But today what we are going to be talking about is Ik version.
What is Ik?
Internet.
Where did we use it?
In our whatever.
We were doing it.
We used Ike.
As Ike.
The nine packets.
You remember the control plane traffic was isochem, right.
It was like.
So before setting up the second tunnel, which was the data tunnel.
Before setting up your data.
You had this separate tunnel.
That was equation total of how many packets?
Nine If we were using main mode.
Aggressive mode is three plus three six packets.
Write a quick review of what were the packets going through.
Packet number one and two was policies.
Correct.
Three and four and nonce.
Five and six SK PCA.
PCA certificate or whatever.
Seven and eight policies.
The data for the data tunnel.
There is a transform set being negotiated and the last packet was acknowledgement or validation.
That everything is okay.
Right.
Plus, we also saw that, again, when this was created, when this whole thing was created, a lot
of things were not there.
What do I mean by a lot of things?
Stuff like Nat T Nat D was not there in V1 one.
It wasn't.
So what people had to do was, since the problem came up later, what people had to do is every vendor
created their own implementation of Nat D.
So you'll see that it's implemented in every one of them.
But everyone had to do it by themselves and it's included as a payload.
Is there.
It's included.
It was included later by the vendors.
It was not there in the beginning.
That's how you see it as a payload.
And down the bottom you see it there because they wrote the code for it later.
It was not there in the beginning, so it was a lot of other features like that were added later to
Ike V1 Right.
Eventually there comes a time when you keep on doing some stuff like that that it starts becoming too
complex.
So then they decide, okay, if we have something like this, why don't we create a new one which has
all these features inbuilt and to make this exchange a little more streamlined.
The keyword here is streamlined.
So again, the same thing will be happening.
You'll have the same exact thing configuring, right?
The only thing is the way that these policies are going to be exchanged is going to be different.
The new version so much better than before.
How?
Think I might have a document which I've already shared.
So in total right now, the nine packets, which you see will be replaced by a total of four packets.
You'll have the first two packets, one and two.
We call it Ik sah in it.
I guess, initialization.
This is equivalent to main mode.
One, two, four, packet number one, two four in the main mode.
What do you mean by that?
Your policies, your.
Your nonce, all of that?
Yes.
In the first two packets.
Right.
So you get everything by the what?
You need it.
That's all, isn't it?
All you needed was the key on both sides.
So once you have the plus the policies, the plus policies plus noise from both ends at the end of this,
what what will you have on the other side?
A key.
By the end of the first two packets, you'll have the key.
Correct or not, after that packet number three and four.
Can you guess what?
BSC.
RPI.
And transforms it.
Parameters.
Plus the proxy is here.
Basically, we call the proxy ACL here as traffic selector.
Traffic selector.
All of that is exchanged.
From authors.
So this includes main mode five, six and then the rest of the quick mode included in a single package.
So three and four done.
This is known as Ike.
Fourth, like authentication.
ICOs.
So the first four packets have no pre-shared key.
Then the authentication takes place in the third and the fourth packet.
And the other parameters are also resolved.
So your natty and all those features are all resolved here.
In these packets.
Now, I think I might have if I remember correctly, I had a good diagram of it.
Yeah.
Here are these two separate.
This is the exchange that takes place.
Is it visible?
Let me explain while I'm saying it.
This is one.
This is Ikwe two Ikwe one packet.
Number one is phase one policies.
Packet number two is basically three is known as natty and key exchange.
Correct.
We know that already.
So these are one, two, three, four.
Packet number one, two, three, four.
Then he's put a dash in the same thing on the other side becomes Ik say in it phase one policies natty
also sorry is negotiated in the first packet.
So natty nonce key exchange policies, all of that in the first packet on both sides.
So four packets here equal to one packet here.
Then what did you have on the other side?
Packet number five was Ik or certificate or whatever you were sending.
So your authentication either SK or PKI, right.
On the other side.
Again, quick mode was what Essar Transform, set some other information about what is happening and
numbers and then the acknowledgement move it to the other side, your authentication ID certificate
or whatever you're using.
Transform set Nat information all in one packet.
All in one package.
Right.
So much, much more easier than earlier.
Yeah, but here, troubleshooting will be a little more complex than the first one because first one
you would know if packet is getting stuck in 1 or 4 or 6 or 8.
Now the packet can either get stuck in the first one or the second one.
First one if your policy mismatches.
Second one is transform, set pre-shared key and all those features are not matching.
So you'll have to dig in a little deeper.
But what it gives you is it's faster, quicker, less number of packets going through.
It still works on the same UDP 500 to 500.
Still works on the same protocol numbers 4545 is also.
That is also there.
So if there is nothing happening exactly same that is happening, it will move to 4500 where it works
exactly the same way.
Correct or not.
Another thing that you have to know is in Ik v2 there is something known as create child essays.
Sometimes when you have a network setup up, a phase two tunnel has already come up.
Sometimes you do need Rekeying Additional essays need to be created earlier if additional essays needed
to be created, the whole tunnel was swept down and being brought back up again.
Here you have something called Create child essays.
