IPsec side to side VPN on the RSA.
All right.
So it's going to be like this.
I have one side which is connected to the Internet just like the other side is.
But this side is connected.
Via what?
A firewall.
So the edge device on.
Side.
A let's say this is side A.
The device is not a router, but a firewall.
On the other side we have a router.
So we'll see the significant differences between the two.
Okay.
Correct.
First of all, let's configure the pics.
I've configured everything else.
I just need to configure the pics.
Let's see, what interfaces do I have?
E two and e three now pics.
AC is the same in this case.
Comfy interface.
Ethernet two is the one pointing towards our two pointing towards the internet.
IP address or let's say name is since this is the outside interface.
Security will be zero.
IP address 151 point 20.10.
No shut and rout, a default route pointing towards 20.2, the Internet.
Let's see if it's working.
I can go here.
Can I go to 151 .15.1?
You go to 12.1, which one is 12.1 or 1?
So picks and R1 can communicate to each other.
I also need to make sure R3 can communicate to the pigs because my tunnel is going to be from 3 to 10.1
from 10.3 to 10.1.
Correct.
Let's go to the pigs to the other interface.
Ethernet three Name F Inside Security is 100.
IP address is ten three 310.
And.
No.
Think.
Ten, three, three, three.
I can communicate to R3 also.
Right.
R3 has a default route pointing towards the firewall, so the firewall has a default route pointing
towards the internet.
R1 has a default route pointing towards the internet.
Now, same concept.
Nothing changes.
Same, same.
Icy campus, Same same IP.
It's just that the implementation is a little different.
I might have some of the configs from before.
Right.
Let's see.
Let me just remove.
Sorry.
Between will be one end of the tunnel.
The other end will be R1.
Until now, what we've seen is what R1 and R1, R1 and R2.
So router two router iOS to iOS.
Now we are doing it from Asia to iOS one end is is the as you can do, Asia and Asia also if you want
to.
But I just want to show you that it's just the implementation.
The concept is the same.
The packet exchange is the same.
Step one on the router Crypto Camp Policy ten.
Encryption.
Three days.
Authentication.
Three Share.
Hash MD5.
Crypto.
AC key Sysco address 151 2010.
Crypto IPsec.
Transform.
Set.
ESP 3ds esp d5.
Access list.
Permit IP from ten one one 0 to 10 330.
Crypto map.
Map ten IPsec Isakmp.
Said here.
One 51.20 ten Match Address 101 Set.
Transform set to set.
Interface for 00000.
Crypto map?
Correct.
I'll paste it on.
France.
From ESP.
Correct.
Show run section.
Let's see how to do the same thing on the.
Same thing on this.
Let's go to the first.
Now, this is 8.2.
There is a difference between 8.2 and 8.4.
Let's do 8.2 crypto isa camp policy ten.
Same It requires a activation key licensing.
Check your version right now.
VPN is not supported.
What do you need to do?
Yeah.
To.
8.4.6.4 comes with the license.
Save and restart.
We'll take a little while.
It doesn't restart by itself.
You have to manually go and shut it down and bring it back.
With the command.
It doesn't work.
Routers do, but this guy doesn't.
Fix.
I saved it, right?
Yes.
Running for this anymore.
Enabled.
So version.
VPN is enabled.
So crypto is a camp policy.
Encryption again, same three days authentication.
Please share.
Hash.
Hash is what MD5 group is.
It also supports seven.
Because again, it's newer than the iOS version, which I'm using the newer version.
You use the more options you get done.
So first step is exactly the same.
Exactly the same.
The difference comes in the key.
Just like you saw in the VR, we specified the key as what, A key ring here on the firewall.
The way it's done is the same process which you will see now will be there for all the corresponding
VPNs after this.
The key is not specified in IEC crypto Isochem key.
Specified in something we call it a tunnel group.
We call it a tunnel group.
Then you give the IP address of the peer.
Tunnel group.
What is the address of the peer?
151 dot 12 dot one And then you specify what type of a tunnel is this?
Is this an IPsec?
L2L array is not used anymore.
