This is hub to spoke and then spoke to spoke.
First a hub and spoke.
Then the spokes will talk directly.
Okay.
My topology.
Same internet.
I too.
R1.
Three.
And our what we have done until now is created static tunnels with this guy.
SVT is with this guy.
We'll do the same right now.
We create the same tunnels with this guy as well as this guy from here and here.
But we'll do it in a way so that when the folks have to talk to each other, they create.
I create a DVD, I change.
The creator.
DVD.
If I have another spoke here.
Create a DVT and even between these.
So different duties.
This will be one between R3 and R5.
One between these two and between these two.
Virtual tunnels between different different vehicles.
Okay, This point here, is it going to be a TV or a SVT?
This point, this will be a DVD because one guy is not the only one who will create a tunnel with him.
Many different will.
So the same like we did right now, a DVD.
But the one different thing here is now this.
I'm going to have a different color tunnel.
These are static tunnels.
Right from down street from up duties, but I'll have to make all of them part of.
Same group, which is done by network command.
Why, if they are not part of the same group, they will not be able to share information of nature
that is important in this hub and spoke topology.
The other thing is NLP is not supported on Pure IPsec.
This is going to be a kind of a setup.
So I will never do tunnel mode.
IPsec IPV four.
I will always be doing an Mgr, which is a default mode.
Tunnel protection will definitely be there with the tunnel protection.
Okay.
Gary, is not Cisco proprietary?
Gary is open.
IPsec.
Cisco IPsec Profile.
The one which we create.
Crypto IPsec.
That is Cisco.
It's also a part of everything else.
But this this thing that we're doing is Cisco.
Is Cisco's IPsec is a suite is not Cisco's.
The implementation is Cisco's.
With Gary Moore is open.
Yes.
Gary Moore as a whole is an open strategy.
Okay, then let's do this.
Clear this all.
Close this and don't need this now.
We'll do some policies before the break and some after.
First things first.
I need to push down my pool in MVP and we don't do it.
But here I'm going to do it.
Why?
Because I need to have similarities between the MVP and an server hub.
Server Hub and server client and hub.
And spoke.
So the similarities will be that both will be providing the pool, but at that time you need a username
and password.
Here, you don't need one here, you just need a tunnel from that side to here.
Okay, let's do this.
First things first.
Authorize the network.
To use the parameters for policies locally.
How a new model, a authorization network.
I can use money, but I said for this for an app to work, it has to be.
The following.
Okay.
To.
Configure the default crypto.
Ikev2 policy.
So that.
It sends pushes down.
A pool of addresses.
And also.
Install a static route to the local.
On the remote.
Playing.
For this.
Step.
I make this Step three.
Step two will be create a local pool.
That will be.
Send it down to the.
That's.
Local school.
Flex pool ten.
What is the crypto policy?
Crypto Ikev2.
No crypto authorization.
Policy.
IP through authorization process.
Authorization policy.
Call it anything.
I call the outside interface and pull.
The only difference between this and the last one that we did was this one will push down a pool.
He will also push down the static route.
Plus, he will push down that pool one by one, first 11, ten, then 11, then 12, then 13.
Okay, let's copy this.
Paste it here on our one.
Done.
Everything is okay for now until now.
What is the other thing?
The other thing, you know, from the back of your head.
What is it?
Proposal Encryption.
Three Tests.
Integrity.
MD five and Group two.
Then.
Speak up for proposal.
Proposal is prop.
Crypto ik v2.
KeyRing here is any.
Address one nine.
0.0.0.
This is the hub.
The hub?
Anyone can come in, right?
Pre-shared key.
Then follows the second part.
Crypto like V2 profile.
Mycroft.
Match Identity.
Remote Address.
0000.
Authentication Local.
Authentication remote pre-shared then key ring local.
I always forget that.
Then virtual template.
Why?
Virtual template.
This is a DVD DVD on this side.
Right.
And finally, a authorization group.
Group I'm using.
List is default, which is pointing to the local and the username is.
Default which is pointing to the policy server.
That is a mistake.
If I did that, I should create the policy with the name of.
A good thing.
Should be default.
Okay.
It should be default.
Done.
This is the same thing I did before.
The only thing I did was choose a default here and push a pull down.
Pulled on to the users who are going to come up.
Okay.
Done.
What is the next step?
This was for five D IPsec specified.
The IPsec parameters to be used for.
Child.
If.
Set.
Transform.
Set.
Please sit.
PSP three.
PSP and V5.
Create the IPsec profile.
The IPsec profile, which calls the transform set.
And high profile that points to the local group.
Artist authorization.
Okay.
What is the command?
Crypto.
Leipzig transform said no, sorry, not transform.
IPCC profile.
I.
Prof.
Set.
Transform.
Set t.
Set.
I v2.
Profile like.
Good until now.
Is it the name?