What you can do is once you have your negotiations for the phase one, then whenever you need to create
new essays.
Now, this doesn't happen always, but there are some protocols where you might need to do this right?
You will see that these essays will automatically be created based on the first, because the only thing
that you need to exchange is what the transform set, which is just exchange for the sake of transform
set being exchanged and you'll see new essays being created known as Create child essays.
So first you have your essay in it, then you have your icon, which most of the times you'll always
be using.
So get your get your tunnel up.
It's started working then in some very rare, rare cases when you have more essays which you require
for Rekeying, remember get VPN Rekeying was created one after the other.
For that, the essays that will be created will be which ones create child essays, which will be the
same as your ICOs.
It's just that they named it different.
So you see that the thing that will be exchanging the stuff that is exchanged is SATs and Nat here.
Also SATs and Nat.
That's it.
Right.
Mr. H is right here.
Second.
What?
Second.
Yeah.
Forwarding secrecy.
You can configure that.
Yeah.
That'll be done here in phase two.
You can do that.
That comes right here.
That's done under a crypto map.
You have a crypto map.
You can specify it there also.
That is again a distro for the quick mode.
Yes, for the quick mode.
It does it again for for extra security.
You just have to choose which group of sizes what to use.
Right.
And here also in until now, the authentication mechanisms that we saw and all the encryption mechanisms
that we saw, we saw ESB, we saw H Ik v2 also supports EEP.
Eep will be used with certain protocols.
It's usually used for authentication, usually used by switches for extensible authentication protocol
you'll use for triple A when you have a triple A server and you need to communicate to the triple A
server, usually the frames are encapsulated within EAP.
So you have an EAP one.
Say for example, there's a switch, right?
The switch and the user is sitting on the other side of the switch.
Now whoever user logs in his information needs to be sent to the triple A server, right?
So eight, not 8 or 2.1 x, that is exactly the frames that they use.
The password and username is hidden inside that EAP packet.
The thing is Ik v2 has support for it.
So tomorrow when they want to expand and use EAP, maybe do authentication based on a triple A server
can be done.
So users logging in, it's very easy.
Why?
Because people will come in using AP and that frame will be just forwarded out to the EAP server to
the 777.
Right.
Another thing there is a little problem though with Ik two which was not there with Ik camp.
The problem is the first packet when it goes right.
I see in it.
The first packet that goes out is quite heavy.
It has a lot of information.
So if this is the initiator and this is the responder, it takes the responder a little while to respond
to this.
So the session on the responder stays open for some time because it takes some time to respond.
The first packet is not the same as before.
Earlier it was a policy.
Now he has to find out his policies and create the and then reply.
Check the Nat and so many different things.
And just one packet.
It does take him a little while more than it used to take earlier.
So what it does is it leaves you open for a DDoS attack because what the other guy can do is it can
send a lot of hits and your sessions will keep staying open and open everywhere.
There is a possibility of a DDoS attack, right?
How do you protect yourself from it?
You don't like V2, does it by themselves?
By itself.
If you send a lot of say in it and the responder figures out that he has a lot of open sessions and
also the same way, the same way it worked there.
It works here.
Same window size here.
If this happens with the responder will do is it sends back a reply in the reply is we call it a cookie.
It sends back a notify payload.
It's a special type of informational message, which too has informational message where it says where
it gives out a cookie.
Cookie is just a small, random number.
Gives it out to whom?
The initiator.
If it's a guy who's.
There is no way that it can include this cookie in its packet because it's just sending packets.
It doesn't know how to deal with them, how to accept those packets.
Right?
So it waits.
Then the next packet that comes in from the initiator will not be accepted unless it has.
What?
Unless it has that cookie which from I to r should go.
Right.
Clear.
So in case someone is spoofing the address, in case someone is spoofing the address, when I reply
back, I'm not responding to the guy.
I'm responding to whom?
The actual guy.
Back it the of notification on the next time it magically things if you want to do it again but see
how does it create this connection.
First of all you have to understand that he's spoofing someone else's address.
It's not using his own address because you know who you are creating the tunnel with, right?
You have configured it properly.
He's spoofing someone else's address.
When you respond back, your replies are not going to him.
They're going to the original address spoofing.
Right?
When you respond, you're not responding to the attack that you're responding to the actual address.
He doesn't have that.
So when you send the cookie, it doesn't go to him.
It goes to the actual guy.
If he doesn't receive it, he's never going to send back the cookie to me.
If he doesn't send back the cookie to me, I have prevented myself from a from a successful DDoS attack.
Okay.
Another mechanism inbuilt for.
The other thing Anti-replay is the same which you can do here.
You can do it there.
Also windowing time based activity, replay detection.
You can do that and you have certain other features.
But these are, I think, the most important ones.
Streamlined.
It's much more streamlined, much lesser number of packets.
It has inbuilt protection streamlined as in earlier when I told you that that was earlier was later
built in, a lot of other features were there in Isakmp, which was later put in here.
What they have done is they have sequentially made it when I say streamlined.
So you have this thing happening first, then Nat happening, and all those features were added together
not like before where it was just jumbled up like that.
