Right.
So.
Our objective is the first objective obviously is end to end connectivity, which as you can see as
per the diagram.
If you go to any of the routers and you do a show IP route, you should be able to see all the networks
in there.
Eight end to end connectivity.
Private connectivity is there.
So I can go to ten .1., which is me.
I should be able to go to 2.2.
Obviously the route is here.
If the network is here, I can go to all of these networks.
Right.
The question is it's going through the service provider.
I need to make sure that the service provider does not sniff.
On the packets that I'm sending through.
What is the solution?
How do I do it using get VPN?
Right.
We did it last time.
We'll do it again.
And the extra thing that I'm going to do today is I'm going to make R7 as a backup server.
I'm going to keep a secondary server which will help the primary server and make sure if the primary
goes down, it comes back and becomes the primary.
Also, we're going to talk about the other type of key.
Last time we only talked about the tech.
We're also going to talk about the new key, which is the key, key.
And how does it work?
Until now.
How did you see the registrations taking place?
We saw that the group members, which are these guys?
Have a time.
Right for the key.
That's 3600 seconds.
5% of the time, less than that, they would go and reregister themselves again and get the new key.
They would go using their own same old protocol.
They would just go up and reregister themselves.
The server would give them a new key.
Okay, let's let's configure it until that part and then let's see what we can add on that.
Let's go to our one.
Sorry, R1 is not the key server.
R6 is.
So what are the commands?
First of all, I can policy.
Encryption three The authentication feature.
Assembly five group.
The A camp key.
Address.
I bet if you had to be more specific, you could specify an address.
But that address would be Which address?
R1 serial interface.
The address when you specifying from R1 will not be the interface which is pointing to it now.
It will be the interface where you apply the crypto map.
That will be this part.
Because the connection will be created from R6 to that interface.
The one which is trying to create the encryption.
The one which is trying to encrypt and decrypt the data.
That'll be the source that will be used.
Okay, We'll see this again later.
Let's also.
Grandma shark is.
Keep it the.
Now two steps down.
What else did I need?
Out of the quiet transform set.
Crypto IPsec transform set to set esp three days esp.
I would need to because I need to push this down along with an ACL.
So I'll say ten 000 going to ten 000.
AP.
Finally to push both of these down.
I push it as a profile.
I set transform.
Set.
So the profile is ready to be pushed down.
The ACL is ready to be pushed down.
I just need to form that group to push it down.
So crypto.
Call it anything.
This is just local, right?
Usually you would call the whole group the same thing.
Most of the times.
So I could say this is the IT department or the sales department.
Sales seven.
The important part is identity.
Now you can also have identity address.
Like before.
So all should point to the same address.
But usually most of the times you would not use that.
You would always use a number which is 150.
Then you need to specify the server.
Is it local?
Yes, it is.
We'll go into the sub configuration mode where you can specify the parameters of the server.
The most important is the address.
Which address are people going to come in and register?
Brass.
1066.
66.
Start.
Also need to configure the last part, which is.
Security Association, which will be pushed down to people who have the same identity number.
So say IPsec.
Just a number ten.
Then match address, IPv4 101.
Profile is called I.
Need to push these two things down.
That's it.
On the server.
I don't configure it.
I don't put it on any interface.
I just need to make sure that.
848 is on.
That it can respond to the requests coming into the port.
UDP 848.
Right.
How do I create those requests?
I'll go to R1, which is my first.
My first.
What?
My first group member.
The this part is the same.
Tiptoe.
Eyecam key.
Cisco address is what?
1066 66 starts because that's where I'm going to create my UDP tunnel.
Then crypto group again.
Sales.
Identity number should match 150.
Server address.
IPv4 1066 60 6.6 Making sure before you do this that you have reachability to.
1066.
66.
Before you go further.
Right.
Then because this is a group I need to apply to an interface.
How do I apply it to an interface using a map?
So I need to bind this to a crypto map.
So I'll say crypto map I map then this is of which kind.
In here.
I'll just call the group.
Set group.
I didn't know.
What was it called?
Sales.
And then I apply this crypto map to the interface.
So I'll say interface serial zero zero crypto map.
Start registration.
Registration complete.
Right.
Show crypto will show me.
What group am I a part of?
What is the server that I'm registering to?
What is the ACL?
That was pushed down to me.
Right.
And your your traffic encryption key is inbound and outbound.
Your lifetime is right here.
And you transform set Anti-replay is disabled right now.
I'll show you how to enable it later.
Right now I will not be able to go to from here obviously, but from source then not one cannot go.
Why?
Because I am encrypted on the other side.
The other guy does not have the key to decrypt this.
The best part.
As you can.
Copy paste.
You didn't do it on all three.
You can also do it on Earth.
Did I not apply it to the interface?
Oh, I did not.
I need to do that in the face.
Serial zero zero Crypto map and map.
Get.
So.
Again.
Interface zero zero Crypto map.
Done.
So the decision is complete for all of them.
So crypto.
DUI.
Nothing to verify.
I'll send things to all of them.
Communicate to our four.
I can communicate to our three.
I can also communicate to.
This is what we did last time.
So crypto IPsec RSA Section gaps.
Same tunnel, right?
One tunnel.
Doesn't matter.
Where am I going?
As long as I have the source and destination as 10.0, I will be encrypting that.
And if the packet is coming with the source of ten and coming to ten, I'll be decrypting that.
Right.
So all that information is where the piece.
Going from ten.
Coming to ten does not matter.
I'll encrypt or decrypt that part.
Now the good thing about this is so crypto guy.
Also one thing to note from last time we saw that this key will be the same on all of them.
So you'll see the timers will match.
This was 27 milliseconds later, this became 13 and even on the first guy.
So crypto you'll see that the key should always be almost around the same.
It is the same.
This is the time it takes for me to shift.
Mate.
So same key on all of them.
A quick recap of how the process takes place.
Is.
I have the server here.
And I have the clients.
The client goes up and registers to him using all the policies and everything.
Instead of the quick mode, though, you have something else here where everybody pushes, everything
is pushed down from the server.
So in quick mode there is negotiations happening for the transform set.
Here there is no negotiation, no ACL, right?
All of this will be pushed down from there, from the server to the client.
It will be installed on the client.
Based on the identity number.
The identity number should match the moment.
It gives you that.