Yes, I.
Prof.
I.
Prof.
Let's copy this.
From the proposal.
And paste it.
Nothing new that I'm doing.
You have done this before.
There's nothing new.
That is the best thing about Flex.
That is the beauty of it.
The only thing one thing I added was that food, everything else is the same.
So if you know one, you know.
All right.
One thing I need to do right now, the last thing is.
Create the virtual template.
Which will give out the pool as well as.
Be used for.
Hub to spoke.
Communication.
What was the virtual lemonade number?
I used ten interface virtual template.
Then do not forget the
I did not create the loopback.
I need to create it.
Is the same concept.
Why?
Right.
The same concept the last time.
Back and call it IP numbered loopback 11.
Tunnel source.
12.1 Tunnel Protection.
IPsec IP.
High profile.
High cross.
No tunnel mode.
Why?
Because I'll be using network ID ten and.
No, not in this one.
He chose chooses a different by itself.
You don't need to do in this case.
Okay.
This Why do I need this for the spoke to spoke communication so he'll tell the spoke Hey listen go direct.
Okay, Let's see if this works.
Yeah.
Am I missing something?
Which one?
I in to the profile?
Let's see.
I'm calling the profile here.
That is done in crypto maps set to profile.
Here we do it inside the this profile.
This calls to check here like we do profile.
So they should.
Work.
Okay.
It's up.
So my server side is done forever.
This is all I had to do on the server side.
Everything is done on the server side.
Okay.
I just need to go to the client side to do the other stuff.
I'll run routing protocol also.
From the client.
I'll just run.
Spoke to, spoke to.
Spoke to Hub Tunnel right now.
Spoke to.
Spoke.
We'll do after the break.
The policies that I need on the client.
Let's check those out.
Or we can call it spoke.
Let's go.
Do I need this?
Yes, I will use it.
Why?
To set my root set interface command so that he gets a static routes to me.
Not.
Not for the pool.
I do not require the pool.
So no pool.
I need this.
But only until here.
Only until here.
Then.
Proposal.
Yes.
Policy.
Yes.
KeyRing.
Yes.
What about the address on the keyring?
12.1.
But I.
We'll use a DVD also for those.
We'll use the same policies.
Where you can see for every pair you'll have to do a different key.
Then there'll be a little too complicated because whichever pair, whichever spoke you have, you'll
have to create a separate key here as well as do it here.
Match Identity Remote address.
You'll have to create that many entries.
So you you can do it zero zero.
Whoever comes in and has the same key is fine.
Whoever comes in to me with any source with this key, I'll accept it.
You can do it separate.
But in that case you'll have to create one for the server and one for each client.
A key ring for him.
A key ring for him, a keyring for him on that side.
Also, you'll have to create a key ring for him, a keyring for him, a keyring for him.
You understand what I'm saying?
Because it spoke to spoke communication and for each spoke you will have a different virtual access
created.
Okay.
So no need this.
Do I need this also the same, same same same same virtual template.
I guess right now I don't need one right now.
I don't need one.
But right now I need this.
Right.
And this is the same.
This will be different.
So until here, it's the same.
Except for one thing, which I'll change.
From here.
The only one thing is I don't need a virtual template right now because I'll create the straight one
going up.
And this is the same because the default one says push that interface down.
My parameters are same.
My transform set profile is the same.
The seventh step will be create an A static.
Tunnel.
Pointing to the.
Interface Channel zero IP address.
What is the address here going to be?
He'll get it from the other side.
The hub is going to provide him, but I'll have to put an IP address here.
Negotiated.
Negotiate the IP address from the other side.
This is the only one difference I'm doing on the client.
Everything else was the same, except I did not need a virtual template.
I will need it later, but right now I'm just doing hub to spoke.
So right now I don't need one IP address negotiated.
Dinosaurs.
190 21. 20 3.3.
Tunnel Destination.
12 that tunnel protection.
And.
IP and HP Network ID should be the same IP and IP shortcut.
But here with the shortcut?
No, not with the shortcut.
I'll have to.
I'll have to tell him where to take that shortcut from.
Way to take that shot come from.
I'll have to tell him.
Take that shot.
Come from a virtual template, which I'll create on you.
The name of that template is going to be ten.
There's no need to unload because I'm not going to create a pure IPsec tunnel.
I'm going to leave it as a default tunnel.
I'm not doing Mgr also here.
Why?
I'm creating a straight tunnel up and I'm creating a straight tunnel up.
I'm not doing Mgr.
It's not a multi point tunnel on that side.
It's not one interface connected to a lot of interfaces.
It's separate tunnels.
GRE tunnel here.
Okay, but a normal prior IPCC does not support MHR.
What supports the AP is gryr.
So that's why I have to announce.
I don't I don't need a mapping on the other side because I'm doing it through this tunnel zero interface
with the source and destination right here.