It's either L2L or remote access.
This one is what l2 L means Side to side, right?
Land to land.
So IPsec L2 then you do the same thing again.
Tunnel Group 151 .15.1 You'll get more options.
General Attributes.
IPsec Attributes.
IPsec attributes are used for either specifying are you using RSA?
If you're using RSA, you'll point to a trust point from there.
Or if you're using a key, you'll specify the key where general attributes is used for other features,
like pushing down the pool, split tunnel and all those other things.
Right.
So right now, side to side, I don't have any pool or anything.
No, no complications.
So I'll just do IPsec attributes.
And here you have either a trust point, you either point to a trust point or.
Three.
Shared key and you specify the key, let's say.
That is the difference.
The big difference between the two.
That's all.
The other step IPsec Transform set key set esp three des PSP MD5 extract same.
Access list permit IP going from ten.
330.
Now, since this is an RSA, you don't use zero dot, you don't use wildcard mask.
You use subnet mask going to ten 110.
That's it.
The last step is different.
Now, the way I explain it is this way.
So.
History.
I'll just copy this.
Right.
Remember this?
When you give an access list 101 or let's say 100 and you say permit IP from any to host ten 111, just
an example access list 100.
If you have to add another nine, you would do something like this.
Right.
If you're using standard ACL, how will you do it?
IP axis list extended.
The 300.
Then use permit IP any to host ten 111.
Permit.
IP from any to host tend to to to correct.
You'll go into the sub configuration mode.
That is the same differences between the pics and the file.
Sorry, between the pics and the iOS on the iOS when you see a crypto map.
The crypto map is in a sub configuration mode.
So you do the crypto map once, then you specify everything under the sub config.
On the assay.
Its opposite.
There is no sub configuration mode.
So you have to add these commands to the crypto map every time you configure it.
How?
Crypto map.
Map.
Correct.
You specify the sequence number, then all the options which you have are used here.
Set.
Transform.
Set.
D set.
Same crypto map I mapped n match address 101.
Right.
What else do I have?
Papier mache.
I did appear so set.
Beer.
151 .15.1 Same three commands which you use there, but there you use it under the sub config mode.
Here you use it with the crypto map.
Also, the way you apply it to the interface is different.
There you go.
Under the interface and you apply here.
Even in access group, you say, How do you apply an access group?
Access group in interface outside right from the global config.
Same thing for crypto map.
You say crypto map i map and you specify the interface interface.
Check this out.
If I use outside right.
Usually until now, whenever you have used the firewall you never saw or use this or think thought of
this as a case sensitive command.
Right.
If I do this, he tells me that outside does not exist.
It's just that whoever created this made this case sensitive.
Most of the times you will not need the case sensitive part of it, but here you use it.
It has to be.
Otherwise it will tell you that it does not find that interface.
Make sure that you keep that in mind.
Correct.
Everything is good.
I have applied it to the interface.
I have an access list.
All well and good.
The only one problem right now is what?
Not out to him.
Remember I told you by default to traffic to a firewall is blocked for everything except for which protocol.
ICMP.
This is also going to be to traffic.
It's going to be a scam to traffic control.
Plane traffic.
Correct.
It's going to come to you, negotiate with you.
So you have to enable it.
Just like how do you enable ICMP?
You say ICMP.
Permit any on the outside interface.
Here, the way you do it is crypto.
I can enable.
Okay.
Enable the ice cap on the outside interface.
So I can accept Isaac features.
Do not forget this.
This is the most important thing that you have to remember when you're doing the assay.
The most important because this you tend to forget because everything else is you just copying it,
right?
This is the command which is extra.
If you copy paste, it should be fine.
So you repeat.
I'm not sure how you do it here.
I don't know how to check the votes here.
I'm not sure if there is a command.
Also also in the router, not all the router is supported.
Here it's supporting traffic to the.
We can compete with an.
Yeah, but why?
That's the way they decided it.
They integrate this integrated the two control plane traffic was kept separate and data plane traffic
was kept separate ACLs were for the data plane traffic.