After that, it's supposed to push down a key.
Now, that key is the key that is negotiated between the first and the second peer.
So once the first guy registers itself, the server has something known as.
The t d k traffic encryption key.
Now, it's not just one small key.
It's a big chunk.
Out of that, he keeps on taking small chunks every 3600.
Tickets.
This management of keys is done.
By whom?
The server.
The clients don't know anything about anything.
The client just create an escape tunnel with the server.
The server pushes down the key to the.
Now for the first case, he'll give out this chunk.
So I won.
Then what happens is whatever traffic is coming from R1 cannot reach anywhere else.
Why?
Because it will be encrypted and the other ones are other edges are not partners, are not group members
yet, so they're not able to receive that packet.
What did I do to do that?
I went to R2.
I registered R2 again.
I resisted R2 again.
So what happened was the server gave out the same key which gave out to R1 and gave out the same key
to.
At the end of which R1 and R2 have the same key.
Symmetrical key.
Same key.
Remember this?
It does do the but to protect the isochem.
To protect because he's going to send him the key.
Right.
The key server is going to send him the key.
He sent ya after first packet.
It sends him the key.
Colonize.
Just you noise.
It is a part of Isochem because it works the same principle policies.
Because you still love show crypto camp shows you are idle, but it's still Isaac Campus.
Okay.
Any questions?
The which one?
Now, see, first time when you negotiate between these two, the negotiate.
Right.
The edge protects.
The edge Has I told you three variations?
The first one is used to protect the first tunnel.
Isaac.
The second one is used to protect the quick.
After the camp.
The third variation is used for your actual session.
The edge has many.
It's not one, only one key.
It's.
I told you a keying material right out of that.
Yeah.
These are behind.
What happens is so these are these are known as set of keys.
These are called I think one is called a one is called D, one is called E.
The sets of keys used to protect the ice.
Part D is used to protect something like that.
I might have missed the words here, but it's somewhere around the same part.
Set of keys.
Right.
So we will protect the simulator.
The same thing happens when your ice cap takes place.
Between whom?
Between R6 and R1.
So when they are negotiating, the first part will be used to protect the escape tunnel for the exchanges.
Right.
Pre-shared key.
And all those things are also protected.
Also, once they negotiate on that, this third part of the key, the one which will be used as the
session key, your traffic encryption key is generated.
Right.
Is generated on R6.
The first guy receives it.
The first guy uses the same, but because it's GDI.
So the way it works is R6 directs that this is the key which you're using.
The whole mechanism.
The exchange is protected.
By whom?
The.
A different variation of the same dish.
Now, once he gets it, what happens with the second guy?
When I create the tunnel with, for example, R3.
What happens then?
It has its own variation of.
But this, the one which they negotiate between themselves, will not be used for anything else.
Rather than protecting only this tunnel.
This edge will protect this tunnel.
The tunnel through which your key will be sent.
This key is which one?
The one which was negotiated with the first guy.
The session key with the first guy.
Yes.
Session key and the tech traffic encryption key are the same.
So through this, the PH between them will only be used to protect the to protect this exchange.
But the that will be used, the one which was negotiated with the first payer.
Big.
They'll be pushed down.
But this is quite dangerous.
This is considered to be quite dangerous.
Why?
Because when your camp is protecting the tunnel, it's only protecting the tunnel At layer seven, it's
doing a little bit of encryption on layer seven, so you cannot see inside the packet.
It's not like IPsec, which protects you from layer three onwards.
It is safe.
I'm not saying it's not safe, but still, I mean, layer seven protection, it's not as good as layer
three protection.
Okay.
So for that, what have we done?
We haven't get VPN has a different variation, we call it.
K e.
K.
Instilled in only leurs.
Seven.
He.
The encrypted part is which one?
I might have an exchange here.
See, this is your VPN, right?
Ledford is visible to you.
There she is.
Visible to you.
Layer to layer one is visible to you.
But if you go to layer seven.
What do you see?
Encryption.
ESP.
Yeah.
ESP from here onwards, you don't see anything.
It's not visible to you.
In Isaac camp until layer seven, you can see, then you can open the packet at layer seven.
But inside there you won't be able to see because it's encrypted.
The data in layer seven is encrypted.
Okay.
This part.
So that's why what we have done is there's another protocol in the same variation of get VPN.
There you push down another key known as the key encryption key.
Now, this is a little different.
Then your normal process.
Why?
Because now what we'll do is we'll generate a pair of asymmetrical RSA keys.
Of at least 1024 bits.
Now you all know how important asymmetrical keying is.
It's secure.
I showed you last time that video of how difficult it is to break 2048 keys 1024 is still very, very,
very good in terms of encryption.
So what they have done, they said, okay, since this exchange is a little different, difficult.
Right.
You're pushing down through the ice cap.
Using the material.
And anyone can just, you know, because it's layer seven, anyone can just spy on it.
Although it hasn't been, but it's a little dangerous.
So what they've done is they said, okay.
While the first is exchanging between R6 and R1, the first the first time it's happening.
When he's sending down the symmetrical key, he will not it will not send down the.
The tea will not be sent out.
Instead of that.
What he's going to do is he's going to send down first of all, he's going to create a set of private
and public keys.
Private.
And public.
So a set of private and public keys is going to be generated.
Where?
On our six.
When the exchange is being done through the first tunnel, it's going to send down.
What?
The public key.
Throughout.
Now R1 has the public.
It does not have the traffic encryption key.
It has the public key.
This public key will not be used for encryption at all.
This is your wish.
Key.
Key K.
This is your key encryption.
Okay.
What do you think this will be used for?
Decrypting, encrypting the packets.
Exactly.
I do need to send the tech.
I still do need to send because the actual encryption decryption will be done.
With what?
But now be careful here.
When I'm sending down the TC.
I will encrypt it.
Using what?
The private key.
I will encrypt as a separate.
Now, this is going to be a separate tunnel.
This is known as Qi Qi.
This time a separate tunnel will be created.
Through this tunnel.
I will encrypt it using the private key.
It will go to the other side.
Will I be able to decrypt this?
He has the public key.
He will decrypt it to get the same black material.
Private.
With public.
Public with private.
Runs both ways.
We encrypt using one half, you can decrypt using the other.
There is no excuse for.
There is no.