This shortcut is basically when he gets a redirect saying, Go here.
He needs to create a virtual access to go to the other side.
That virtual access will be cloned from where?
So take the redirect.
Take the shortcut.
Take the shortcut using this.
So create your virtual access based on this virtual template, which I'll configure after this.
So why is it not You do not require an NHS.
His mappings will not be solved by here.
His mappings will not be solved here.
The hub will do it automatically.
You'll see how I'll explain how NTP works in this.
You do not need an NHS to solve your mappings.
Why?
Because it's not an mg.
This is not an angry it's a normal hub is in the middle.
And then you have two people going through.
You will see when you run the routing protocols on it, the hub will automatically decide how to do
the mappings.
He'll just send redirects.
He's only capable of sending redirects.
But when these people receive the redirects, where do they go through through these virtual templates
which I just created.
So dropping.
Forgive us.
We don't need to.
Why?
Because in that case, remember, it was an MG.
So he did not know what the other side is.
Here it's a point to point.
All these tunnels are point to point separate tunnels.
By default, it's a tunnel.
I'm not changing the mode there.
Remember to do, spoke to, spoke.
We didn't create a separate virtual tunnel.
You have a mapping done.
He required the destination map, the destination address, source, source and source address, public
address.
And then he created the header and then he threw out here.
It's not the case here.
He will create a virtual interface between my side and the other side.
We'll see that when we create the tunnel interface.
You'll see what source and destination he uses.
For right now, we'll just create this.
And see does it get the address from the.
At least that should happen right now.
Did I do anything in here?
I did not copy anything.
Right?
Copy?
Nothing.
Copy.
Just checking.
Everything is all right.
Child This, this, this, and this.
So copy.
Done.
I see.
Camp is on.
Tunnel is up.
The tunnel has not got any IP address, so we need to fix that.
Where's my pool?
Flex pool.
Using the I.
I'm not supposed to use the pool I'm supposed to use.
The default.
So this is crypto ikev2 authorization policy.
You can check whether it's.
Which one?
See.
It says this will modify the original IP topology he was using.
I will because I did not configure it in default.
You can change the last default and go like.
Yeah, but I told you it will not work where it will not work when the nrhp is done.
Right now he's using that.
If we check right now, he should be using default because that's what I did.
Remember, I changed it down here.
Right here.
He's using default, so default has no pool that he gives up.
I need to set that pool root set interface and pool is.
Clear crypto sessions.
Since this is a grey tunnel, so I need to shut and no shut.
That was IPsec.
So when I do clear sessions, IPsec takes it down and brings it back up again.
This is a grey one, so it does not care about IPsec.
No address.
Still.
Oh, we got an address.
We have an address.
How did this address come into play?
The policy from there pushed it down to me.
Show IP.
Show IP route.
I have a static route.
Towards whom?
Who set this static route?
The route set interface on that side.
Does that mean our one should also have a static route?
Towards whom?
Towards 11.
So this guy is reachable to me.
Who?
Is reachable too.
If I run a routing protocol through, it should work.
Yes, it should work.
Right?
Do I have a I don't have a loopback.
Everyone should have a new bag.
10.3 Also create another one on our one.
Three should have.
Huh?
Thank you.
Good enough.
Good enough so I can go to what is the difference between the last one and this one?
There's only one difference right now.
Right now I've not done anything else.
It's just the pool.
This in the previous one for tunnel zero.
I said IP address this here.
I said IP address negotiated and I went to the server.
I said pool.
So he pushed that pool down.
Until now, everything else is the same.
The difference will lie with the DVT that I'm going to create now and you'll see how simple it is going
to be.
The only one thing with that is the concept which I will explain to you after the DVT is formed how
the mappings take place.
Okay, I have done this same thing.
I'll do it on R4.
I don't have to do anything.
All I have to do is change the source.
20 4.4.
Everything else is the same.
Nothing else.
Go to four.
And paste.
12 dot two.
Router EGP ten.
Who's my one guy?
The hub is the only neighbor I have.
The hub is the only neighbor that I have.
And the hub will have How many virtual accesses now?
One.
What have I created until now before we go on the break?
Until now, what we have done is this.
Until now.
This is R2, the Internet.
R1, The Hub.
Three.
Right.
So I always mess our four up.
Okay.
So we have what we have done is created a tunnel.
DeVita Here.
Created that tunnel right here.
One this way, one this way.
This end is.
12.
This is.
11.
This side is.
The site is.
But it's all happening on guard.
Why?
Because I'm using Npx Right now.
There is no mappings.
No one has done any mappings until now.
We did not require a mapping.
Why?
Because these were created dynamically.
He received this address from that guy, inserted the static route from this side.
He inserted a static route for 1.1 from this side.
This guy did the same.
Right now.
We did not do anything to NP.
