All right.
So this is what we are going to do.
Now, yesterday we did create a tunnel between R one and R three.
I'm going to do it again a little quickly this time.
Okay.
And I'm not going to use routers here.
I'm going to use this loopbacks since I showed you yesterday how a loopback is just another network
behind R1.
Right.
We'll do that just as it is and we'll see how the tunnel will be created.
Okay, let's configure it starting from R1.
This is 0000.
Fine.
This is 151 12.1.
Look back on our three.
I need to know finally are to.
No need for anything else.
One should be able to talk.
Where to?
23 points.
That is the whole purpose.
Tell that to.
So first thing is you make sure is what?
The first thing that you always check is what connectivity between the two edges.
So you're connected via the Internet.
You need to make sure that R1 and R3 are able to communicate to each other.
Site to site VPN and connecting one site to another site.
Okay.
This is the most basic form of site to site VPN.
So this guy and this guy I need to create the tunnel.
When I created the first tunnel that is going to be created is going to be.
Which one?
Is a gap in this.
How many phases?
Nine packets.
But how many phases?
Two phases.
First phase is the first phase six packets, which is also known as main mode.
Second phase is the other three packets, which is the quick mode.
The transform set exchange and everything.
Right.
At the end of the nine packets, what is going to be created?
Phase two tunnel.
Hard to have information, without any doubt at all.
Not at all.
How did you know and how did it know?
What does work end to end?
What happens is that is the whole point.
When 1.1.1.1 now will send a ping to ten .3.3.3.
Okay.
What happens here?
Encapsulation.
What is encapsulation?
DSP is added.
Even without configuring anything.
How did it work?
Come and ask if you didn't have any information regarding.
But here I didn't think from 10.1 to 10.3 ping from the public to public.
Right now you're talking about right now but as needed striping.
Only from edges, only from the side edge router to the edge router from the public IP to the public
IP.
The once a week in setup, you will be able to, once the VPN is set up, your packet will look like
this.
Like what?
This will be one 5112 one one 5123 dot this part will be encrypted hidden, right?
So when this packet reaches our to which part of this packet does he see?
R2 makes a routing decision based on this header, which is 12.1 to 23.3.
Now, practically speaking, 23.3 will not be directly connected to this Internet ISP, so it will have
to route it through across the whole globe until it reaches the destination, which is okay, because
that whole routing will be done based on this header only from 12.1 to 23.3 where he doesn't even require
12.1.
He only needs to know where 23.3.
So all of these routers in the middle, they'll try to take the packet to this destination.
That's how I can simulate this cloud because that is what the cloud would do.
It is the Internet.
It has to behave like that.
Once you send a packet for a destination address, it will take it to the destination address.
When it reaches the destination address, then again, decapsulation happens.
It sees what's inside the packet and so on and so forth.
Okay, Now let's configure it again quickly.
Just a recap of yesterday.
What is step one
Crypto Scam Policy and Encryption Reader's Authentication.
Please share hash.
Let's say MD5 or Sha and group.
Correct.
Second step packet number five.
Right.
Crypto camp key Cisco address.
Which address is this?
151 .13..
Step three is what transforms packet number seven and eight crypto IPsec Transform set key set esp esp
MD5 any one of the 25.
Step number four.
Now I need to bring it to the crypto map.
But crypto map requires one more extra step so that the crypto map is activated, which is access list
101 permit IP from ten 110 going to ten 330.
Finally, step step five is crypto map map ten.
What is it linking IPsec to?
That's it.
Now the first thing you always do is match address.
Now it doesn't have any order, but this is the order.
It checks it in.
The first thing that it checks is match address 101.
Set.
Transform.
Set.
Key.
Set.
Said.
Here is which gets 151 .23. Step six Apply it on the interface interface.
Zero zero crypto map.
Then go to one paste it.
Camp is on
504,500 is on.
Go to three.
Sorry.
Copy paste.
Now on the other outer, I will go back and change the stuff which I need to change, but I'll keep
this as for around because I want to create another channel.
So this will be for our one.
I'll just copy it, paste it, flip this part.
Right.
And this becomes what?
12.1 Going from top to bottom.
This is an encryption reshare hash due to crypto keys addresses.
12.1 Talking about R3 from R3.
The address is 12.1 correct.
Then transform set to set again esp three does same, then your ACL will be flipped.
So there it was.
One, two, three.
Here it's 3 to 1 match address is correct.
What else do I need to change?
Set pair command would be 12.1 and then crypto map copy.
Customer by camp is on.
What else do I need to do?
I will open my wireshark check.
Now, yesterday when I did this, I was using H and we saw how the packet looked like.
Looks like.
Today I'm going to do the same thing.
But now I added esp.
Have I just instead of using h header here I could have said h MD5 but i used esp header.
He is the author.
So let's try.
How do you how do I make sure the interesting traffic passes through?
I'll ping ten .1.1.1 with the source of ten dot.
This is the interesting traffic, right?
It will hit the interface the moment it hits the interface.
The traffic will be triggered.
So if I ping 10.1 directly, you, you, you, you, you.
Who's sending me the use there?
