 will still be as it is.
Encryption in ice cap happens where in the actual data.
So that has nothing to do with this which interface you're using, which they have.
No, no.
Every one hour now you'll see I have to show you another command on the key group members.
It's known as show cryptography.
So crypto shows you everything.
What?
Everything.
What was downloaded?
Who is your group server?
Right.
How many keys?
Three keys means the new keys have you received until now?
The identity number is 150.
Also your de-registering yourself in.
Your key.
The key.
Time left is 2987.
You are reregistering yourself in 2948 5% less than the key expiry.
So when you have 5% of the time left on the key to expire, the group members will go and register themselves
again, get the new key and all of them will do this at the same time.
That is the beauty of it.
It keeps the advantage.
Yes.
On these seven noted that it would use what the key the key will get.
See, the key key has a time thousand 600 seconds the moment it receives the key.
The timer keeps on going down right the moment the timer goes to.
How much is the time difference between the 248 and 87?
That is 55, six, 37, 38, 39 seconds.
Right now it's 39 seconds before 10s, before 39 seconds of the key expiring.
It will go back, register itself again, get the new key of 30/602, but it won't use it until it.
No, no, no.
It'll use replace it it replace the old one He replace the old one with the new one.
This key that we are talking about right now, the session key in get VPN is known as tech traffic encryption
key.
Remember this term traffic encryption key will need this.
What?
Traffic encryption.
The IPsec is known as Typekit traffic encryption.
Right.
So all the group members will receive the key and they'll start working with it.
The good thing is it's very easy on the group members.
They don't need to do much register to get the key and start encrypting, register, get the key and
start encrypting.
They don't think much.
Good enough.
Let's go through it.
S sip server Local sip ten.
No.
Sorry.
As they receive only.
Profile of match.
Showed on section.
The essay is only receive only.
This is receive only.
Right.
Let me go back here.
You'll see some other stuff here which you have not configured.
These are default values.
We'll talk about it tomorrow.
Yeah.
You should be pushed down.
I have to specify what to push down, but when you're pushing it down, only apply it in one direction.
Right?
Clear?
Yes.
Go back to all the Scopes and group members, not the scopes.
So register.
Registration is complete, right?
What I'll do is I'll go to the other ones.
Interface 000.
No crypto map imap.
I'll remove the map.
So three has no encryption happening.
R2 is already registered.
I is registered, right?
R3 is not.
No, IPsec is here.
So if I go to R2, so crypto IPsec direction is inbound.
If I ping ten .3.3.3.
I can think of three is not encrypting.
R3 has no key, but I can still go from here to the other side.
So that's what you usually do.
Now, if you see your whole when you're doing it, everybody has not registered themselves.
They have not registered themselves.
So when you register one, it will lose connectivity to the others.
To do that, to stop that from happening, you use receive only only in inbound direction.
You'll apply get VPN to all of them.
So when you apply it to this guy, he will still have connectivity to the others.
We'll do it on all the group members one by one.
Once everybody has got the key, you'll go back there, remove the receive only register them again.
All right, let's do that first.
I'll clear it on all of them.
So, crypto guy.
Of the interface serial zero zero crypto map and map R4.
Claire Crypto Show Crypto inbound only.
Not only right now, when you have done it, when everybody is in inbound only direction, you go back
to your server crypto group, it's server local A receive only.
You just do not receive.
Then go to this guy.
Clear crypto IPsec Sorry, Layer Crypto.
The good thing about this is when it registers itself again, it can still talk to.
Why?
Because this side is encrypted.
But the other side has inbound.
That means he can decrypt.
Right?
This is for migration.
So I am encrypting the other side can decrypt because it has the IPsec applied in the inbound direction.
So I'm not losing connectivity for even for a very small amount of time.
The only amount of time when it goes and registers itself, which is some seconds.
Then register themselves again.
And now your connectivity is still there.
Is it clear?
Get VPN with single hub.
There is still a lot in here, but if this part will be clear again, you have a full weekend to practice
your DM and get.
I would suggest you do that because next week is going to be how do I say this?
You have easy VPN in there, you have a server in there and you have great VPN.
So one of the most what do you call it?
You have to do a lot of hard work next week.
You have to work a lot for that.
You have to again, I say this every time for this, you have to finish your whatever we have done until
now on this weekend.
I say this out of ten only to follow.
And you see on Monday.
Today how many people.
12.
Right.
We'll go down to eight.
I think it's just prediction.
Not really sure.
Yeah, earlier it was 21.
Now it's down to 11.
No, 12.
You need to go back.
So.