NP will be used.
Now when this guy will want to go.
He will basically be using this source.
So this guy will require a
DVD, a DVD.
He will require a DVD, but he will not require a tunnel source and a tunnel destination that is going
to be provided by the source as well as the destination will be provided by whom?
And we'll see how NP will provide that.
Okay, let's take a break in this.
Yeah, the poll is.
Three and a half or three and a half, four years.
Allocating the same IP address to all because it is downloaded on.
This pool is downloaded to this interface of IP, he says.
Interface Tunnel zero IP address negotiated for that negotiation.
He asks him, Hey, give me an address.
Does this policy allow him to give an address?
Yes, it does.
His policy says root site.
Right.
And the pool.
So he gives them an address he uses that addresses his IP address.
Was just saying the pool on that on that.
Whoever asks you for the pool.
So the tunnel is asking for the pool.
Given the pool.
This tunnel is asking for the pool.
Given the pool.
Which this 111 and 12 because is.
See, this is the pool from the pool.
One at a time.
How does not pool give out IP addresses?
Dynamic pool.
You have a whole pool.
How does Dhcp give out returns?
First it gives ten.
Then he gives 11.
Then he gives 12.
Then he gives 13.
Right.
Which we give over here.
Yeah.
To download the pool to whoever asks him, give him the pool, Give him the pool address where it's
specified.
Here?
No.
Here.
Check this guy.
Right here.
Wait.
Let me remove this.
This is the pool we have specified and we have said pool for authorization policy sent in.
Right.
And we have called this authorization policy where in high profile this profile will call where in virtual
template.
So whoever asks this virtual template for a pool, he will go for his eyebrow to check for his policies.
I will give him transform set and this transform set is okay.
Then he needs to check the height of he goes to his height.
Prof.
Ike Prof is right here I.
Prof says authorization left is default goes to the default list which is right here.
Default list says give him a pool and take the IP out of this pool and give it to him.
The pool is here.
Right.
I understood the pool is downloaded.
Yeah, but from the same pool.
He is getting the address from this pool.
Yes.
I don't understand your question.
Where would he get it from then?
Yes.
Means I was thinking that the pool is downloaded.
Okay.
The part was for downloading the pool on one of the addresses from the pool.
Not the whole pool.
Oh, you mean this?
You mean he is downloading the whole pool here?
He's not downloading the whole pool.
Pool flex means one address from the pool.
It does not mean just push down the whole pool.
Down.
No, just give him an address from the pool.
That is that one address.
12.
So he gives him 12.
The other guy comes, he gives him 30.
After this, they will be communicating to him for the pool.
For who?
Which guy?
No, they don't need a pool.
Now, see, he has an address.
Where's this guy?
Okay, I don't have the thing.
See, R3 has the pool address.
What is it?
12.
Arthur has 13.
11 and 12.
When they want to communicate, they will require a source and destination.
Which one do you think they'll use?
They have 12 and 13.
Okay.
Using that only they will.
Using that only they will directly.
I thought that every time he will get a pool.
No, no, no, not like that.
He will not use a pool.
Then he will use the same source, same source.
And over there would have the the source will be 12 and the source will be 11 and they will communicate
to each other.
Okay.
We'll do that after the break.
Okay.
To.
The breakup video?
I don't think so.
All right, let's move forward.
What am I supposed to do now?
I'm supposed to create that world wheelchair interface.
Virtual interface that will guide my device between the spokes.
I do not need a source and destination which will be provided to me by the Nrhp resolution request and
reply.
I only need to provide which shortcut to take in that also.
Okay.
So I'll go in here.
I have created this tunnel which takes me up.
I also need to create a virtual template.
I believe I have something here which I put in.
No, I did not.
I did not do anything here.
So I'll have to first go inside my profile.
And say virtual name it ten.
So interface virtual template ten type.
No Source and destination Tunnel protection IPsec Profile Graph.
IP, NTP.
Network ID first is ten IP address.
Check this out.
I'll do this here.
What is the IP that I'll use on this virtual interface?
Where's my this?
I have.
Ah, three.
However.
Told you I always mess up the for this and are one.
The address that he got from this tunnel was.
11.
And the one which he got was.
12.
Right.
This is already an address that he has received.
To create this virtual interface with this guy.
This guy.
He needs an IP address.
Does it make sense to get another IP from the pool and then create the tunnel?
Does not make sense.
It makes sense if he uses this to do the tunnel on this side.
Now I could say IP address this guy, but as you know, this is going to be a virtual axis.
Virtual axis only works if you have IP unnumbered.
So my address here, my IP unnumbered.
What is it going to be exactly?
It's going to be IP.
Unnumbered tunnel zero.
This address will be given to the tunnel using negotiated.
So the address that comes here will be used for this virtual axis on the other side.
Right.