Not from this side.
Let's do from one ping.
Ten .3.3.3.
It will not go through.
Why.
Because the service provider does not know where it is.
Right now what I'm doing is if I'm sending a direct ping without the source address to ten .3.3.3,
it is going to the interface.
It does not match the interesting traffic, so it is not passed through the crypto map.
If it is not passed through the crypto map, it goes straight to the ISP.
The ISP says destination unreachable.
But if I now use the source also what will happen?
It will trigger the crypto map because match access list is successful.
It will trigger the crypto map, attach the transform set, go up and check his policies.
And the key and first thing is what is the first thing that he's going to do?
The first packet that is going to leave from here is Icecap, which is a camp UDP 500 to 500.
And in there will be what only one guy studied or one in there will be what policies.
Right?
There will be policies.
So in the first packet I'll send policies and then the whole nine packet exchange.
Until then my ping is going to be stop buffered.
So if it takes more than two seconds, more than one packet, most of the times two packets get dropped,
the first two packets get dropped because of the whole nine packet exchange.
Right?
So let's try interesting traffic source ten 111.
Nine packets.
Right.
Policy.
Policy and nouns.
Nouns.
Key.
Security Association.
Transform.
Set.
Exchange.
Transform.
Set.
Exchange and acknowledgement.
Right.
This is your actual tunnel.
This is your actual data tunnel right here.
When you see ESB here, this is the tunnel.
Right.
So this is the first tunnel.
Icecap is your first tunnel.
This is your IPsec tunnel.
If you have a look at this, it's pretty ordinary.
Why?
Because you don't see anything in there.
That is the beauty of it.
You see the outside header, which is 12.1 to 23.3, but the actual actual message is going from 10.1
to 10.3.
You don't see that part.
You only see an ESP header out there which is not available to you.
Let me show you how this whole process works now.
When this happens on on your R1, when the packet comes, it will look like this.
I'm trying to go from ten 111.
I'm trying to go to ten 333.
Okay.
I hit what.
I hit the interface on the interface.
There is a crypto map which says that this part should be encrypted.
So it does the nine packet exchange to get what?
What is the whole point of the nine packet exchange?
Three things.
He needs the key.
But he has he needs to know which mechanism to use for encryption and what mechanism to use for hashing
of the actual data.
Right.
So by the end of nine packets, he knows that.
Okay, let's say this is using three Des and Sha from both ends.
They will negotiate on the same thing, right?
Ki, ki des.
And so once he gets that information until this time, until he gets this information, 1 or 2 packets
get dropped.
Right now, he has this information.
Now, what does he do?
He uses the key using the algorithms and this header, which is the ESP header to encrypt the data.
It also has something else.
It has because it's a ping.
So ICMP is hidden here.
Is all.
Right.
But on top of that, what does he need?
Because if he hides all, how will the routing take place?
How will it reach the final destination?
So he needs a public address.
It uses the set payer option, which you already specified as 23.3.
The source.
It uses the interfaces public address from 12.1 to 23.3.
Understand how he sets these two things.
This part based on the set peer command and whichever interface is leaving from that will be your source.
And then he doesn't have to care about anything because this routing is done by the internet and it
reaches the final destination anyhow.
You don't have to worry about that.
It will reach the final destination.
If it is on the Internet, it will reach the destination.
But what happens when it reaches the destination?
The guy.
Does he have the key?
First of all, he opens this because it's meant for him 23.3.
So he opens this part, checks ESP to open ESP.
What does he need?
It is the key to open this whole thing.
Three needs.
What if he doesn't have the key?
He won't be able to open it.
That's why no one in the world can open it.
Only if he has the key will open.
He'll open it.
He does have the key.
So what he does is he opens the ESP.
Finds the actual message, which is from 10.1 to 10.3, and it's an ICMP for forwards.
That request to 10.3 says it's actually meant for the destination of the reverse process.
Works the same.
So on a weekend, there's no need for a nap.
Without nap right now, there's no nothing happening.
Right.
So, I mean, this is.
Not yet.
There isn't.
There may be setups when I'll show you where you require an axe.
But in this case, no, you don't need.
Why do you need.
You don't need it.
It's already hidden.
Your actual private networks are already hidden behind the public addresses.
When I say behind, they are encapsulated within the public address range.
Any questions on how this works?
Any questions?
No.
Clear.
Shall we move forward then?
What I'm going to do next is I'm going to attach a new site to this.
I for.
And with our four, I'm going to create a tunnel between R one and R four.
The loopback.
Ten .4.4.0.
Okay.
This is going to be 24.0.
24.4
know set a default route.
Making sure that our one can reach.
I forget which one.
Okay.
Also, I also need to do what I need to create that loop back on our for.
Right so I the set up and ready.
What do I do now on our phone?
Help me out with this.
I'll just configure it from here.
Tell me.
I need to create a tunnel between R1 and R4.
The first thing is crypto scam policy, then encryption authentication hash.
There I use Sha here, I'll use MD5.
Okay.
And I'll use five.
Just remember what I used here.
MD5 and Sha two five.
Then all the three have the same can.