Exchange.
Ivan receives one key, then he receives another key.
Uses the first key to solve the other key.
Gets the actual.
You have to understand your job here is to do nothing is just to receive this black key.
Now, earlier we used to receive it through the first tunnel, which was well and good.
Now what we are doing is we are receiving it as a separate tunnel.
It is protected using a private key, and I'm receiving it as the private key, but I'm decrypting it
using the public to get the same key, the same key that I'll be using.
Is it clear?
Yes.
Now will be received through a different.
First the first time the game takes place, the key is created through this.
Also, the public key is sent.
For the k k.
The public key is sent to me.
Once I received that public key.
Now I have it.
Now, when he sends the packet, he will send it as what?
Encrypted.
Using the private key.
He will just send one key.
That's all he'll do.
It will just send one encrypted using the private key.
It will come down to me.
Encrypt it.
Anybody?
Everybody.
Whoever comes in, in the middle tries to see it will not be able to get in there.
It's 1024 bit encryption.
If you want, you can take it to 2048.
Which I think will be too much.
Right for our case.
1024 is more than enough.
Right.
And you're not just protecting yourself from the service provider.
So encrypt it and you will decrypt it using your public key.
Any questions?
The same.
Simulated.
Same.
It's called Gdoi.
Key exchange.
We'll see it.
Let's see the exchange.
Kid.
All of them.
Yeah.
Okay.
Who can decrypt it.
That's the thing.
The public key is sent at the end of what?
Your camp exchange.
For that.
Your identity number should match your Pre-shared key should match.
Your policies should match.
Once all of that matches at the end of the exchange, it sends the public key.
If you don't have that, you can't create that exchange, right?
Look, it was a good question, but do you understand?
What if you don't have those parameters, you won't be able to create that tunnel.
If you're not able to create that tunnel, you won't receive the public.
Any more questions?
Let's see this.
Let's configure it and see.
Let's go to R6.
The way you the first thing that you have to do is crypto key generate RSA modulus 1024.
I'll label them.
As get keys also.
I'm going to make them exportable.
I'll explain why later.
I'm going to make them exportable.
Remember this?
Okay.
Now I'll go back to crypto group.
What was it called?
Sales s.
I'll go back to serve Rogue Local.
Here.
I've used essay.
I've used a dress.
I can now.
For k k, I'll be configuring.
What key?
Kaga is known as Reki, so I'll say Reki.
Now you have certain options available to you.
We'll configure all of them and we'll make sure that we understand each one of them.
First of all, you have to address now this rekeying can be done two ways.
When I say Ricky, I'm also talking about the every 30/602.
The key is going to be sent again.
Right.
That is also known as Ricky.
Now, that will also be done not from the first tunnel, but from the second tunnel.
From the public and private key.
Now, this key.
There are two ways of doing it.
One, the server sends it to a multicast.
Sends it to a multicast address.
What is the what is the what is the good part about that is at the same time, all of the peers will
receive the key.
Because all of them will be part of the same multicast group.
So when it sends out a multicast.
Sends out the key to the multicast address, all of them will receive it.
The only one bad thing about it is there is no acknowledgement.
So the server has no way of knowing if the clients received it or not.
If the client doesn't receive it, it will come and reregister itself again.
Which is okay, but not efficient.
If you have a lot of spokes.
Then this is good because one shot, all of them get refreshed.
If you have a smaller environment, although what you will do is unicast where it will individually
go to each of them.
And send them a Reiki on their address.
The one address which they have registered with.
So two ways multicast and unicast.
We'll be working with Unicast right now.
So when you have multicast, you specify that address here.
In an access list.
No, no.
You can use any, any that you use from here.
Anything after 224, any address, everybody will come up and register to that address for the multicast.
By default, it is multicast.
Right now I'm going to use what unicast.
I need to change that using key.
Transport.
And you say transport should be done using.
My should be sent down using unicast.
By default, it uses multicast, so you have to specify that address.
Now I change it to.
To done.
What else do I have?
Ricky.
Authentication.
Rekey authentication.
Now.
What?
Are you using a key from outside or are you using a local key?
I'm using a local key.
So my pub key.
RSA.
What is the name of that key?
Get.
This is my key.
Kay.
I'm specifying it that the key that I want to use is get keys.
Okay.
What else do I need?
Algorithm, you can specify which algorithm do you want to use?
I'll leave it as default.
Lifetime.
Lifetime is important.
By default, the lifetime of a key is 86,400 seconds.
By default.
Cisco recommends that this key should be.
Three times your.
How much is the.
30/602.
Three times it would be.
How much?
10,800 seconds.
10,000.
Cisco recommends that.
Why?
What is this lifetime?
This lifetime is.
Now, see, by default, it's 86,400 seconds.
Do you remember your camp?
Yes.
What is the lifetime of that?
86,400 seconds.
So basically what he's saying is every 86,400 seconds since this will be recreated again.
Along the same time, you'll get the public key again, right?
So your other tunnel will also be refreshed.
Both of them.
Cisco recommends you should change it to 86 three times your.
Villages is 110 800.
Why?
Because you'll be receiving the tech through the same tunnel.
You will receive it once you receive it twice.
You receive it the third time.
Then it asks you to get the public key again.
So at that time the R6 will send back the public key again to R1 through the first.
The public.
The cake is sent again.
So next time when you send the tech, it'll be encrypted again and again and again.
The good thing about this is all the group members will get it.
At the same time.
That's the best part about this synchronization is they're all the group members come up and register
themselves again.
So that's why when you specify this lifetime, you can specify it in 300 seconds.
I'll do it 300, because I want to show you the key process.
Now, when you do it less than you, it does show some problems.
Should not be less than the obviously.
What do I mean by that?
He has 3600 seconds, so you're still valid, but you're going to get your public key again and again
and again and again, which makes no sense because your tech will come after 3600 seconds.
The traffic encryption key will come after 3600 seconds.
So in this case, you will see some problems.
You will see a lot of inbound outbound essays because you'll have the older key and you'll be getting
a new key.
You'll be getting it again.
You'll be going up and down, up and down.
Not recommended, but just to show you the process, I'll keep it as 300.
Okay.
Save it, then, Ricky.
What else do I need?
Authentication is done.
Retransmit.
Retransmit means once I send the key, if I don't receive the acknowledgement.