And finally, I will also have to say that IP and shortcut will be done using my same interface, virtual
template, the same interface, and that's what I did here.
Also, I'm telling the.
Tunnel that your shortcut is going to be to be through the template.
But I also have to guide the tunnel.
Hey, listen to the shortcut.
I'm guiding this tunnel to listen to the shortcut.
I also have to guide this tunnel to listen to the shortcut.
Right.
And the interface is going to be himself.
Listen to the shortcut, but use the same interface to go out.
Right.
Done.
That is all I have to do.
Which one?
This the shortcut.
See, he will only listen to the shortcut if he gets a redirect.
I have configured this interface right here.
This DVD, to give out the redirects so the redirects will be given out from here and from here.
Right.
I've told him to send the shortcut.
Where to this?
And I've told him to send the shortcut to this.
But he.
It's a redirect coming here.
He also has to listen to that shortcut.
Right.
So I have to manually tell him, Hey, the shortcut you take, but take it from the same interface which
you are creating right now.
I'm not guiding it to throw it out somewhere else.
Telling you to take the shortcut, but take it through this interface.
Which interface template ten, which is himself.
Here.
Right.
So that redirect that he receives, he will take it and go this way.
The same thing will happen on this side.
We don't.
Not only that, I can also include my IP and shortcut will work.
Why?
Because it worked in the VPN.
But on a virtual template you have to specify it this way.
But we already specified over here.
We specified it to come here.
Right.
We can work it.
Yeah, we'll try the next time.
Once we get this working, we'll remove this and we'll see if it works.
Because probably what happens with IP and Sharp on a virtual interface on virtual template, you have
to provide which side to go out.
But yeah, shortcut should work like we worked at.
Where in the VPN.
Okay.
This is all I have to do for the VDI.
Everything else will be received from the resolution requests.
Okay, let's try.
So copy this.
Do I have the same thing on both sides?
I have the same thing on both sides.
Same tunnel, zero, same virtual template ten and same network ID ten.
Copy.
First on R3, just to make sure that I have not specified a virtual interface before.
Let's check it.
No virtual template, Right.
So it's all right.
Copied half of it, Is it?
What did I do with the shortcut?
Did I specify template one or template two?
Template ten.
That's good.
So this is fine.
Crypto this virtual level ten interface, virtual template ten all of this and it's all good.
Right now it's down because I need to send a redirect first and I need to create the other side also
the other side.
He tried to create a tunnel, but he could not because I had not done it here.
Also ten.
Copy.
And based.
Done with visual template is done right now.
Check this.
My routing protocols tells me that ten dot three is true.
Let me trace it out.
The first packet is going in here right now and this is happening.
My virtual template should be solved, which is not.
Yeah.
There you go.
Virtual access is turned up.
Yes.
So my neighbor is also come up.
Why?
Because my virtual access is now connected.
From where?
Directly from 11 to 12.
A big tunnel was created from, spoke to, spoke.
If you check your IP route.
This now is from where?
11.
It was from one before.
He was from one before, but now it's from 11.
Right.
So this sign is showing this because of this virtual override.
Override.
But it's still going this way.
It's still going this way.
I know why this is.
Mountain not routing.
The NP is not getting resolved like it should be.
No, I'll have to do one more thing.
I'll show you what redirect is enabled.
No, that's not the problem.
I know what the problem is.
I have to override my user.
Turnout for is going direct.
Darfur is going direct, right.
Why?
Okay.
He has ten over four.
Through which guy?
So spoke to spoke is working one way, but this way is not.
The three is not going the right.
It's a lot of work of of.
The IP.
Next up self.
IP Next up self know that you would use if you have one interface.
Mgr.
Mgr is one interface on one side connecting to all.
Here you have different virtual templates, one going here, one going here and all the others going
there.
No, you can't show IP and I am actually getting some maps here.
I'm actually getting some maps.
10.3 is incomplete.
He has not created 10.3.
There is the complete one.
His NVM addresses.
Okay.
I need to clear up this one.
No, it should work.
Clear IP and NP clear crypto sessions.
Let's create the whole sessions.
Clear the whole sessions then go to my tunnel.
Shut.
I did go down.
And no shirt.
Okay, It's coming up.
He should create a neighbor relationship pretty soon.
One is up.
Show IP route.
I have this guy right now.
No mappings, so trace route ten .3.3.3 Source Loopback zero First should go this way.
Virtual ten interface is up.
You should create a neighbor very soon.
The neighbor is also up and he's going direct.
Okay.
There was a problem with the first mapping.
It was incomplete.
This is an awful awful on R4.
R4 R3 will be the same.
R3 will be the same.
It's going direct.
That was the end.
That was the mapping was incomplete for the first one is going spoke to Spoke with through what?
Through this.
Let me explain to you how this works.
The thing right now, if you look at it right now, there is no NHS.