That'll be easier.
It is possible.
But I want to show you.
If it's not, how will you manage that?
It's easier if all of them have the same policies.
But let's do the other way.
Second step.
Yeah.
I said, can you say school address?
What is the address?
150.
You have your diagrams, right?
151 .15. then IPsec transform set.
I'll keep it as the same esp three as MD5.
You can use MD5.
Yes.
And if I then access list 101 permit ten dot
to ten .1.1.0
IP.
Finally crypto imap then.
Crypto iMap, then IPsec and then set here is what, 12.1 match address 101 and then let set transform.
The last step is apply to the interface.
This is what I did.
Crypto ICBM policy ten and the rest of the stuff is the same.
Then the key.
Then the transform set.
The year
the map and apply it to the interface just for record.
I'm at ten
and this is R4.
R4 is separate, R4 is new, R1 is 1120 as as you like right now.
I'll go back to R1 and this is the configuration which I've done on R1.
I want to make sure what changes do I make need to make here?
What things do I need to add so I can accommodate the newer tunnel?
The first rule that you have to remember is that on an interface of a router, you can only apply one
crypto map.
Yeah.
I showed you yesterday.
Someone asked me, what is the whole purpose of this tent?
You can only apply what one crypto map per interface.
If you can only apply one crypto map, how will you accommodate two tunnels?
You have different sequence numbers on there.
So when I have.
When I have this crypto map here, I'll keep it as it is.
I will create a new sequence number, let's say 2010, 20, 30, 40.
Like that.
Okay, I have a new sequence number here.
The set payer address is what?
24.4.
What else changes?
The ACL will change.
Why?
Because now the address is not 10.1 to 10.3, but it is.
What?
So I'll create another ACL.
102 which permits from IP ten 110 going to ten 440.
So here the ACL will not be 101 will be one zero.
Transform set.
I put the same thing on both sides.
If I had not, I would have to change the transform set here and put the other one transform set to
set one or T set two or set three.
But since I'm using the same transform set on our four also if we check same three days an MD5 on our
4 or 4, visualize it after three days and MD5.
So here also the set is the same three days and MD5, so no need to change that.
The difference between the how is it going to make sure which crypto map to use, which entry to use
based on the ACL.
The decision which crypto map to use is based on entirely based on the ACL.
If it doesn't hit this ACL, it goes to the other one starting from top to bottom.
But the only one thing that is missing is what I am policies.
Earlier, I used this policy.
Another one.
If I use 101 only it is.
Why?
Because I want which traffic to encrypt.
I'm sorry.
What?
You can play in a much different way here in the ten.
See, in 110, you can only have one ACL.
You can have both ACLs in there and I have two 2020s, but you can only have one pair, right?
Set pair command.
So you have two addresses, but it will only go to one
set here.
If you had dual set pair command.
So you could have done that also.
But that's what you're doing right now.
You're saying if the traffic is going here, set this pair.
If the traffic is going here, the pair should be only the right.
So ACL changes.
The pair also changes.
I'm saying if the traffic is going to 10.3, my pair set pair address on the outside address should
be 23.3 if it's going to this 1 or 2, which is 10.4, the outside address should be 24.4.
Do you understand?
When I say what I mean when I say outside address.
When I say outside address, I'm talking about the header on the outside of the ESP because that is
the one which does all the routing.
So when I say set at 24.4, it is set outside header which will be routed across to the internet through
the internet to the device.
Okay, Clear, everyone.
So the only thing that is missing, if you compare it to R4 is on R4.
I use different set of policies and okay, let's say I will use a different key
as many as you want,
but iOS?
I don't think so.
That is on the think.
Yeah.
How much is the limitation?
I think 100.
If you buy a license for 100, let's check the version number.
Maybe it gives that information in there, but I have not heard anything like that, I'm sure.
Yeah.
Okay.
Maybe there is a possibility.
I mean, that's how they do it for everything.
That's how they make money.
So what I've done is I've changed the key from this side also.
Cisco one, two, three on R4.
So you cannot create the you cannot create the tunnel with R4 if you don't have Cisco.
One, two, three.
As your PS3 pre-shared key.
And I'll make this deliberate mistake on R1, I will keep the key as Cisco.
Show.
I see.
Yes, I see.
That is RSA.
RSA signatures.
You have.
I told you you have a VPN on that server.
You have to do that.
That is the important one.
That is the one which is used widely.
Right?
So what right now, what changes do I need to make on R1?
That is the question.
I'm using the key.
Do I need a different key?
I need a different key to go to 12.1 because the address has to be specified.
I also need another key for 2024 dot, but I will deliberately keep it as Cisco because I want to show
you the state of where the packet gets stuck.
Where is the packet going to get stuck?
Packet number, packet number five and six between hills and five.
The other guy will not be able to send six, so he'll keep on sending three and four again.
Three and four again.
He'll send five, three and four again.
Then five, four, five, four, five.
Right.
Also I need to do policies.
So just like I did ten, I will do
crypto scam 20
encryption again, I'll just copy paste it from the other side.
Okay.
Am I doing it?
Yeah, I'm doing it on the number.