So now there's a there's a specific sequence that everything follows.
Okay, how to configure it?
The best part is that when you configure Cv2, you're only worrying about the first phase.
The second phase will remain the same.
Your ACLs will remain the same, your crypto maps will remain the same.
Everything has to remain the same.
Either you're using profile or you're using VPN, you're using VPN.
Everything remains the same.
The only thing that changes is the first nine packets.
The exchange of those packets.
Let's check how this is done.
I do have the emotion.
Let's do it on the news.
I'll create a simple side to side.
Right.
So the address that I'm going to use.
Same as before.
All right.
So R1 can talk to R3.
That was the whole purpose, right?
So.
This is slash 24.
My job is, what, 10.3 to 10.1.
Should communicate, right?
Let's let's see the differences.
Major differences between V2 and IQ one.
We won.
What was the first set of policies?
How did we describe them?
Crypto policy.
Then you number it Encryption three days authentication key share group to.
Harsh.
And then you said crypto is Kam Kee.
Cisco address one, two, three, one.
Not as simple as that.
You're defining all your packets.
That's it.
That's all you did right Now, if you have a look at this and you compare it to IP two, you see IP
two is so much better.
Why?
First of all, if I say Kam, if I say Kam, you had to create two different tunnels between, let's
say between R1 and R3.
You are going to do for Kam Properties.
You are going to do three days and MD5.
But with R4 you are supposed to do S and MD5.
What did you need to do here?
Create two sets of policies.
So the policy number ten, policy number 20 and when the exchange took place, R1 would said what all
of the policies ten as a separate policy, 20 as a separate policy.
And the same thing you would do here.
What V2 has done is when you're configuring it on the server.
What you can do is, first of all, it's not called a policy anymore.
It's called crypto ikev2 proposal.
It's a proposal, not a policy.
Name it.
Anything.
It can be a name.
It can be a number.
Right.
So I'll call it prop.
Then you choose encryption.
I want to use three days.
I want to use as you can choose it in one line.
You can choose, say for example, I want to use hash MD5 and Sha authentication.
You don't choose here group.
I want to use two, five and one.
What you're saying is you're giving your preference when the guy comes up, give the first preference.
If he's using three dice, if he uses if he's using, that's also okay.
I'll accept it.
If the guy comes in with MD5, MD5, give it the first preference.
Sha the second preference.
Same thing for group.
Group two is given a higher preference group five a little lower than that, but still high then group
one.
You understand.
So instead of writing ten different policies for ten different sites, I just have to write one proposal
where I mention all the different possibilities of the encryption and authentication mechanism that
people are going to commit.
Okay.
Also, make sure that the iOS that you're using is 15.
I don't think this is 15.
You need to change it.
So the image that I'm using here would be.
Similar to S2, right?
It only works 15 above.
I also make sure it's s so this command will not be there for the other outlets.
Hi.
Q2 just like you have crypto icecap, you also have crypto.
What was the first thing I said you have to do?
Proposal.
The name it.
Anything is just a name.
I'll call it prop.
What does it say?
It must have at least an encryption algorithm.
An integrity algorithm and a group specified encryption.
You already know integrity is the same as hashing.
So hashing is known as iniquity.
We call it integrity encryption.
What do I want to use?
Three dice.
Then you can choose other options.
Now see the new variations?
Yes.
Now has 192 and 256 bits in one.
Earlier it was just one 128.
Right now you have more.
You can use more.
As long as the devices support the licensing for that should be able to do it right.
So let's say I want to use as 256 as a backup.
Okay.
Again, integrity.
Look at this.
MD5 is the same.
Sha has new variations, so sha one Sha 256.
Right.
Newer variations.
Group.
Check out the groups.
1 to 5 has become one.
Now, it doesn't matter that it doesn't mean that the higher the group size, the better.
The bigger the size, the higher the number of the group, the bigger the size.
Check this out.
20 is just 384 in size.
Group 20.
Right.
This is what you call these.
These are called elliptical curve.
Elliptical curve mechanisms.
Not really sure what the P stands for, but I'm sure that this is elliptical curve.
Let's check this.
Yes, but faster elliptical curve rhyme groups.
What they have actually done is has been so strong since it was created that they have now reduced the
size of it using variations.
So instead of using a normal, you use something known as elliptical curve.
So they find out values based on a curve and then reduce the size.
What it gives you is faster tunnels with good amount of security.
Not as secure, obviously, as the original.
But since that was never broken, they thought that, you know, why don't just reduce the size.
That's why you see a lower size in all these steps, right?
So what you would use right now, let's say, is two, five and one as the backup, Where do you specify
all of this information in the proposal?
So what did I use as.
Yes.
So that we are in sync so we can copy and paste the other side.
Right.
What else did we do earlier?
See we have specified this group and hash authentication mechanism we have not specified yet.
We also need to specify the.
But yeah, but what you also here have is one additional step which is not used for anything, but it's
just there.
You have to specify a policy.
Now you can name it anything crypto IP to policy.
Again, just a name, any name you can name it.