You don't have any NHS.
How does he resolve these mappings?
That is the question.
If check is mappings, he has the mappings for what, 12, 10 or 3 and 13.
How does he get these mappings?
Who gives it to him?
No, not the pool.
Not the pool.
Look at how the communication takes place.
I'm going to clear this and I'm going to.
Definitely save flex.
This is spoke to.
Spoke.
Check this out.
This is my server.
I will not create the internet in the middle because I've been doing that a lot today.
This is our one.
The Internet.
Are three and.
For.
The address here.
This one.
92 one 6811.
The address here is.
But I think when I refresh the tunnel, it was changed.
Yeah.
So this side is 30.
The site is 30.
Right when my virtual when I think this has a loopback of.
And this has a loop.
Back off.
I think from here.
What is my package look like?
Sources.
Ten, three, three, three.
Destination is.
4.4.4.
Right now he only has one tunnel.
This one.
Right.
That is the only one he has.
So he has no option but to send it through the tunnel.
That's how we saw the first ping goes to 1.1.
The first time I trace route, it goes to 1.1.
Right?
So the whatever is going to be here is ESP and then the outside header is going to be
192.168.1.172.
One dot.
Oh, can we undo?
Controller does not work with Epic to Epic today.
So again our one quickly.
I do.
33431.
92.168 .1. 11.
13.
Ten.
3.3.3.
Ten .4.4.4.
And the packet looks like this from.
Going to.
KSP.
This.
And this is the sources.
Not actually this.
This is not the source.
The outside source is going to be.
20 3.3 with the destination as 12 dot going from here to here.
Why this?
Because the next hop is going to be 182168.
If you check.
For now.
He won't show you.
The next hop is for one and one is one and 21681.1.
So the first time this one was also 1.1.
Now he changed it to 13.
But when I didn't do that traceroute in the first packet this was 1.1.
So he knew he was supposed to go through the virtual access.
The outside header that he puts is this for the virtual access and the packet reaches whom?
This guy right here.
One has to make a routing decision.
Based on whom?
These two.
When he makes the routing decision based on these two, he checks where is 10.4.
Let's go to our one.
He checks west and for he sees 10.4 is through 182 113.
He checks the source.
He sees the source is also he realizes both of them are on the same network.
That is all he realizes.
He realizes one is 1.11, the other is 1.13.
He does forward the packet.
But while he is forwarding the packet, he also forwards something else, not forwards sense.
What is that he sends?
Redirect.
Message.
Redirect.
Redirect, saying if you want to go to 10.4.
You go through.
You go to 192.168.1. 13.
And for him you tell him you want to go to 1.3.3.3.
You go through.
One dot 11.
He tells him that it's an Http redirect message.
So what this message comes wear to this guy, to these guys?
Right now.
He needs to create what that virtual axis here.
But this this resolution request now, this guy came in with this redirect message.
He needs to reply with the resolution message.
That resolution message is not sent straight here.
No, that resolution message say this green is my resolution.
Message is sent through this tunnel to the hub.
The hub forwards it to this guy.
This was a correction in Dmvpn.
It does not The hub does not resolve these requests.
The hub does not resolve it.
He actually takes the request and forwards it.
To whom?
This guy in the request.
He's basically telling him, Hey, listen, I know you are 192, 168, 113.
Right?
This is my source.
In the request, there is a source.
He's telling him my source is.
My e-mail address is.
12 to 1.
I want to know what your address is.
Your address.
Tell them I want to know what your address is.
For him to create this one tunnel.
What does he require?
A source and a destination.
That's all he needs, right?
To create the DVD.
Does he have the source now?
Sorry?
The destination.
He has the destination now.
Does he have a source?
He has the public source as his source destination was received by PNP resolution request.
Right.
He doesn't even throw it this way.
This guy also sends him a resolution request this way.
Comes to this guy saying, Hey, listen, I am 1.13.
My name address is one dot.
What is it?
24.4.
What is your address?
To reply to this resolution request.
They don't go through the hub now.
To reply to this resolution request, they create this tunnel.
Now they have the source and destination from their side.
In the meantime, the other guy also receives it.
He has the source and destination also.
So they create.
They negotiate this tunnel here with all the Ike Ike initial message and Ike Ike message is exchanged
over here.
Why?
Because the source and destination is known here.
The source and destination is known here.
So he replies to him saying, Hey, my destination address is this through the tunnel?
And he replies, saying, My destination is this through the tunnel?
When the tunnel is set up, he they don't need anything else.
Why?
Because the virtual access automatically has the source and destination.
The public source becomes from here 23.3 From here.
It's.
How did he know the destination is 23.3.
This resolution request.
How did he know?
It's 24.4.
This resolution.
So he knows to go.
Now he knows that if I want to go now, they don't need to exchange ten or 3 or 10 for Why?