This is our for.
I need to do the address here.
Right.
And the policies
crypto camp policy 20 encryption I used was authentication
hash I used and D5 and group I used.
I keep it as what policy number 20.
Keep it as policy number 20.
Let's paste this part again on our one.
So if you check your show, run crypto.
You see, you have two policies, two sets of policies, not one, two.
Now, when he creates a tunnel, when he sends policies, which one is he going to send?
The ten one or the 21?
The policies that he says is going to send both.
When is creating the tunnel.
See now the difference between R1 and the others is.
R1 has two sets of policies.
Policy number ten.
Policy number.
When he and this guy has only ten number.
Right.
When these are negotiating the first tunnel, the escape tunnel and the negotiation takes place.
Both of these are going to be sent across in one packet in the first packet, both of these policies.
Then it's for R3 to decide which one does he match.
So the first thing that he's going to try is he's going to try with his lower number.
So the lower number that is coming through.
So he's going to compare 10 to 10, then he's going to compare it to 20 and see which one matches with
R3.
Ten will match.
For our for his ten will match with the 20 here which does not make much of a difference.
Which is the first packet is going to be a little bigger.
That's only the first packet, not the second packet, because the first packet I'll send all the policies.
The second guy will choose one of them and reply with that one.
That is the difference in the first packet.
Second packet.
No change.
Third and fourth.
Obviously nothing.
Fifth and sixth is the pre-shared key.
I've set the Pre-shared key here as Cisco.
The other side as Cisco.
One, two, three.
So we should see the packet getting stopped in the fifth exchange.
Correct.
Let's try to do that.
Let's go to R1.
I'll Penguins address.
Ten .4.4.4 with the source of and not one dot.
I get number one, two, three, four, five, then four again C 4 or 2.
Right.
4 or 2 gets repeated again after five.
See.
One, two, three, four, three, four.
Size is 4024025 is 134.
Then the other packet you see is 402.
Why?
Because fourth got repeated again.
This is the pre-shared key.
There's a mismatch.
Right?
So the fifth packet I send Cisco, the other side is not accepting.
Let's check the state of the packet.
If you go to your show crypto, I say no state, I'll send the packet again.
Key exchange.
It is getting stuck.
Where in the key exchange part.
What is key exchange packet number five and.
What are you trying to repeat?
The experience is supposed to send the key again.
Which key?
The key.
He sends the key.
The other guy doesn't have the key to respond back.
There's a mismatch.
So he sends the previous packet back again because he wants him to send the key again.
But he didn't see the packet.
The fifth packet was there.
This is the 134 is the fifth packet.
This is one, two, three, four.
Then one, two, three, four.
This is the fifth packet I'm sending you.
Then.
Then you detect a mismatch.
You send me forth again.
So I know that the key is not wrong.
Not right.
Right.
So when you go back here, how do I fix this?
I'll go to R1 crypto Eichkamp Key.
Cisco.
One, two, three.
Address is 151 .14.
already exists, but it exists with Cisco, so I'll remove that one and paste this one again.
Okay.
Now let's try again.
I'll start from R2 after this time.
Ten 111 with the source of ten.
444.
Then successful exchange is good.
The packets have been exchanged.
Shouldn't have done it from there because I wanted to show you something.
With one, with one person with one pair, only one.
Obviously with one side, you will only have one, Right?
The second side of.
It's like, again, that's what I'm doing right now.
If you check, I can.
But here I need to use Cisco.
One, two, three.
From this end.
I did that, right?
I use Cisco one, two, three here.
And R4 is also using Cisco.
One, two, three.
Where is the guy?
R4 is also using Cisco.
One, two, three.
Right.
That's what I'm doing right now.
So going back
the tunnel set up, I want to clear the tunnel.
How do you clear the tunnel?
You have to clear both your tunnels.
Clear.
Crypto scam will clear your first tunnel.
Clear crypto sessions will clear everything.
Okay.
If you want to clear a specific tunnel crypto scam clear crypto scam, then you can specify the session
ID.
So for example.
Yeah, every connection has an ID, so show crypto scams is see a connection id height right here.
You just put that connection id it will remove that part.
Okay.
Now I want to send it again, but I want to originate this from R1 because I want to show you the policies.
Thing.
Ten .4.4.4 to the source of ten .1.1.
It just happened.
This side didn't clear clear crypto camp where crypto.
Then, Nadia.
I didn't.
I thought I did, but I didn't get it from both ends.
Then let's have a look at the exchange.
The first packet, which is going from 1 to 4.
Let's open that and see what's inside there from 1 to 4.
Remember on one, I have two sets of policies, not one.
Right.
So when I send him the policies, I'm going to send him both sets of policies.
First policy number ten, which has group two.
Then policy number 20, which has group five.
If I had ten sets of policies ten, 20, 30, 40, 50, I would send them all.
And he chooses which one does he want to use right now is using this part.
Let's check that to the other packet that he responds with.
Chooses only one of the two, the one which matches on its side.
So this is policy number ten, 20, 30.
It's arbitrary, it's local.
1020.
It's just a number.
What matters is what policies are you sending?