Ten You can also call it Paul here.
All you have to do is call the proposal.
So it is still a policy.
It's just that the proposal is separately done and then called in the policy.
So you had your second policy earlier.
It's not an ICBM policy anymore.
It's ITV2 policy, which you can call anything in here.
What do you call.
That's it.
You just call a proposal in here.
That's all you do.
Okay.
Clear.
Now comes the real part, the key.
You need to create that key here in Cv2.
See in the first section and I see what you could do was if this is R1 and R2.
Right?
For them to be able to authenticate each other.
Both should have the same.
If there was a mismatch, they wouldn't create the tunnels.
Right?
Same on both sides.
What we do gives you is you can have a separate PSK for sending and a separate one for receiving.
So let's say I want to use Cisco one as my sending sorry, receiving one, Cisco two as the.
Sending 1 or 2.
What should be the receiving one?
Cisco to and sending one.
A separate key for sending a separate key for receiving, we call it local and remote.
Local will be one for R1.
Remote will be what will be sent will be Cisco two for the other side, the receiving one, the local
one should be Cisco two and he should be sending his remote should be Cisco.
Then.
Played with this, how this works.
So.
R1 and R2.
Also, another thing we've got to show you is in Icecap, you can only choose one mechanism.
Either use SQ, which will be negotiated on both sides or use RSA, RSA signatures.
In here you can say from here, from R1 to R2, I'm going to send a SQ from R2 to R1, I'm going to
send.
I'm going to use.
I'm going to use a certificate.
So once I will be sending a pre-shared key, the other side will be sending a certificate back which
most of the times you will not use, but it's just that it is available to you in case you're stuck
in a situation where you have to use it, you can use it.
You also have to specify authentication method.
Remote is SK or local is PKI and stuff like that, just like you do here.
Okay, so let's see how the key is specified here in Ikev2.
The key is not specified openly, just like in icecap.
Here you specify it in a crypto to keyring and you name it.
You call it a key ring.
So go here crypto IP to keyring, call it here.
Then you specify the peer who is your peer, not the IP, just the name.
This name is local.
Can be anything.
This is just for you to know what you're configuring your neighbor with.
I can call this as R3.
This is where you specify the address inside the sub configuration.
151 .13. also.
Pre-shared key.
Now you can either specify pre-shared key or if you just specify Cisco, you're using the same key on
both sides.
Or what you could also do is you could say Pre-shared key local is Cisco.
Pre-shared key remote is Cisco one.
Two ways of doing it.
Either you specify local and remote.
That would mean you have to specify it separately or you just say Right.
Pre-shared Key.
Cisco like we used to do earlier.
So what's the point of having?
In nothing.
I think it's just a prop.
Something doesn't really make much of a difference.
You can.
The option is there.
You can do it if you want.
So in the key ring, what you'll say is PR R3, because most of the times you will not use it.
Most of the times you will use if you have a problem like that for security, you will use RSA signatures,
right?
You wouldn't use Pre-shared keys.
It becomes more complicated.
Yes, there is an option as an option.
So you usually you would say is pre shared key is Cisco.
Usually you would do this or.
You could also say Pre-shared key local Cisco.
Remote.
This Cisco.
Let's say Cisco three is remote and local.
Is Cisco one this year.
Reset the local Cisco one.
We should be remote Cisco because I'm creating my tunnel.
So if you have a look now.
Actual crypto configuration.
Why is this good enough for you?
Because later, if you have ten tunnels, when you look at your keyring, you will know which key you're
using.
Right.
You'll know that you're doing this with R3.
The address of R3 is one 5123 So streamlined.
Even in configuration.
Much easier to.
We didn't have so many bullets in killing us.
So we can if we want to move and we will talk about.
You just have to add that we're in the key.
That's all.
That's why it's better, right?
Tomorrow we have our four.
Where will you add it?
Right here, right under his nose.
You just add another beer, right?
Done.
The last thing that you have to do is crypto.
We call it V2 profile.
You have to bind all of these together using the profile.
Now, this can be called anything.
I call it Ik from I to Prof.
It says a local and remote authentication method has to be specified.
Authentication remote.
But how do you want to do it?
You want to do it?
EAP is also there.
EC Electrical curve.
There's another one.
DSA signature, Right.
New ones have been introduced.
What I'll say is remote pre-shared and local is also.
Authentication, remote user authentication local is also present.
Then it also says you have to match.
Match identity.
Remote address.
Basically specifying your peer.
What is the address of the other side?
Match Identity Address.
Now, it doesn't necessarily have to be peer.
You could also say it's fqdn.
If you have a domain name specified.
If you're using key IDs.
If you're using an email address.
You can specify that.
But for that you have to locally specify.
Identity local.
So local identity address which you use from here should be used from the other side.
So let's say I want to use Fqd and so I'll say cisco.com.
From the other side should be match identity remote cisco.com.
You can do it based on an email address.
If you specify key ID, if you specify.
But most of the time, what do we do?
Address.
What do you mean by it's just.
You can specify any so you can say match sorry, identity local.
You can say email whatever.
At Cisco.com.