Because they have a neighbor relationship.
The tunnel source address from here is 190 to 113.
From here the source is 11.
I have done EGP.
My EGP is running over here.
So there are these networks will now be shared over whom?
This one interface.
So they don't need the hub anymore.
They are directly neighbors with R3 and R4.
Is this clear?
Any questions?
The DNA.
If R1 goes down, everything goes down.
Here's this tunnel will go down here.
This tunnel will go down.
If this is up, he will stay up.
This will stay up for that amount of time until he has the mappings.
That is, again, 69.
What is two hours?
Two hours?
You can see it here.
Not here.
R1 doesn't have anything.
Ones.
NP is empty.
He does not store any data.
He just forwards requests from here, forwards request from here.
Only data which you have is on R3 and R4.
10.3 is through the tunnel.
192 168 is through 192, 168, 113, which is directly connected to me through the tunnel and the name
addresses 24.4.
Is this clear?
This is myself.
14.3.
This is the mapping for myself.
182 1.23.3 is myself.
So if he wants to bring himself.
Right from R4.
Also, he will have a PNP mapping.
For 10.3.
The time is.
147 through 192 168 1.11.
1.11 is his neighbor.
1.11 is a neighbor through a virtual interface one full time and everything is good.
So he has a direct relationship with the spoke.
That is your dmvpn summed up as flex.
It's flexible.
Why?
Because remember R1, I did not do a lot of things on our own.
If you compare this R1 to the R1 in the previous lab, only one thing I added was the pool.
That's all.
And obviously I just have to make R1.
Part of the decision is made by him when he has to forward traffic and he knows that forwarding traffic,
both of them are part of the same domain.
He knows this guy is also part of my same domain.
This guy is also part of the same domain.
Why don't they talk directly?
If they are in the same network, why don't they talk directly?
So he just tells them, hey, listen, he's in your same network.
He tells him, hey, this is in your same network.
He doesn't tell him.
He just sends a redirect saying, Hey, go directly.
They don't know how to go direct.
So they go through the hub for the resolution and he goes through the hub for the resolution.
They get their nbma addresses, create a tunnel.
So that redirect command.
Yeah.
4.4.
And this is.
You said that at 1.32 that he has that through his routing table right here, through his routing table,
because before it was through.
Yeah.
No, before also, that's what I wanted to clarify last time.
What we did, this thing that we did last time, there's a correction in there that at that time also
it happens the same way through IP table, through the IP routing table.
At that time, what I had said was R1 resolves everything for them.
They send their resolutions to R1 and R1 resolves it for them, but that's not the case.
That time also, he gets the he gets the request from this side.
He checks the source and destination.
If they are on the same network, the final networks are the same.
It's coming from 190 211 end point of the tunnel is 192, 168 111.
The other end point is 192, 168 113.
They know they are.
He knows that in the same data.
So he says, all right, if they are in the same network and the domain is also the same, they need
a redirect.
So it sends out a redirect to them and they don't talk to the hub their request.
The destination is dot 13, and for him the destination is dot 11, but it's going through the hub because
at that time they don't know what is the direct address, the NVM address in dmvpn.
He doesn't create a tunnel back.
The NTP reply comes back through the hub.
Also here, the resolution deployed does not come back through the hub here.
He creates that virtual access and replies through that because they both have everything that they
need by that time.
So by the time is resolved, virtual access is also created.
And then obviously you have routing enabled and the traffic goes through that and creates a neighbor.
There is a direct communication between both the scopes.
Now there is, yeah.
So that's why the routing table is showing the overridden overridden, that's why.
Because now see.
This is overridden.
To whom?
Why?
Because this static route was installed.
Where?
Root set interface install this root set installs this root.
If you see this is next hop is overwrite.
Why?
Because from R3, this is what 13 was is my address.
My address is 11.
Right.
So this he has it as an AARP neighbor.
He has this guy as the AARP neighbor.
He can go there directly.
13.
He can go there directly.
Why?
It's a it is a next hop for him.
So he does not need this in the routing table.
He was installed as a static route, but it's overridden.
Why?
Because now he directly connected to me, so I override it.
I don't use this one.
This one is not used anymore.
Override means override this.
Why?
Because it's directly connected to me from the other side.
Through that, virtual access is directly connected now.
So interface virtual access.
Can we move this?
All right.
I will hide this.
Oh, yeah.
Nice.
So this is my tunnel Zero.
My endpoint is this.
And.
I have this right here.
Right source and destination is given by whom?
The NSA told me.
The other side is this and that side also.
He told me the NSA.
Is this clear?
Any questions?
This is the most difficult part of.
That is all.
This.
What read was the request goes to the hub.
However, replies with the destination tool, with the destination to request, and then request goes
to directory.
The request goes.
Let's see how the Cisco docs right here.
Because you cannot change the packet in destination.