What policies are you receiving from both sides?
Any questions?
No questions.
Here for one side.
The other side?
Yes.
The other side still exists.
He thinks that the tunnel is up the other side.
Still thinks that the tunnel is up.
So he sends the traffic through the tunnel, but there is no one else on the other side to receive it.
Now, the other thing that I want you to see is show this command show crypto camp.
I think there's a command for detail.
If you go to detail, it will show you the lifetime left in this tunnel.
Right now, it's 23.
It will show you the group that you're using.
Number five, the SK.
You're using authentication based on Pre-shared keys.
Hash is MD5, encryption is
right, the remote end and 24.4 local is 12.1.
And your connection ID is this connection.
ID will keep on changing every 24 hours because this tunnel will go down.
Another tunnel will come up 1005 will become 1006.
Why is it important?
Because, say, for example, you go back home today, you come back in the morning tomorrow, and you
check the connection ID it goes from 100 5 to 1 006.
If it has gone to gone to 1015, what does that mean?
In 24 hours, the tunnel has gone up and down ten times.
That means something is wrong.
That's why connection ID helps you to keep track of what tunnels were where.
Right.
And then what you have is engine is don't have to worry about that.
So Crypto IPsec is the one which you care about.
Crypto IPsec.
Jihadi jihadi
because this has certain limitations.
What I want to give the message behind the Westinghouse.
Not really another router.
If you want, you can do that but gives you certain more advantages which IPsec doesn't.
But I don't want to talk about the negatives of IPsec crypto map right now.
Let's focus on the positives, then I'll show you how GRE gives you something which this guy doesn't.
Right.
But before that, we have to move certain steps and then we can reach them.
For my understanding, I require an extra standard.
But what is that for?
What if you create a of shops?
Not all the interesting traffic will go through the town.
The rest will go through public address.
So you'll protect your tunnel separately with IPsec.
So your interesting traffic at that time will not be defined by an ACL.
It will be defined by the split.
Tunneling is something else.
Split tunneling is you use it an easy VPN.
But we have ages since until we reach VPN from now, we have a lot to cover until we reach there.
Right?
Right.
Now check this out.
This is your IPsec se.
Make sure that you understand the important points of where to check what?
Okay, first things first.
This part tells you what
what is getting encrypted traffic going from 10.1 to 10.3 is getting encrypted.
Okay.
Local address.
The map is applied to which interface S00.
The local address of that which by local address he means public address on that interface is 12.1.
This tunnel is going from where 10.1 to 10 dot until now.
How many packets have passed through this?
Zero.
Local endpoint and remote endpoint.
This is nothing but the outside header that is going to be used for the traffic going from 10.1 to 10.3.
Right.
So if you want to draw it graphically for the traffic going from ten .1.1. 0 to 10 .3.3.0.
The outside header is going to be, what, 151 12.1 going to
23.3.
And obviously this will be covered using and you'll see that right now we don't know what it is right
now.
We don't know what it's going to be covered with.
But if you go down there, you should see right now it's not applied, obviously, but you'll see inbound
and outbound ESP.
Right.
So this you know that this is going to be what?
Lyngby as if it was, it would show you.
Here it would be inbound and outbound and inbound outbound because inbound for decrypting, outbound
for encrypting.
Right?
So you'll see that these these parts are always going to be the same.
Tonight, more infections.
I'm sorry.
I think the hashing and encrypting of reading some Java you can read, but how will you get understand
what it means from Java?
This is not showing what.
It was it was not known.
See?
Check.
And there it is able to show you.
But in which sense?
That is the question.
That's it.
All hidden behind this one number.
That's it.
It is compressed.
But in what sense is it compressed?
All of your information is here behind this somewhere.
Something like that.
Yeah, but it's not really you're not compressing your data, so it's not like the size of the packet
will get slow, will get less sun like that.
The size will still be the same.
But maybe behind this x there's a lot of meaning behind one x in his own language.
Yeah.
And the decryption part he will know about what it is with the key and this decrypted encrypted data.
He knows how to encrypt and decrypt.
But your jabber is here if you want to check it.
Yeah.
All of this.
All of these values F11 for all of this.
Okay.
Now going back, you also have something called the SP number here, right?
Keep this in mind.
It should.
That's why we have grief in this.
It doesn't.
The area has something called keep alive sin, keep alive.
Dead prey detection is there, but you have to enable it separately.
Yeah, there should be.
But it's it's as complicated.
That's why crypto maps are not preferred.
If you want to create site to site tunnels, crypto maps are not preferred as much as tunnels.
And then there's certain advancements of tunnels also.
But that's a topic for tomorrow, right?
Support for the numbers.
Yes.
So that numbers are there so that what you can do is you can manage two different tunnels separately
or one right now has two tunnels coming in.
It needs to manage the traffic of both of them.
How will it make sure?
Because when the packet is coming in, it will be coming in as ESP.
When it sees that ESP packet, how is it how does it know which tunnel does it belong?
So it keeps track of both the tunnels using our three four tunnels.
Using what?
The numbers on those tunnels.
That's how it remembers.