Do I transmit it again?
I say yes every if.
Wait for 10s.
You don't get the acknowledgement, send it again.
Then he says, okay, how many times do you want me to try sending the key?
By default, it's two.
I'll keep it.
Take it to three.
So if you don't get a response, send the key back again after 10s.
Do this three times.
If this doesn't happen, then stop it.
The group member may be down.
Right?
So crypto show run.
Section crypto.
That's all I need to do.
For unicast.
There is multicast.
There is.
All is configured.
Now, the good thing about get VPN also is when you do your show running configuration, if something
is missing, it will show you here you have not configured this part or that part or this is missing
or that is missing Right now, everything seems okay.
So let's go to our one clear crypto guy and say, yes, we'll go and register itself again.
Everything is fine, but you also have what?
Group sales transitioned toward unicast.
So crypto.
I have my tech, which is fine.
I also have.
What?
I also have a.
Unicast.
It is.
And he doesn't want you to.
I'll explain.
The second tunnel.
I told you, it comes down through a second tunnel.
Right through a second tunnel.
The second tunnel.
Is also encrypted.
You are sending the TC along?
Yes, the TC is.
The data is encrypted using the public key.
But you're sending it through a tunnel, right?
This tunnel, in turn, is also protected.
Using an algorithm which you choose.
I left it at default.
So the algorithm that was chosen was what?
Three days.
192.
You can change that because these are two different tunnels now.
There's one for Isaac.
There's another one for this.
You can see it using show crypto.
I said camp.
So you have a guy idle which is using your three days and MD5.
Then you have your key, which is using the default three days and 192.
Like two different tunnels.
This tunnel lifetime is how much?
Don't think if it shows you that.
No, it doesn't show the lifetime of this key.
The second one, c three doesn't show.
It's a separate tunnel.
So crypto I can see the lifetime here is only 300 seconds.
So you will see after 300 seconds a separate tunnel will come.
A separate tunnel with the public key that you'll be sending will be the same.
Remember, you will still be sending the same public key.
What is going to be different between these two tunnels?
Why do I send it again if I'm sending the same public again?
What is not the key.
But.
When I'm sending it for the first time.
I'm sending it through this tunnel.
Right.
It's encrypted.
The second tunnel.
Is encrypted again.
The difference doesn't come in the public.
The difference comes in this encryption.
The key.
This is.
Ricky.
This is the first leaky tunnel.
This is the second tricky tunnel.
I told you this right now it's using the default three days and.
Sir.
She doesn't.
What is it?
Which key does it use to protect this tunnel?
Your key.
The key between R1 and R6.
No, this is I'm talking about the second time.
This is the tunnel, not the tunnel.
Let me explain.
There are two types of tunnels that will be exchanged between R1 and R6.
The first tunnel.
Is going to be a normal idol.
Through which Ricerca will be solved at the end of which you will have a session key.
The thing is, that session I won't be using for anything.
I will only be using it for protecting.
First of all, this tunnel.
Protecting this tunnel.
Plus, I will also be using it to protect the second tunnel.
The the the.
With.
No.
We will only be used for encryption of data.
We are protecting the exchange using the.
Your own your own variation or not the key.
Not the actual T.K..
The T.K. will stay with the server.
See, when you negotiate R1 and R6 when you're negotiating, you will have a session key also.
Right.
Both of the sides have a session key.
The part of the session key is kept by the server.
It is with him also, but he doesn't use it.
It's kept by the server.
It's not pushed down.
Right.
Then the remaining part of the what I'll do with it is first of all, I'll protect my camp, which is
done already.
Then I'll use some of it to protect the other part of the tunnel.
The other tunnel which is coming later.
The second tunnel that is coming.
What is coming through that second tunnel might not the public key public key have already received
from here?
In the first.
In the first tunnel.
I've already received the public.
Right.
I'll explain it slowly, real slow and real realize.
Right.
The full process between R6 and R1.
First thing that happens is.
They start negotiating.
In the first tunnel.
Which tunnel is this?
Oilton where policies are exchanged then is exchanged by the end of this.
Both of the sides have.
By the end of this exchange, not full exchange.
By the end of the third and the fourth packet they have there.
Then they'll use this to protect this tunnel.
Correct?
Protect this tunnel.
And then they will negotiate.
On what?
On the policies which will be pushed down from the server to the client.
Also along the same time what will be pushed down.
The public key will flow.
To this side.
So now one has two things.
One, he has his own material, not the tech.
This is not the tech.
The tech is with whom?
It's still with server.
The this black material is still with the.
The actual encryption.
You have a small variation of PH, which you negotiated with R1, plus you have the public key, correct
or not?
Any doubts here?
Definitely the capability.
Right now, it's not encrypted.
It's open free.
The public key is open.
Yes, That part.
Yes.
It's the tunnel.
The public is also the seventh part.
It is encrypted at that part.
Correct.
You're right.
Right now.
To send down this key.
What the server does, it creates another tunnel.
It creates.
It creates a new kind of a tunnel.
This tunnel, first of all, is encrypted.
It is encrypted using word that is the question, right?
It is encrypted using the between R1 and R6.
The material that is left, it will use that to encrypt this part and this side will use it to decrypt
that part.
The material that is left.
R1 has only two resources.
The public key and the material.
That material it will use to encrypt and decrypt this.
Correct.
Now, this tunnel is also protected.
What policies do you use here?
That depends on what you have specified on R6 already.
I left it at default.
So right now it's three days and.
When it is.
I mean, where do we use this to protect the sun?
The key using which algorithm.
Three days and shuffle the material using which algorithm.
These two algorithms.
Right.
What do you need for encryption?
What kind of algorithm are you using?
And the key.
You have both.
Yes, yes, yes.
No, here.
It's not right now.
I'm not talking about asymmetrical at all.
The edge is the exchange is symmetrical.
Finally, the key is symmetrical.
Remember, the exchange is asymmetrical, but the final key, which you use for encryption decryption
is symmetrical.
Right now it's symmetrical.
Both of them have the same brown key.
Both of the sides have the same brown key, right?
Okay, Now what is going to happen is the only one thing happens through this.
What?
He's going to send me this black key.
He could have just sent it to me as it is, but that would be the same as before sending it through
the tunnel.
It's not going to do that.