The source and destination flex spoke to spoke.
Yeah, there's a whole packet exchange that is explained in these docs, so we'll see that.
This is the exchange, right?
This is the description of the exchange.
This is your.
Host request.
Host Request goes to the hub, goes to the other side.
In the meantime, what this hub does is send a redirect.
Send a redirect.
Then the resolution request goes where?
Straight to the other spoke.
Right.
The resolution request from the other spoke comes straight.
Then the Ike is formed between spokes.
Nothing is done with the hub.
The hub is not.
The only thing the hub is doing is sending the redirect on both sides, as you said, like forwarding
just forwarding the request.
This Http request is also forwarded from this side.
Also even from this side, the moment he receives the resolution, then the reply does not come straight.
It's through the Ike initialization.
So that means he only replies with the destination and then the hub replies in the redirect.
That's what he does in the redirect.
Again, the a new packet is generated per request and directly goes to the this one.
Right?
The resolution and resolution request is a separate packet.
That's what I showed you here.
How do you get back?
That's what I said here.
See, this was a redirect coming in.
This resolution Green one was a resolution request.
The resolution request is not forwarded.
It's not forwarded.
It goes straight.
Yeah, it goes through the hub.
Why?
Why did I say forwarded?
Because it leaves this interface.
Is this virtual access.
Then it goes out from the other virtual access.
That's what I'm saying.
The request goes to this request the destination to R3 again.
R3 again.
Yes.
And then R3, R3 goes straight.
But that's not what he shows here, See?
These.
Okay again.
Check right here.
This resolution request is he is is the hub replying with anything to him?
The request which I'm sending from here is the hub replying.
He's not.
It's the same like this.
This packet which is going through is the same like that packet going on.
But now inside the packet, it's a resolution request with the information about my source because he
knows, the host knows that who's going to take me to the other side, the hub.
So he sends it to the hub here then see, otherwise he would show you Hub sending something back, and
then he creates another packet to send back.
Right?
So then another resolution request goes out from here.
But from here, only one resolution request is going.
And from here also only one resolution request is coming from R3 coming to R1, but through the house
it's called spoke, Hub spoke.
The communication is called spoke, Hub spoke.
It's not meant for the hub.
The destination is the spoke.
But the way the path to go through is through the hub.
The hub does not do anything.
His destination, when he opens the packet, he sees the destination is the other spoke.
So he doesn't do anything.
He knows it's an Http request.
He just forwards it from the other virtual interface.
Only the redirect is sent to the spokes.
That's the only thing that he does is the redirection after the command.
The redirection is the redirect message is simply it's sent.
See, the first traffic goes in the moment.
The first traffic goes in, then the hub can.
At the same time, the hub realizes when he makes the routing decision, he realizes that both of them
are in the same network.
When once he forwards it, he says, All right, if they are in the same network, let me send them
a redirect.
So he sends that this redirect packets sent over here.
Which one?
No, you know what that one is?
Excuse me.
You know what that one is?
See, this was the first packet sent to that packet.
This was the reply.
That is the reply which is going.
Because the first ping completes.
Right.
How will the first ping complete when it comes back?
This is the echo request and this is the echo reply.
Now he's cutting off here.
Why?
Because first he sends a redirect and then he replies with the.
So this is the one which he gets back.
Check.
This is what the host receives.
The first he receives.
Is this right?
Then he sends the redirect.
The host is not sending the redirect.
This guy is the only packets leaving him.
Is this one.
Right.
This is your spoke the only one packet leaving him?
Is this the only one packet receiving is the request from the other spoke?
Yes.
From the other scope.
What you're saying is the dmvpn in the first one.
Why?
Because the spoke at that time.
The hub has all the mappings here.
The hub does not have anything.
He has no mappings here.
He does not have any mappings, so he does not know what to do with it.
He does not reply with the mappings.
What you're saying is dmvpn.
In that case he replies with the mappings.
Then they talks directly for the resolution.
Here it's straight through the hub.
In that case, it was sending only the destination.
And then because the hub had everything else here, the hub does not.
I showed you the NTP table on the hub.
It was empty.
Okay.
Any questions?
Any more questions?
Is this clear?
The communication between the hub and spoke.
The spoke.
The spoke communication.
Is this clear how this is happening?
The redirect and everything.
This is in Cisco Ducks.
Okay.
That is how your flex spoke.
The spoke works.
The only one thing that's left right now is server and client.
Very subtle differences between the two.
Very subtle differences.
But I will not do it today.
I want you to do this today, so we'll do that tomorrow.
It'll be a recap of everything from Flex beginning until the end.
This Two steps.
Just two more steps.
But we'll we'll be repeating all of this.
So all those fill in the blanks that are left in my in our heads will be cleared.
One step at a time.
And then we'll also do the theory of SSL VPN.
Okay.