If you want to control the control plane traffic they are disabled by default.
You have to enable them one by one, your telnet ssh, all of that traffic, you have to enable it.
I lose all the control.
Those are all control things.
The services which you enable for it, those are control plane.
Okay.
Management and control can be used inter interrelated to each other.
Control plane has management plane in there.
Why?
Because control plane will have telnet ssh your isochem and routing protocol.
Traffic out of that traffic management plane only includes the traffic which is used to manage the router
which will be telnet ssh ip sctp.
And SNP.
All right.
So only a few protocols become management, but there are also two traffic, so come under the control.
Then save.
You want to see if it's working?
I'll send traffic from our three.
210 .1.1.1.
This capture.
The commands to debug show crypto a campus.
Initiator is active, so it's not able to negotiate the policies.
So Crypto IPsec is same.
Exactly the same.
No difference.
No, it is encrypted.
It is active.
No, active here means it's done.
So encryption is happening.
From which side?
From this side.
Where am I sending the traffic to?
Ten .1.1.1.
I don't think I have a loopback here.
Yeah.
Routing problem, right?
Encryption is happening one way and it's not getting decrypted on the other side or the return traffic
is not coming.
So.
Goes through show crypto.
IPCC.
Exact same thing.
You will not see any difference here.
Any difference here?
It's exactly the same.
10.3 to 10.1.
Right.
Your end point is the same.
How many packets have been encrypted, decrypted, remote end point, local endpoint, M2.
Your ESP, you are using a land to land.
Right now the mode is tunnel.
Right.
Same thing here.
ESP total amount of time left on the tech total amount of data left on the on the data portion of it.
Correct.
If you go to R1 show Crypto IPsec Campus, it shows you the same show.
Crypto IPsec.
Essay will show you.
The second packets are coming and going along.
Okay.
No difference at all.
That's why I said it's easier now because you know the concept already.
You know how the exchange is done if you really want to see this.
What I'll do is I'll clear the tunnel from one side with ice and you clear the ice.
It gets cleared from both ends.
Right.
So you see some informational messages going through and then I'll ping again.
Your exchange is exactly the same.
Same nine packets.
No difference at all.
Informational messages are sent.
When there is something, there is a mismatch in something.
Right now the mismatch comes because R2 is not supporting R1, I think is not supporting fragmentation.
You just have to use this command to support fragmentation.
Right.
But again, compatibility is something is not matching, which will not affect the tunnel, but for
their control planes or they're exchanging informational messages.
Keep on doing that.
Okay.
Deeply.
VPN group filter that's used in VPN.
To control access, General.
On is what we call it.
For example, you want to filter.
You have a split tunnel already, but you still want to apply a filter on the users who are coming in,
don't want them to access everything.
You can apply a group filter.
Yeah.
Side to side.
I don't think we use I don't think it's important.
Right.
So again, the good thing about the essay is what?
There's a command called VPN setup.
And you specify.
What do you want to set up?
A side to side tunnel or a remote access tunnel?
I'll say side to side tunnel.
And then you use the command steps.
Check it out.
It tells you exactly what to do.
Tells you exactly what to do.
Go to the interface, enable it, give it an IP.
Go to.
Now, this is this is just a demo, so don't use these addresses.
Change your address.
You can do that also.
Right?
But it shows you the whole process.
So this is how you do your policy, right?
It does not specify the group by default.
It'll take two then.
You have your transform set?
Correct.
Nice.
Right access list L2L Tunnel Group Specify the Pre-shared key.
Exactly this diverse route.
Also, you could set if you're giving out addresses and enable it on the outside interface step by step.
Everyone wants this command VPN setup.
Definitely.
So not only show you here, I'll show you easy VPN to all those things.
You just have to specify which ones will show you everything, what you have to do.
Right.
But I would recommend that you don't go through this.
Use this as a disaster management when you don't remember something because you understand the concept,
obviously you'll have to do it the other way.
Then this is just to check it is there on the essay.
It's not there on the iOS.
Everybody good with this side to side tunnels using the AC.
We also have.