What is the server going to do?
It's going to encrypt this.
Using the private key.
Double encryption.
That's the thing.
Double encryption.
Once it's going to encrypt it using the private key, then send it across the tunnel where it is going
to be encrypted using the tunnel.
Which is using the edge.
It reaches the other side.
As encrypted.
The other side already has.
What?
The private key.
It uses that private key to decrypt this to finally find out.
It has a public uses the public key to decrypt this part again to get what?
So.
To get the actual.
Session.
You are the.
To get the actual.
So this traffic is protected two times.
One using the PH, which is negotiated between R1 and R6.
Second by the public and the private.
Is this clear?
Clear.
Now, I'll ask you if this is clear.
I'll ask you some stuff.
Okay.
I understand.
Between R1 and R6.
Let's say R1 R6 exchange is done.
R6 has the key already.
We have negotiated.
R6 has the key.
They have their own set of keys.
The R6 keeps the.
Tell me, how is the exchange going to happen between R2 and R6?
First of all.
I seek.
The first iSight camera.
Who that negotiating on what?
--.
Remember?
The edge here.
My team will not be touched.
The.
Exchange policies and everything else eventually send him.
What?
Send him.
The public.
A different set of obligations.
No, no, no.
The public is the same.
The PH is different.
The age is different because two different peers, right?
The public will be the same, always same public.
You will be sent to everybody.
Okay.
This is encrypted using some part of this.
Now you have the public key, You have the key.
Then another key will be sent.
Another exchange will be done.
Encrypted using the which you have which is the same.
Through which it will send you.
Encrypted key.
Which you will decrypt to get.
This is now our one has the session key.
You have the session key.
You'll be able to communicate to each.
Okay.
Good enough.
Now, when you see is every 300 seconds, this key will be renegotiated again.
The second tunnel will be renegotiated again, which.
Every 300 seconds because I've kept the timer at 300 seconds.
This will change.
The material will remain the same, but they will shift and use some other part of the.
Every 300 seconds, this tunnel will be coming back again and again.
And again.
The bad part is that my TC will only come down.
The new TC will come down after 3600 seconds.
So what I'm basically doing is after 300 seconds, I'm getting the same key again and again.
And again.
And again and again.
That's why it's recommended to keep it three times the peak.
The second tunnel.
The tunnel that will cause problems which will see right now, if you go R1, you will have received
a lot of times already.
So crypto.
The registers itself.
That's okay too.
Rickies have already come to me.
Right.
So.
What do you have on?
He dies eight years.
Yeah, sure.
Crypto I.
There was one.
Then there was another one.
Check out the connection ID 1005.
Right.
1006.
A new connection created every time.
Okay.
Decay.
Decay is the first time it takes place, right?
The first time.
Out of that, he will take the three separate keyeh1.
The other ones will be used to encrypt the tunnel.
The actual one will be saved.
The one which is saved for the data.
They'll be safe.
Right.
It has.
The other one should be three times right now.
Configured it to be only 300 seconds.
You will be changed, right?
The key will be changed from the server.
He has to work with these.
See.
Yes.
It's not.
That's why it has to be synchronized.
That he has to be synchronized.
See, there's another thing.
So crypto.
What is the size left?
1086.
You also have.
Re registers itself.
The group member will still after when it's about to go to 3600 seconds, he'll go back and reregister
itself again, go through change.
At that time.
He'll get the same new new variations of that has to happen.
For the second.
That's why it says three times.
Just to keep it safe.
Says three times.
Right.
Because the second time.
Right.
Someone might be sniffing on it.
Then because the PH will remain the same forever.
That is not really feasible.
To remain safe.
That's why they keep on changing that.
So the other guy cannot collect a lot of data.
Although it is still protected two times, but still for safety, three times is enough.
By default, it's 24 hours.
By default.
It's when the whole GDP goes down and comes back up again.
The same time, your other tunnel also comes back up again.
But for extra high security, they say three times.
Three times three hours.
Ten more days.
We.
After time.
Out of which one time out of.
You know, this doesn't happen just like at the end of your 3600 seconds in a normal IPsec tunnel.
This doesn't happen again.
But what the other two peers do is they just shift their keying material.
The keying material is the same.
They just use a different block out of it.
The material because they don't have just the key.
They have a full material, Right?
They have a full keying material out of that.
They'll use the other part.
The other part the other part.
After your lifetime is done, then they'll use a different key.
84,000 after after the after 24 hours.
Everything changes.
Your keying material changes and everything changes.
Now you have the new king material.
From that, you'll use different keys.
Until then, you'll just be shifting three, three, three hours every three hours.
You'll keep on changing your.
Yeah.
After 24, after changes every 30/602.
But the material remains the same.
Keying material remains the same.
Is again, a smaller block out of the same material.
After 24 hours, the complete thing is refreshed.
Right.
Remember these things?
TC 3600 seconds.
You don't change the material.
You don't change the full material.
You're just taking another block from the same material.
The material is usually 1024 bits out of that.
You're just taking 128 bits here, 128 bits here.
You're just reshuffling the bits.
Every 3600 seconds, every one hour until 24 hours.
After 24 hours, your whole icy camp is torn down, brought back up again.
So what you get is newer, fresher material for TK.
Then you again start taking out smaller chunks of keys from the same key.
From the same.
You know, minimum is 300 cents.
Oh, that one.
The.
You can bring it down.
A would, but that would mean 100 seconds is way too less and seconds is way too less for every hundred
seconds changing the key.
It's.
Every 300.
The same key to every 3600 seconds.
Unstable.
Its.
It is unstable.
Yes.
I'll show you the instability that it brings.
No, right now it's not.
Later, I'll show you.
It shows a lot of essays.
And essays out essays.
Right now you have 86 800 and 60s left.
Off the tiki.
The tiki will come back in 86 eight 60s.
We'll have a look at that.
Until then.
Until then, what we'll do is we'll register others.
Clear Crypto.
Yes, please.
Right.
So crypto same concept, same things will be pushed down here.
Also inbound outbound, same things.
So crypto.
I use the same two tunnels, which you'll see.
Three key tunnels.
Coming from where?
1066.
66.
Let's do it for all of them.
Clear crypto.
Played crypto.
Tricky has been received.
He has been crypto as.
RSA public and private RSA is a set of keys.