How does it work?
So when I send right, when I'm creating my name, when I'm creating my relationship with you, I'll
send you my email address.
You send me your email address from here.
My local is what that cisco.com when I receive from the other side, what should I receive?
Dot Most of the times you always use address.
You say identity local is 151 .15.1.
Then when you send your remote you'll be sending it to 12.1 right for here.
For example, when I say match identity remote address, what did I say?
151 .23.3 So when I'm sending creating my relationship, I'm sending which address going to which address?
151 dot 20 3.3 The other side is local should be that which it is, which is correct.
But if you know know you have to configure one way of doing it.
At least one way.
Either either address or your email address.
Most of the times you'll do it based on address email router doesn't have any, but if you you can configure
right, you can say identity local address email address.
So I can specify an email address.
Just an identity.
Exactly.
So it doesn't mean that the physical address or something.
No, no, no.
Any address you could use any address here.
But again, the local which you use here should be the remote from the other side.
Yes, sir.
That's all.
That's all you have to match.
Exactly.
If you don't configure the local by default, it will take the public one.
If you don't configure the local address, which I did not configure here.
If you check show run section crypto, it actually doesn't make any sense.
What do you want to do, Max?
This is extra security to match.
I'm creating a tunnel with you.
Right.
Earlier, when I used to create.
What was the only thing that should match Cisco Key to add extra security, They said we'll add something
else.
Now they have to verify their identities when they're creating themselves.
They have to verify the identities which can be done based on domain names.
Right.
So domain name on your side and mine should be the same.
So if someone in the middle is spoofing, he will not know what the domain name you used.
What was the domain name that you used?
You could do it based on email addresses so the guy in the middle can try doing it on domain names,
but he doesn't know that you're not using the domain names.
You're using email addresses.
Right.
We could do it now.
Low security would be doing it based on addresses, just normal addresses.
But again, most of the times since it's very entirely new, people have not been exploring new options.
Right.
Very new.
This technology, you can do all of these features in there.
So how do you do it?
I agree to profile.
I'll call it I to.
So when I say match, first of all, identity remote.
Either you can do it address or domain name or email address, whichever you want.
Let's say address for our case.
If you got three then you also say authentication remote is pre-shared authentication local also pre-shared.
Then you have to specify the key.
Heating.
Don't forget the keyword local heating, which has been specified locally.
The address of that heating is what?
Yeah, That's how you're done.
That's what we'll be doing now.
This is just hitting local.
What you have done is you have only configured if you compare it to if you only configured this part.
That's it.
You have not moved to the second phase.
Phase?
You have completed all the phase parameters, but you transform it and everything will remain the same.
That's a good thing.
You only only mention here.
Yes.
Instead of saying authentication pressure, now you have more options.
You can say remote authentication.
Local authentication.
Remote is pre-shared, local is RSA.
That's it.
I cried Ike Internet key exchange.
Then we can use.
Yeah, sometime you can.
You can.
We'll see that in brief.
If you're not changing the default behavior of it, you don't use the profile.
If you're changing the default behavior, then you need to use the profile some some time.
We are using sometimes.
Yes.
Sometimes we'll see.
Tomorrow we'll also use a key ring there.
When we are doing VRF, we'll be using Key Ring along with Isakmp.
Also at that time we'll have to call the Isakmp profiles inside.
Yes.
Now again, going back down here, this is just an hour, so don't worry about this.
You're doing the same thing.
You have more options here instead of just specifying the address here.
Now you have more options here.
Also, instead of just specifying one key, you have more options here, but you are actually basically
doing the same thing.
What about the other features?
Crypto IPsec Transform set?
See this at ESP Peter's ESV.
And let's check out in the new version.
Do I have?
Do we have new options?
These are tools I use the iOS 15 iOS in 15 iOS.
We get again, different variations of the same thing.
So ESP you could have three days as there's right?
So let's say I want to use as.
He did not have anything like.
Yes, no encryption.
We no encryption.
So you have this, right?
What else do you have here?
Now, again, you can specify which one do you want to use?
128 192 or 256 So I could say 128 for example.
Then do you want to use sha MD5?
Let's say MD5.
You can specify more.
That's h if you want to use, but right now you only want to use MD5.
So let's do that.
Then what else do we have?
Let's copy this.
What else did we specify in our site to site tunnel
ACL.
So step.
Let's call this step two.
Step three is.
Access list 101 permit IP going from ten.
I'm going to ten 330.
And finally, crypto map I map ten IPsec
IPsec profile, where we apply it.
Apply it.
You don't have a tunnel.
You have a tunnel.
You use that set here.
151 .13.3 Match address 101 set Transform.
Set.
Set eight v2.
This is the one extra step like we do profile IP.
This is one extra step.
You also have to bind the V2 profile in here, basically telling him that I'm not using icecap, I'm
using it v2.
None.
Very applied interface for one zero.
Crypto map.
The camp is on show the detail.
This command is not here to show you which code numbers are open.
Done.
Right.
This part is done.
Let's figure.
Let's configure the other side.
Let's copy this first.