Good that translation would be different because they're the addresses are given to send the traffic
where it goes and where is it coming back?
Yeah, something like that.
Indexing.
So just to remember, just to differentiate between the two, because you might have seen I mean, in
real life perspective, there's a lot of tunnels coming in.
It's not more than that.
We have not done dmvpn yet.
There are thousands of spokes connected together.
Right?
So there'll be 1000 sites connecting together.
So you'll have to keep track of all of them.
Like that, right?
So you don't do it.
The router does it for you, but for for doing that, it requires what?
That number uses that.
Okay.
Let's check the other details in here.
The package.
Now I'm taking the actual tunnel.
The first one is not there.
It's not up.
That's why zero zero.
I'm not saying interesting traffic through it encapsulated and encapsulated four packets encapsulated
four D capsulated, four encrypted, four decrypted, four hashed and four verified.
Okay.
But usually most of the times if you see one of them going up, all of them go up.
So the whole counter goes up and down.
Either all three will not work or 1 or 1 of them will not work.
Yes.
If there is tampering happening, if there is tampering happening across the way, someone is tampering
with the data you digest and verify will fail.
Because when you send the data, someone will tamper it.
And when it reaches the other side, he will not be able to verify it.
So it will not accept it.
It will show you that the packet has not been verified.
Okay.
Digest.
Verify.
You know the difference, right?
Encrypt and decrypt is different than digest and verify.
Digest and verified is for integrity.
Encrypt and decrypt is for scrambling of the data.
Then you have compression.
Not important right now.
You have you also have something known as path empty ipmt.
MTA is important in IT sector.
By default, it uses the normal MTA of the interface, which is 1500 maximum transmission unit.
So if it goes more than 1500 it will break the packet into fragments.
ESP will to break it into fragments.
Right.
But sometimes what happens is now sometimes when you're in production, you see that everything is working
fine, but the tunnel traffic through your tunnel, when the traffic is going through, your tunnel
is going very slow, goes slow, and you wouldn't be able because everything will be configured properly
and you wouldn't be able to verify why.
One of the reasons could be the MTA.
Here is what, 1500 somewhere somewhere else along the way is going along the way, maybe somewhere
the MTA is less, which is not an issue because path you will find that out.
But what usually happens is there is a switch or something in the middle which might be doing tagging,
maybe double tagging and adding its own tags on top of that.
Now since this is ESP, no one can open this packet when you're tagging it and you're sending 1500 once
if you tag it 15 one four is okay.
If it goes more than that 1518 from your end is okay, you're sending it at 1500, but when it reaches
some other point, tagging is happening.
When it gets tagged, the size increases goes more than 151.
For the moment that happens.
Fragment.
Right.
Fragmentation occurs and that fragmentation is difficult.
Why?
It happens on the IP layer, Yes, that's fine.
Obviously, then it goes to the other side.
IP layer also fragments and brings it back up again.
But your tunnel was now is getting encrypted, is getting hashed, is getting broken down then is getting
connected back up again so your tunnel will definitely get get slow.
Okay.
In that case, how will you prevent that?
You will reduce the MTU on this side?
Yes.
Okay.
So that the encrypt the breaking down of the tunnel happens from here, not in the middle.
You want that to happen from here before encryption, not after encryption.
If it happens after encryption, it will make your tunnel slow.
So come it comes.
Compensate for that time before you reduce the force byte or eight bytes.
You make it one for eight zero or something like that before it leaves the tunnel.
Right.
Have to.
I mean,
why does Tunnel have to break?
The tunnel doesn't break it.
C tunnel is here.
I create my.
I create my packet.
It's one 500 bytes.
Right.
But when it goes to a frame, right, there is a switch in the middle.
Who is tagging it?
When it gets tagged, additional bytes are added on top.
When the frame was 1514, which was okay because the frame was added to it.
But if an additional tag is added, another four bytes will be added.
It will become 1518 is only 1514.
Right.
If it goes 1518, it will not be allowed to go through.
So it is broken down.
It will be broken down.
If it's broken down, it gets slower.
Okay.
In that case, now you will not see that happening, but that will require your gut.
You should know that tagging is happening along the way.
The packets are big.
That's why it's getting slow.
So reduce the empty.
It does double tagging does happen on the ISPs also.
So those things also, that's why it happens.
That's why it's one of the most common problems in ICT sector.
This part, usually we do that for the double pack tagging part.
We reduce the MTA so that it comes to level.
Development of the field to increase M2.
You can do it here, but you don't have control on all the routers out there, right?
You don't have control over your ISP.
So I can increase the M2 from my end.
But the general principle of everybody, everybody is using it at 1500.
It's a standard.
So when you send it from here, you are okay, you send it at 1700, but your ISP will have it 15.
So he will break it down.
It will break down.
The standard is 1500 everywhere along the way.
Okay.
Use
18 1518 with the tag is 18, but with the double tag it will become 22.
2018.
Yes.
Then you add the the frame.
You add the frame.
1515.
Double two.
Will we see without the tag?
It's How much?
1514.
Without the time, the frame
1518 Without the frame.
With the frame.