But the key part is.
Whiskey bark.
That's all.
We still have also.
Yes.
You use everything.
Everything that you used to use before.
You're using that.
It's just that you're using to protect from the top.
Encrypt at the bottom, encrypt at the top, Decrypt at the bottom.
Because everything else is the same.
Things are related to the.
Give me everything.
It's still.
It's still the.
Okay.
Now, what you'll see from R1 is not R1.
R6 is astonishing.
Why you say so, crypto guy?
So crypto I can.
I still see a lot of keys.
A lot of.
Right.
There's one icy camp with the first one, the second one, the third one, the third one and the fourth
one.
Now, the moment you send out three keys, you see three keys.
A lot of keys also here.
Now, this idol is there for a long time.
23 hours.
The other guy has nothing to do with this, so let's wait for the Reiki.
So crypto.
How much time do you have left?
With the.
Give it time.
So crypto.
So now you should be able to this should at least work, right?
I mean, that's all we are doing all of this for.
Everything is the same.
Nothing changes after that.
Your IPsec tunnel is the same.
The only thing you're doing is you're making strong the process of sending down the team.
That's all you're doing.
You're just making the process stronger.
Nothing else.
There.
Good.
The last thing that you have to do is in this.
Do I still have time?
I can check in from the server.
Sure.
585 VMs will come up and register themselves in five 85 seconds.
You gotta take the time.
Anyways, let's wait for it.
What you have to do is you need redundancy.
We need redundancy.
Let me explain to you a little bit about redundancy, how it works with get VPN.
In get VPN.
The way it works is you have a key server.
He's over one.
I'll have another key server which will be key server.
Key server one and key server.
The moment I set up the relationship between them.
This relationship is known as co-op.
Who?
It's called co-op.
They will communicate to each other.
The two servers will communicate to each other.
One of them will be the primary.
Everybody else will be the second of the group.
What does this mean?
Can you guess?
First of all, one goes down, the other comes up, that's fine.
But the role that is important, what is the role of the primary?
What is the role of the others?
The role of the primary is only to keep track of the key.
That's it.
The rule of the primary is only to keep track of what the key.
That's all it needs.
What it does is the key is with whom?
This guy.
When R6 and R7 are creating their relationship.
R6 will also send a copy of the key to our.
We'll send a copy of the key to our server.
So what people will do is whenever they come up and register themselves, they'll always they can register
with either him or.
Since R7 also has the key, it can push down that key.
Sorry.
Seven will not have the key or seven will register them.
Seven will register them.
First time we will give them the key.
Every key after that will be done.
By whom?
The primary.
The primary job is to.
You can go and register yourself anywhere.
You can go register yourself anywhere you want, But you, Ricky, will be done.
By whom?
The prime.
You see a small little flaw of something else that we need to do.
Let's say I register to R7, right?
Let's say I'm here and I register to R7.
Then my will be done.
By whom?
Asks.
Is there something missing here?
The private.
The public and the private.
The private and the public.
Key is with whom?
Before Arsic sends me a I would require that public.
Because he will encrypt it.
I will need to decrypt it.
Do you understand?
Because when he sends the TC to me as a rookie, I would need to decrypt that for me to be able to decrypt
that.
I would need the public key.
Now, if I had registered to R6.
R6 would have given me that public key in the exchange, but I've registered to R7.
I cannot create a separate set of keys on R7 because that would not match.
R6 will use a separate set of keys.
R7 will use a separate set of keys.
That's why when I created the keys here, if you remember, I created them.
As what?
Exportable.
And now I'll export them.
I'll export the public and the private key from here and put it there on our side so that anybody registers
it will get the same public key.
That it would have received from our.
Now, this is very, very, very dangerous.
You have to make sure that this key is secure.
One way or another.
Crypto key export RSA, whichever is the name of that key.
Get keys.
The type of file is PM.
How do you want to export it?
You can use it using a URL so you have a server somewhere.
You export it to the server and something like that.
Here I'll use what.
Copy paste.
He says, encrypted locally.
Format dot ppm of the exported key.
Okay.
Then he says terminal here is only supporting one, so meiosis will support a lot of them and all of
them got one to.
So here I'm saying I'll do it using cut and paste.
It says, okay, encrypted locally.
Using either three days or I'll use Cisco one, two, three to encrypt.
I will need the same key on the other side to decrypt it.
This is not the complete key.
This is the actual key.
Encrypted using the three days I just used.
Right.
I need to paste this on the other side.
The first thing I'll do is I'll copy it.
Starting from the first dash until the last dash.
Remember?
Dash two dash.
Pasted where?
On the notepad.
Go to R7.
Use what command crypto key import.
I'll say the least, is okay, what is the local label?
What do you want to label them here?
I'll label them the same.
Do you want them to be exportable from here to.
No, I don't want them to be exportable.
I want them to stay here.
How are you importing them?
Using terminal.
What is the password that they are encrypted with?
Says space the public, not the private, only the public part of it.
Again, dash to dash.
The public is.
From this dash to.
It says Begin public.
Public.
Okay.
Sorry.
Yeah.
Public to public.
I'll paste it here.
Press the enter key.
He says now face the.
David.
Dash to dash.
End of private.
Copy it.
Paste it.
Press.
Q To quit.
Quit siding type.
Quit.
All right, I'll do it again.
Crypto zeroize RSA.
I might have made a mistake with the queue, so I'll copy it again.
Again.
Crypto key import.
Odyssey.
Right.
I want the name to be get keys and using terminal.
The password is Cisco.
There is the public part.
Press the enter key.
Twice.
The private.
Quit.
He puts a succeeded show crypto key my pub key.
You have the kid.
I did the same private and public key that you have on the other side is the one which you have.
Now let's do the configs.
Now this is going to be another server, right?
How do you configure the server?
First of all, the policies, do they remain the same?
Obviously, yes, I did.
I removed everything.
So I'll just copy everything from this side.
Do show run section.
And there you go.
So crypto, if you see it, has gone and registered himself again.
So you'll see a new key has come.
He's using this key.
He still has the old one because he goes 5% less than that.
Time to go up and register itself.
Right.
So what you see here is the second key, the one which you have received, which you're using for encryption
decryption.
This has not been used.
This will time out after the amount of time.
Our six.
What do I need to copy?