Yeah, I'm just going to paste it here and then make the changes proposal.
Let's say this side is only using because I don't want to confuse him.
It can if you want to, but usually on the other side you only configure one part.
Let's say group five, the server has all the policies, the different variations.
The clients will only have the ones which they require to make with the server.
Policy remains the same, prop remains the same keyring r1.
The address is.
Up.
So I'll be copying this one has to be the name of.
No, no, no.
This is just a local name.
This is just a local name for a local name locally for you to know.
So I can also call it site one.
Yes.
Description.
Yeah.
For you to know when you check your running configuration, you should know.
Okay.
This is site one.
This is side to side three.
Okay.
Just like this.
Yeah.
Local.
Local to the clients, local to every router.
So here address is 12.1.
The local key is three.
Remote key is one high profile remote address is 12.1.
No remote address that that's also here from here.
Also remote address.
I told you if you don't specify the local, it will use the public address.
Right.
So I'm using here the local address as 23.3.
The other guy is using the local address as 12 dot.
So if I don't specify, my remote should be 12, his remote should be 23.
That's it.
Okay.
Authentication local remote is pre-shared.
Local is Pre-shared key ring is key and this is done.
So you copy this.
Copy this and control key is not working.
So.
It's.
You need to copy it.
Where on R3?
Right.
So this should be okay.
Then.
We need this now.
Copy it.
Just you should not be thinking.
Oh, okay.
Yes.
No, that was not the mistake.
It will still paste.
I have added a.
An extra space it should face anywhere.
Then the rest is also the same.
Transform set remains the same and I'll just reverse the set.
Pair should become one.
Everything else is same.
Right?
Copy it and paste it.
And finally interface for one zero crypto map so you'll see that it works the same way.
It will be triggered when you have interesting traffic.
All those things are the same.
It's just that the exchange in the first packets, the camp exchange will be different now.
Everything else will be the same.
Okay, let's try and see.
To make this work.
All I have to do is send interesting traffic from R3 to R1.
So that's ten 111 going from source ten .3.3.
The packet goes through, but the important part is in total of four packets.
First packet.
Security associations.
I'm sending.
What?
Protocol is I'm sending encryption as three days.
I'm sending my PRF as pseudo random function.
We are sending also a mad MD5.
We are also sending RD which group?
Number five.
Then you have your same key exchange.
You have your nonce, you have your vendor IDs, your nat and everything is happening on.
So the first two packets cover everything, but the size is huge.
405 hundred earlier, which was around 150 and 200.
Now it's 500, 500.
The packet size increases as compared to the earlier one, but everything else is almost the same.
Then from here you won't see anything onwards because it is encrypted and authenticated post so you
don't see the encrypted data right here, but you don't see anything.
Right.
Same process is happening.
So if you check the verification, if you check your second tunnel show Crypto IPsec essay, you will
not see a difference.
It is exactly the same.
No difference at all in the IPsec essay.
But if you check your show crypto Eissey campus, you'll see that it is empty.
Why is this empty?
This is what I should be like was the first.
The whole thing has changed.
It's not camp anymore.
It's more like V2.
If you check local is 151 .23.3.
Remote is 12 dot one will do later.
Status is what?
Ready.
The tunnel is up.
Basically, it's not called idle.
It's called status.
Instead of calling all those different states, it will just tell you what the status of the tunnel
is.
What have you negotiated upon?
Three des MD5 bch group.
Authentication signature is you send, you'll be sending and receiving Pre-shared Key Remote Pre-shared
Key Local Lifetime 86,400 seconds.
You have chosen right now one one three seconds have passed by.
You can also go into details.
Right.
So in details, what you would do is if you have specified you have your IDs, it will tell you your
local ID, remember, identity, local identity, remote match identity.
Local local identity is 23.3.
Remote identity is how many messages have been going through this, right?
Nat has not been going through and Sgt is trust security.
Now this is these are certain new features, security groups, these are new features which are included
in your ISC, right.
If are not being used right now.
But that's what Cisco is moving towards.
Trust security.
Where is device where is device can communicate to this server and make sure that they are part of the
same domain and a lot of different things.
It's like, for example, let's talk about a person, right?
A person who's coming to a company.
He has four devices with him.
He has an iPad, he has an iPhone.
Bring your own device based on security groups.
So that user will be linked to that one profile security group.
Doesn't matter which device he has, doesn't matter how many different things he has.
All of those devices will be pushed down with the same policies based on his security groups.
So his laptop will have the same policy.
His phone will have the same policy.
His iPad will have the same policy.
You grouping devices together?
The same concept.
Not exactly the same, but somewhat close is the concept which they brought into it.
Again, very new, right?
Still in experimentation with all these new features.
Right.
But all you have to understand is this part which is important for you.
Is this clear how this works?
Just requires a little practice.
That's it.
It's new.
Yes, but with a little practice, it's easy.
What are you.
Which.
Which group part?
Does it need to?
The client doesn't need to know what one.
The group number.
Yeah, it's five.
Yes.
See, the thing is on the server.
I got your question.
You're saying that if the server does the client need to know which group should I use?