Default is 18.
All right.
So it's 18.
So you add four byte becomes what, one, five, two, two, and then you add four more.
If you're doing double tagging becomes 1526.
The whole point is double tagging, right?
The whole point is double tagging.
If one tag is there is okay.
I mean, you accommodate for one tag.
Everybody knows that because frame it's a standard.
If there is a frame and a tag, it's fine.
But if you are adding another tag on top of that one, which usually does happen, so another tag will
be added most of the times.
Again, yeah, that's what increases the latency.
Most of the times it doesn't happen, but it will.
I mean, if you're in production, if you have 100 tunnels out of those hundreds, you might see 5 or
6 which are down because of the empty based on which ISP they are going out.
Right.
Based on the because you don't know how they're dealing your packet since you have to be careful with
that.
Right.
How will you troubleshoot everything first, check everything else.
If everything else is okay working now, you won't know what's happening on the other side of the ISP.
It use the M2 21480 works.
Okay.
So you're fragmenting before getting encryption.
The other thing is inbound and outbound.
This is just the same thing.
It will show you how much is the remaining lifetime in your key.
This is the total number of kilo bits.
This is in bits.
So if you have these many bits, if this amount of traffic goes through the tunnel, this amount of
traffic goes through the tunnel, you get what the key is refreshed.
So it's both things I told you not a lot of data should go out.
Not a lot of data should go out.
Plus the time.
One hour.
So one of the two, whichever comes first.
Whichever of the two comes first.
Four four, 711, one, two.
4336 bytes 4.4 MB.
Now, again, if you compare it, if you look at documentation, there are certain documentations which
say it's four GB, some no 400 MB BS and some say it's four MB.
But there is still debate about what this actually is, the total number of traffic which can go through
the tunnel, total amount of traffic which can go through.
Let's actually let's actually go through this IPsec Cisco
Tunnel.
460800 KBS.
460800.
That is how much?
Kilobytes.
Gibbs cannot be dismissed.
Okay.
Yeah.
Divided by slow bytes.
I did the configuration wrong.
I configured it to be as bits, not bits.
Kilo bits.
So
(406) 460-8000
divided by 1024 will give you an mb BS 4500 MB traffic which can go through sorry by default through
the tunnel if 4500 MB goes through.
It will change the key.
So it's two things either one hour or 4500.
Traffic going through a 4500.
Traffic goes through the tunnel.
It will shift.
It'll make the shift.
You can you can change the Security Association lifetime.
You can change the security doors.
You can change the lifetime in seconds.
You can change it in kilobytes.
It's not bits, it's bytes.
The kind of data, not really.
But you can set up a restriction using your ACL.
You can say ACL permit only traffic, say TCP from here to here.
That is the only traffic that will go through the tunnel.
So it's up to you.
As long as that.
As long as that ACL is hit, it'll go through.
So when you're using TCP, you'll use the port number, TCP port 23.
So only Telnet traffic will go through the tunnel to the other side.
Okay.
Another thing right here is it's just a question, right.
We'll take a break after this.
And you would try to do it on your notebooks or wherever you're doing it and just let me know if this
there is a possibility that this will work.
10.3 is sending its traffic to 10.1 to the tunnel.
The ACL here is 10.3 to 10.1.
Whatever to that ACL.
I add another entry to the same ACL.
I say traffic going from 10.3 to 10.4.
Should also go to R1.
I'll send that traffic also to R1 and R1.
I'll say traffic if the source is 10.3.
Destination is 10.4.
Send it where?
Two are for.
Is it possible?
Should be possible, right?
Today.
I want you now.
I told you the concept, right?
I want you to write the access lists, which I would require to do this from R3, R1 and R4.
There's only one tunnel.
There's only going to be two tunnels, one between R1 and R2 and one between R1 and R2 three.
But I want R3 and R4 to communicate to each other through R1.
Someone can directly connect.
Not right now, but right now it will drop.
Definitely.
There is no ACL matching.
One more thing I want to note column content for.
Yes.
For directions.
You have to do it both right here.
Only here are for as well.
For our food as well.
Because our food needs to reply.
Right.
Reply to whom?
So from 10.3 to 10.1 will be one which will be here.
Here I need to from 10.3 to 10.4.
Going from this tunnel.
That would be.
That would be risky.
You can do that.
But we need to be more specific.
You can do that also, but that will be for all the traffic, right?
So what you could do, think about it.
I can have two different R3 and R4, just one here pointing to.
That's the thing from R1, I have two pairs only from R3.
I have one pair here and one pair here.
Both are pointing to.
So from here, one ACL is for 10.4 to 10.1 from here, 10.3 to 10.1.
It is speak for 200.
Also they will not be any reply.
Echo reply request will go and reply will not come back.
So it will reach R3, but R3 will not be able to reply.
So R3 will see decryption is happening, but no encryption.
On one side.
There will be decryption one side, there will be encryption.
Again, let me tell you something about troubleshooting.
When you're troubleshooting your IPsec VPNs, if your Isakmp Schmeidl is on, if you're already in a
schmiedl and when you're troubleshooting, what do you mean by schmiedl?