I need to copy this.
I need to copy this, this.
This right here.
Same.
Everything is the same except for the address.
Address is what?
Server address is 1077 77.
That address?
So run.
Section.
Something is incomplete here.
What address?
Access.
This is not created.
Okay.
Now, this is important.
This is important.
What is important?
Everything that you configure on one server.
Should be the same on the other side.
Why?
Because when they're trying to communicate to each other, they will exchange and see.
The characters.
If the characters don't match, they will not become co-op.
They will not co-op cooperate.
They will not become part of the same cooperative group.
As long as everything matches, it's all right because they will tally.
Okay.
Here.
Something is missing.
I need to create the access list 101 permit traffic from ten zero zero 0 to 10 000.
Forgot the IP again.
Show on section crypto.
See if everything is okay.
Everything is correct.
Everything matches.
Address.
The same identity number is the same.
The name does not really matter.
Right?
300 seconds.
Key transcript.
Everything.
That's the thing.
I have not configured that part yet.
I'll configure that now.
Crypto.
I am already in here, but let me show you from here.
Crypto Gdoi Group.
Sales.
S.
Server is local.
It's called.
A redundancy.
Not a lot of things that you have to configure here.
Only two things.
One is.
What is the address?
What is the pier's address here?
The pair who I'm creating my redundancy with is 1077 70 7.7.
There's also another thing called.
Local priority.
This is what matters.
This is what makes you the primary or the secondary better the priority, the better your chances.
I'll keep the priority here as.
Crypto GDI group also the same.
See?
What does he say?
Contact from unauthorized source.
Possible misconfiguration of PIR or local address.
Because from here I have not configured it.
The other guy is trying to contact me.
They are not able to communicate, so I need to configure the same things here.
I'll say server local redundancy.
Local priority.
I'll keep it 50.
Address here.
Address?
IPv4 is what?
66.
Six.
Cass is entering what election mode in the group sales.
In the election they will choose.
Who's going to be the primary.
Who's going to be the secondary?
The good thing is.
I already have a gdoi idol between the first and the second.
But have they entered?
Yes.
This guy has already transitioned.
To what?
10.6 has transitioned to.
Then that six has transitioned to prime.
Which is the other guy.
Not seven is me, so my campus is fine.
I have received the public key.
From the guy.
Everything is okay.
So crypto.
IPsec is Sha Chau Crypto.
Check out the information in my.
You will be amazed how much these two talk.
How much the two servers talk to each other, why the other server even told him how many group members
have registered.
The other server told him that he's alive.
The lifetime remaining lifetime in the group.
Ricky is also here.
They're actually talking to each other all the time.
Stay tuned.
See that?
Time is the retransmit period is here.
This should match on both of them, by the way.
If it doesn't match, they will not create neighbors.
They will not talk to each other.
I see.
Lifetime is 30, 60.
Time is 30/602.
Right?
Is a remaining lifetime on all the pairs is 2099.
Write the access list that is being pushed down as 101.
Write all of this information also.
There's also another command show Crypto graphics co-op.
It shows you the keepalives between the two.
This keep allows every 30s.
Out of that right now.
13 seconds are left.
They'll keep on sending Keepalives from one side to the other side to make sure they are communicating
to each other.
Right then, Anti-replay.
I'll talk about that later.
What do you have?
The peer.
Who's my peer?
The pair is 10.6.
He is the primary.
Its priority is ten.
Sorry, 100.
Ake has been established with him.
I've established my session with him already and we have certain packets which have been sent and dropped.
Nothing has been dropped until now in my communication with the peer.
So this is for troubleshooting.
This part is for your troubleshooting between the thing.
The good thing here is what I can do.
From my router side, from the client side.
Right now they're pointing to whom?
1066.
I'll go to the group.
Address.
Server.
Sorry.
First I'll remove this.
Then I'll put the address.
As what?
Senate.
7777.
I'll configure not only one, but the other one also.
So crypto.
Doing for show run section.
Something is missing here.
Policy.
Ten camp?
Yes.
The Pre-shared key is not pointing towards the right crypto Isakmp key.
Cisco address is 1077 77 dot.
Try to find it out.
Point it also clear crypto.
Yes please.
Legislation complete.
Legislation.
Complete with whom?
R7.
I'm registering myself with R7.
If you check show crypto Aisaa Campsie.
The first Reiki was given to me.
My home.
Also are 70.
Because I created with him.
He gives me the key, the tech.
The remaining keys will be coming from where?
From the band's.
All the remaining keys.
The keys will be coming in from the secondary server.
I'll do the same exact thing here.
Crypto Ice Cap Key.
Cisco Address.
So.
I did the same exact thing on how to show crypto.
If you check the gdoi here, you'll see that active group server is home.
1077 70 7.7.
How many servers in my list?
Two because locally I specified both.
Right.
Server 10.7.
Server 10.6.
Then I registered myself back in.
20/402.
Ricky received two minutes, 44 seconds.
Then the other stuff is the same.
Inbound direction, outbound direction show crypto campus.
If you check right now, everything that I've received is from where?
10.7.
Check out our one show, Crypto Campus.
Where did it receive the latest Reiki from?
From the primary.
So in get VPN, if you have as many number of servers, you have as much as ever, but you want to have
the clients or the group members can register themselves.
They can register themselves to any one of them.
But in the whole system, the keys will only be managed by one of the servers.
Which periodically, with the remaining lifetime, will always keep on reaching the group members.
Depending upon its time, the one which you have set.
The key will always be done by the primary.
Always by the primary.
Right now in the primary goes down, the secondary will take over as the primary.
It already has the information that it reads.
It already has.
The set of private and public key doesn't need anything else.
Uses that information to become the primary, then handle the keys henceforth.
And luggage henceforth.
The Reiki request.
Did you know it's managed by the server?
Yes.
The key timer is kept by the server.
The clients are just dumb terminals here.
They just receive the key.
They encrypt and decrypt, encrypt and decrypt.
The job is just to receive the key and start encrypting.
That absolutely done.
See, I wanted to check on our to show crypto icecap this Ricky here is also coming from.
In.
And six for the first time they register.
The key is given by the server.
But since they are talking to each other, they exchange what they're talking so they know what key
is being sent down.
They send the same key down from the other side.
Right.
So price of campus are six.
So crypto scam here.