This one.
Is it?
Yeah.
Oh, you're saying the client.
Can I use two, three and five like that from the client?
We can, but again it'll be based on priority.
So when the client goes first, he will try to do it with five.
First five will be checked against all the server sites on the server side and has 251 say 251 it'll
be, it'll be negotiating on five because five will go and check with all the server policies here we
can mix and match.
Yeah you can if you want to, you can, but usually you would not because that would defeat the purpose
of why you're doing this.
Usually one side which we know that is going to create multiple tunnels, you'll create all those policy
sets on that side.
It will work in any way.
It will work if you if you if you do it this way, also, it will work.
So if you choose 5 to 1 here, it will negotiate on five because five will be matched on the other side,
Right?
So five will be checked with all the server policies.
Does it match?
Goes with the other one?
Okay.
That is based on crypto maps like we do based on crypto maps.
Now you can apply the same thing to everything you have done until now.
How do you apply it to a time?
I will do that after the break.
The same thing.
You just have to do it in a profile.
I'll show you how to do that.
After that, I'll create a tunnel between R1 and R4 and I'll apply the same thing here.
We have another profile which profile I go to profile.
We have.
I will use the same profile.
Okay.
It's the same exact profile and we'll create a tunnel between R1 and R3.
KeyRing.
I have to change.
I have to bring in a new keyring.
Right.
Same keyring.
I have to add a new pair and I have to do something else.
We'll do that.
Sorry, would call that.
We'll do that.
Let's keep it as suspense, right?
Let's take a break.
A club in what?
Furnitureland?
What is the problem?
It's not working.
Yeah.
The command is not taking
up here.
So it's a multicast.
Dynamic is not working.
The command is not working.
Did you shut up?
No.
Shut the tunnel.
After you do that, try this.
Okay.
Bring it.
And then.
Like this?
No, it should not.
Yeah, it should.
Should work properly from the server side.
Basically.
You're then specifying remote.
In this case, packets are there.
Two packets are coming.
Packets.
But routing protocol is.
Okay.
Multicast is not properly properly.
It's not getting the clients.
It's not going.
Clients or neighbor comes up from which side.
Client or server gets the neighbor.
So servers and multicast are not reaching the clients server, but packets are capturing the packets.
Packets are.
Packets are going.
We'll see.
Just bring it tomorrow.
Maybe we'll have a look.
So what we are is something related to routing, right?
Is when you divide one router into two something, there is something related to the routing table,
right?
Yeah.
Two routing table.
Everything will be split into half.
Router will be split into half, so one router will be two routers.
Okay.
So your interfaces will be split.
You can only use one interface and it comes in, but you have to do it because it's important.
So what we'll be doing is configuring a tunnel between that.
Between R1 and R4, a simple tunnel between R1 and R2, SVR like we've been doing until now.
Or we can do it on also does not make a difference.
So tunnel between R1 and R4 should be able to cover it.
First of all, let's create that to then protect it later.
Tunnel zero IP Address 19216.1.1.
Zero tunnel source for one zero tunnel destination.
150 .1.24.4.
Simple, right?
And from R4 I'll do the same.
Interface tunnel zero IP address 1921681.4.
Kernel source.
Fast Ethernet one zero.
Kernel destination 153.1.2.1.
Okay.
Send a ping to 192 168 .1.1 successful.
But it's just it's not protected.
It's open.
Right.
So you see that not protected to simple tunnel between whom R one and R So now I want to protect it.
Let's try this out first.
192 160 810.
Okay.
This is about one.
This is dark.
Correct.
Now, how to protect it.
Let's do it from our.
First, the easiest one, because I have the policies already.
So from here, let's say I'm using as.
Because the server side I have configured what is 256.
So from this side I'll configure the other side is using three days.
This side will use yes, let's say group two and five.
Right.
Keating.
Who's the peer?
R1.
Correct.
Pre-shared Key.
Cisco or remote?
Local.
I could do it that way.
I'll just use Cisco this time.
I will not use Cisco.
One, two, three.
I'll use Cisco.
I'll use one key authentication.
Remote address is same.
Pre-shared.
Key Pre-shared key.
Local.
Everything is well.
Be sure both sides are using Pre-shared key most of the time.
You will do this.
Remote is also using Pre-shared key.
I'm also using Pre-shared key because I'm not using digital certificates.
Right.
Copy this.
Paste it on our phone.
Then.
Done.
Then the other stuff is the same.
What stuff transforms that you need.
So just copy the transform set, paste it here.
Also need a profile.
No.
Need an IP.
No.
Yeah.
No need access list.
Set.
Transform.
Set reset.
Also set to profile.
So earlier I used to apply this on the crypto map.
Since I don't have a crypto map on an ACL anymore, I'll apply it on the profile.
You do have two profiles, right?
Two profiles here on R4.
No.
After I only have one, you have a profile I drop and that one is my profile.
This is IPsec profile.
That one's I32 profile.
So if you check your crypto, you'll see that you have a proposal, a policy, a keyring, a profile.
But this is i32 profile.
So in your actual IPsec profile you call what I give.