Which part of this will be correct and which part can be wrong?
This will be correct.
Your key will be correct.
Your transform set will be correct.
So if your first tunnel is coming up, all these three are correct.
Do not check those parts.
But if your first tunnel is not coming up, there is a mistake here.
Right.
If you're not getting anything at all, if when you do your show crypto campus, you cannot see anything
at all.
It's empty, black completely at that point.
That means you have not either applied the crypto map or you applied it on the wrong interface or your
interesting traffic is not matching route would be if your tunnel is coming up, the first tunnel is
coming up.
Your encryption decryption is not happening.
If your tunnel is up, the first tunnel is up.
Right.
But your encryption and decryption is not happening.
The possibility would be you don't have the routes to those destinations.
Let me explain how that could be.
If you have R1 and R3 right now, let's say R3 was not here anymore.
It was not there at all.
When from this side I send a packet, I'm sending it from where ten dot going to first negotiations
will become begin.
Negotiations will be complete done because negotiations require what public to public communication
policies are.
Okay.
Tunnel is form.
Then when the actual traffic goes through the tunnel, the traffic goes from 10.1 to obviously it will
be encapsulated when it reaches the other side.
It will be encapsulated when it decapsulation it.
It sees that it wants to go to.
He doesn't have 10.3.
There is no 10.3.
The packets are going to be dropped.
So the return traffic will not come.
You will see decryption is happening, but encryption will not happen.
It will never happen because the network doesn't exist.
You don't have the route to that network.
If you don't have the route, you will not know what to do with it.
So you'll drop it.
So you'll see encryption is one way decryption is on the other way.
If obviously this network also was not here with him, no decryption, no encryptions will just just
be there.
So if you see one side encrypting one side, not encrypting the route on the packet, on wherever you
see, it's not decrypting, it's not encrypting the side, which you see is not encrypting.
That means that side does not have the route to the net.
Okay.
These are very important steps.
So IPsec will show you how many packets are decrypted and encrypted.
You'll see it here, Right.
The best way to check your tunnels is not the full tunnel.
You always check.
The first thing that I always do is show crypto IPsec sa, section gaps, two tunnels.
First tunnel is not up.
The second tunnel for encrypted.
For decrypted.
Let me show you this on here.
I'll remove interface loopback zero.
So ten dot three is not there from Nelson packet to ten dot.
You see a packet will not go through.
But so crypto camp is committed.
So your first tunnel is up.
The second is not so crypto IPsec sa section caps.
Three packets encapsulated.
Zero.
Encapsulated D capsulated.
Zero means what?
Nothing is coming back.
I'm sending.
Nothing is coming back.
Let's check on our three.
So crypto IPsec section gaps in the old one.
Right now it will not encapsulate any.
So if you keep sending him,
you can do what?
I'm sorry.
What we do.
Clear counter on this on the.
Okay.
So crypto IPsec.
Let me see this first.
Scabs.
Zero zero.
Right.
Clear.
IPsec Clear Crypto.
I don't want to clear it down.
I think there should be something say counters so crypto
6001 here and start from here.
I'll send again and you'll see that one side will be five, the other side will be zero.
So from this end you'll see decryption is happening, but no encryption.
Because it doesn't have the network, so it doesn't get a return packet.
I removed the loopback three.
I removed 10.3 network.
10.3 was not there.
Decryptions are happening, but encryptions will not happen because I don't have the route to come back.
These are very important troubleshooting steps because this is where you get stuck when you're creating
a tunnel or something like that.
These are the small things that you'll see once encrypting once not decrypting tunnel is one.
Part of the tunnel is up, the other is not.
So two important things.
If your tunnel is up, there's a problem either with your access list or with your out.
Right.
If your is not coming up at all either you're not applied the crypto map anywhere.
Right.
Or you're interesting.
Traffic is not hitting the interface.
So there may be a problem with the routing too.
Okay.
If your app is getting stuck in a stage, you are more than more perfect than me.
On knowing what's wrong with that if it gets stuck along the way, right?
You know, first and the second packet, fourth and the fifth.
Fifth and the sixth, seventh and the eighth.
That's it.
That's your IPsec.
If you can figure this out, it's done because everything is based on IPsec.
Yes.
It will not do double tracking because of double tagging.
It will go more than that and then it will be broken down into fragments.
So you have.
After that and the actual traffic goes, your traffic that is going out first packet will not because
those are small packets.
The first packets are very small, 400 bytes, 400, 300 bytes maximum I think is 454 or 2 bytes for
the which has the rest of the packets are very small.
So now how do you how do you know how we have to how.
That is M2.
You change it on IPsec.
IPsec.
There is a command, which is Crypto IPsec M2 for that interface path M2.
Also you can change.
I'll show you that as a lab.
I'll show you that as a lab, I'll decrease the M2 on one of the interfaces and I'll show you how the
path will go down.
I'll create a separate When I'm doing that, we'll do both together.
Nat and IPsec M2.
We'll do it together.
Okay, Claire, Any questions with this?
Good.
Right.
Let's take a break.
And after that, let's do the hairpin.
Yes.