Idol with all these people.
Okay.
All right, Now, how do I check all of this?
I will turn off what my main server.
Before I do that, there's another command which you need to check.
It's called show crypto.
CSS members.
Very good command, very good for troubleshooting.
Show crypto key server members.
Shows you.
Which group members are registered to which key server.
Because in production you can have many key servers, right?
But any one you can go to any one of the key server and check from there who is registered to whom.
Here it's telling you 25.2 is registered to 10.6 plus the characters which it has.
How many keys has he received?
How many has he acknowledged?
35.3 is also registered to.
45.4 is registered to right now, only 15.1 is registered to.
10.77.
It shows you that information.
You can check it from R7, also show crypto CSS.
15.1 is to me, 25.2 is to 66.
35.3 is to 66.
45.4 is to 66.
The same information.
Both of them will share.
15.1 is with 77 only from here.
Also 15.1 is with 77.
The shows that they communicate to each other.
How do you how do you check the redundancy?
Stop.
Now, you might ask that the time is a lot.
30s plus the retry and all those things.
The time is a lot.
It really is not a lot because you already have 3600 seconds on your tech.
So by the time your tech is expiring, first of all, you have five seconds left.
5% of the time less than that.
Even if you can't reach your server, you have 5% of the time.
That's more than 90s for you to work around with that key.
So even if the server is down, 30s is more than enough for them to make the shift to the other side.
Right.
You will see when the other side comes.
Up until now, the key was done.
By whom?
1066.
Right.
That was always done by 10.66.
You will see when 10.7 becomes the primary.
The key will be done by.
I have seven will send out the recordings.
And so how do you check it?
Show crypto.
What is the command?
Kscope.
He tries to.
The third time, I'll consider him dead.
Five.
To.
Zero.
The Ricky is dead.
Sorry.
The server is dead.
I'm transitioning toward primary.
I'm sending.
What?
All of them will now receive their keys.
From whom?
The secondary server.
They will receive their keys from the secondary server.
Is this clear?
The concept.
You'll have to practice.
If you remember, I warned you about this week.
This is just the beginning.
Okay.
Tomorrow is a light day.
Tomorrow you have not much to do.
Practice this until we reach easy VPN.
Finish it off.
Only.
Light one big and a small one to cover it today.
Now, another thing that I have to show you is if you check your crypto IPsec right now, you'll see
that Anti-replay protection support is there.
The support is there.
But if you check your crypto.
You'll see that MTV plays disabled.
And you'll see two keys here.
Two keys.
Because this was the old key which came down from the previous server.
Now, that server died, but the key is still here.
Now I'm using the key from the second server, the one which I just received, and this is a new key
which was just generated.
Right now.
MTV play.
What is what is play?
You know.
Distinguishing whether you have already got the package.
Of that sequence number if you've already got it.
So if you have two hosts, even if they are running IPsec.
But I said something.
There's something known as a sequence number attack, Which a person can do is it can take a packet.
Right.
Based on the sequence number, he'll keep on sending the same packet again and again and again.
Replay.
Attack.
The same packet will be sent again.
He'll replicate it and send it again.
Since the other guy will accept it because it's part of the number matches and all the other things
match, it will accept the packet again and again and again.
Right.
Replay Attack an IPsec.
No one can tamper the data, But they can do is they can take a part of the data and start transmitting
it again and again and again.
To protect this from happening.
You have anti sequence, you have two ways of doing it.
One by default, if you check is enabled on your VPN.
If you go to show run section crypto.
Sorry.
Not here.
The server.
If you check your crypto, you'll see that by default it's counter based.
Window size is 64.
Counter based.
Sequence number based.
It keeps track of sequence numbers.
So I send this sequence number.
I should receive this sequence number.
I send this sequence number.
I should keep track of this sequence number, which is dangerous.
Which is dangerous, should not be based on sequence number, should be based on time.
We call this T bar.
Time based anti-replay detection.
How do you enable it?
It's pretty simple.
You just go crypto gdoi group.
Sales s.
So the local.
You have a IPsec ten.
We play.
Not counter based using sequence numbers, but time based.
Window size.
Now for the time, you can set the window size in seconds.
I could say, for example, 10s.
And you clear it from the servers, Clear crypto.
What this does is now it will keep a track of time when I send a packet.
I'll increase the counter for 10s.
I should receive a reply within 10s.
If I'm sending a sequence number, the next sequence number should be coming back in 10s.
If I don't receive it in 10s, I'll consider this packet to be lost.
Which is good.
Why anyone who is replicating your packets, it will take time for him to replicate the packets.
The.
And that's replay.
Yeah, that's replays and replays to protect against that.
Protect against that.
That's what we are doing right now.
First, it was based on sequence numbers, which was dangerous.
Now we're doing it based on time.
So we are keeping a time frame that he cannot replicate it within this amount of time.
On because I already have.
So with that amount of if he doesn't because if it comes back, if the packet comes back after that
amount of time, do not accept that packet.
Okay.
So I'm expecting a sequence number.
I'm expecting it within five seconds if I don't get it within five seconds.
He's.
I'm supposed to send the previous sequence number again because there is a chance that someone has someone
is trying to replicate it and send it back to me again.
So show crypto.
I just did it.
So if you do your IPsec.
The support is on show.
Crypto guy will show you that your anti-replay is not the first one.
The second one the first one is the old key.
This is the actual one which you're using.
Time based.
Your replaced time based.
No, no.
I cleared it from here.
I said clear crypto.
It went and registered.
That's why.
Now you see a third side, three sets of keys.
One, two and three.
This is from the old one.
This is because I cleared midway.
So it had these ones were still left.
So because I cleared, I got another one from the server side.
Clear all you have to.
Yes, you can do that.
You have to remove the crypto map first and you have to create it from the server side because he's
the one who keeps track of the keys.
So you have to clear it from clear crypto, from the server, then from each of the clients, then register
it.
Right?
Because clients.
I told you are dumb.
Everything is done by the server.
The client.
You cannot just clear from the client.
You also have to clear from the server side.
Is this clear?
This is your gateway.
Now, I know that right now there's a lot of information in here.
A lot of it.
You have keys going on.
You have co op happening.
So many different things.
But try it once.
Try it once and then.
Let's see.
One minute.
30s.
That's not much.