Where do you apply this interface?
Tunnel Zero Tunnel Protection IPsec Profile.
I.
Heisterkamp is on from this end.
Also need to do the same thing on R1.
Now what change is on R1?
R1.
If this stuff doesn't change, your proposal doesn't change.
You add another in the keyring, add another peer.
So let's configure that part on our own.
KeyRing is the same.
Peer r r4.
The only thing is I have to check the other part.
Let's let's do that address.
151 dot 20 4.4.
Pre-shared Key.
No remote, no local.
If you just specify one, you'll only be using one.
The same for sending and receiving.
Then to profile right here, I need to make sure that I'm doing the same thing.
I think I might have to use a different profile.
Why should The profile should be different.
But let's try.
If I can specify a different match.
Address has to be different.
Yes.
That's why I agreed to profile.
I agree.
I agree, too.
Yes, I agree too.
I agree, too.
But let's just just check.
Yeah, it has definitely has to be different because I have to apply it in the transform set.
Right in the profile.
So in the profile, I'm not applying the same address.
Otherwise you have to get a different one.
Yes.
Not specifically there.
Yes, exactly.
So this will be I pro for R4 match identity remote address.
This one I have to specify it as 24.4.
Right.
Then authentication remote is pre-shared authentication local is the keyring that I'll be using is the
same because the pier.
I have the pier has been specified in the keyring.
Then transform set the same.
I need a crypto IPsec profile i prof.
Set transform set.
I'll use the same transform set set hike v2 profile I to Prof.
This is.
Interface Tunnel Zero Tunnel Protection IPsec Profile.
I.
So Crypto IPsec SA Caps.
It's working.
Correct the marker.
Also let's do router one network 19216810 north.
Look.
Ten 0000.
R1 Router one Network ten 000.
Nortel Network.
19216.
He has out Wellington.
I have the route to ten .4.4.4 with a source of ten dot one.
You check your wireshark.
This should go as ESP, but 198 because of all those added headers, how do you stop?
It transforms.
You can create change the mode to transport or change the tunnel interface.
Tunnel zero tunnel mode IPsec IPV four from this end.
Also from the other end.
Colour mode.
Ipicyt.
It does not.
It seems the mob from the other side also.
Right.
Good enough.
The same thing.
The only thing I did was I went to the other side.
I applied everything.
On what?
On the profile.
So I copied the same thing.
Then I went to crypto.
IPsec profile at it.
Set.
Transform.
Set.
Ik v2 profile.
Ik two.
From.
That's all.
And then you go to your interface Tunnel Zero Tunnel Protection, IPsec Profile High.
As simple as that.
So earlier in a normal crypto map, you would apply the set IQ to profile under the crypto map, right?
In a tunnel.
You just apply it wherever you want to and then do the prediction.
So if you want to have a look at the whole thing, it's.
It's this.
For the profile.
This is what it is.
That's it.
That's how you protect a tunnel.
First, your policy is all here.
After that, you already know this part.
The policies are not the policies anymore.
You have to be careful about the pre-shared key, the authentication, remote and local, and the key
that you are using.
That's it.
Once you're done with that, well and good.
Okay.
Another thing which I want to show you is before we break off, if you go to your crypto to keyring,
you specify a let's say are in the pair.
You have pre-shared key, right?
You can also specify an identity address here which address should be used because sometimes you might,
sometimes there is a possibility where you might have RF running virtual router forwarding running.
That is where you use a keyring.
That is where you use this address.
Identity address, identity, local address.
Right.
We'll talk about more, more about RF later.
We'll see how that is done.
Right.
There'll be a full document on it, full lab on VFS and how to apply VPNs.
When you have VFS running on a router, VRF is nothing, but you break down one router, just an overview,
you break down one router into two.
Right.
So the problem with that is when you break down a router into two, this will be one router, this will
be another router.
One interface can only be part of one router.
We call it a virtual routing router forwarding.
So if you use this, if you put this interface as a part of this router, this router will not be able
to use the interface F10 anymore unless you subinterface it and one Subinterface you make part of this
guy, the other one part of this guy at that time.
When you run VPN you will not be running it with the router, will be running it with this instance
between this and this router.
So your tunnel will be like that at that time you'll use this.
Just keep this in mind.
So later we know how to apply.
Clear.
That is your too.
Also, some people might call it flex, but it's not really flex.
It's just like to normal side to side tunnel using ikev2.
Then you have other instances in it where you can do server client server client model, just like your
VPN.
You can do hub and spoke and you can use site to site.
Those three are different modifications which are known as Flex.
Why flex?
Because earlier until now, which you saw, if you remember, site to site and you compare site to site
to dmvpn, both are completely different in configurations.
If you remember, in all those different things happening.
Right.
And then you compare that to remote access VPN, imagine the difference.
Remote access is entirely a different ballgame.
What they have done with Flex VPN is a similar configuration for all for all three.
So when you're doing when you're going from Hub and spoke to server client, you don't have to change
much.
Just 3 or 4 commands here.
Change done.
That's why it's called flexible.
Tomorrow we'll do our.