So the next thing that we are going to do is what?
I want to make sure that R3 and R4 communicate to each other through R1.
Based on what?
Purely based on access lists.
Okay, let's do that.
R3 and R1 right now.
Now it's all based on your access list, which will tell you what traffic should go through the tunnel.
Right now, if you go to R3 and you do your show, Crypto IPsec, you'll see that traffic from 10.3
to 10.1 is going through the tunnel because my access list 101 is saying traffic going from 10.3 to
10.1 should go through the traffic.
What I'll do is to that access list, I'll add another keyword which says traffic from 3.3. 0 to 10
.1.1.4.4.0
permit.
So traffic coming from ten dot three going to ten dot four should also go through where.
10.32 10.4 will also go through the same tunnel from 23.3 to 12 dot.
Correct.
Let me send the traffic from here.
Ten .4.4.4.
The source of 10.3.
Yeah.
I'll send some packets which will obviously not go through.
Will they be encapsulated?
That is the question.
What should I see?
Encapsulation.
Decapsulation.
Encapsulation.
So IPsec SA section.
10.32.
10.4.
He sending errors?
Let's check.
Why is it sending errors?
Sending errors because when the negotiation took place.
Remember, the other side should be what?
A mirror image of this side.
The ACL on the other side should be.
Do I have an ACL on the other side which will decrypt this packet?
I don't have anything on the other side which will decrypt this packet.
So I also have to do is I have to go to R1.
Show access list.
Now, this one will be for 10.3, so I will change with one 101 permit IP coming from ten dot.
Going to ten dot.
What did I do?
I went to R3.
I said, okay.
Add to this.
Going from 10.3 to 10.4 should also go through the tunnel.
And here I said, okay, traffic going from 10.42 should go through this tunnel.
Correct.
Because the reply for here will come here and then he'll want to go content not for the reply will come
here and then he will want to go to the other side.
What else do I require from this end?
Another ACL on R1, but that will be for this tunnel which says traffic going from ten .3.3.3.
Going to ten dot should go through this tunnel.
Right.
And from here, I should say from 10.42 should go through.
Right.
Let's do that.
So here I do not change.
Now I added on to one list.
I added on to this access list.
I also need to add on to the second access list.
1 or 2 is the second tunnel.
In the second tunnel.
What traffic will go from 10.3 to 10.4.
So access list permit IP from ten dot going to ten dot
show access list.
Good.
Good enough on our three.
Good enough.
And then also I need to do finally for.
Show access list.
See, he is getting he got it from before where it was not encrypted.
So here I'll say access list 101 permit IP going from ten .4.4.0.
Going to ten .3.3.0.
I also need to clear all my apps access list.
Sorry, your tunnels show clear crypto.
You can also clear the session which will clear everything or essay essay will clear the security Association.
So essay which is your IPsec essay will be cleared.
Also do it here clear crypto is the first tunnel clear crypto either session or essay and R3 finally
clear crypto sessions clear crypto.
Then from here I'll send packet to 4.4.4 with the source of 3.3..
Go through the packet goes through from here back to show crypto IPsec sa section.
Encapsulation and encapsulation.
So now.
Clear crypto counters.
10 in 10.
But if I wanted to send.
10.1.
That will also work.
If I don't take the sauce, it will not hit the interesting traffic.
If it doesn't hit the interesting traffic.
Yes.
Straight to the Internet.
You go straight to the Internet with the outside interface, the public IP.
I mention this for outgoing interface.
You wouldn't really do that because that is your public address.
You don't want to go from public to private.
You want to go private.
Why?
Because this actually, when I'm doing from loopback to loopback, this will not be a loopback this
will be a network here with PCs connected just like yesterday I showed you routers behind right router
to router communication was taking place.
Those are PCs behind you want traffic to be encrypted from this PC to the PC which is right here.
You want these PCs to track not loopbacks.
Okay, so the PC to PC communication is possible across the map.
Right now our phone is talking to R3, but through where there are two tunnels,
there's this tunnel and there's.
System.
But between R1 and R3, you'll see there's two data transfer.
Two data types.
One is from ten dot 3 to 10 dot one.
The other is from 10.3 to.
Right.
If you go to R three and you do your crypto as a Schmeidl is only one, but your IPsec, there are two
IPsec s one for traffic going from 10.3 to 10.1, the other one going from 10.3 to 10.4.
Based on the access list.
So if you have as many entries in the access list as many IPsec tunnels will be created.
But since they're all using the same material.
Same material.
Right.
So your camp will only be one which will be there for 24 hours.
24 hours.
It will give you a new tunnel on which one?
Two data.
Two data times?
Yes.
Why not use the original tunnel is to differentiate between the two traffics.
See, right now there are two types of traffics that are coming in.
You have decided to access existing tunnel, but you're not creating another.
We are not creating another tunnel.
See your actual traffic.
This traffic traffic is defined by which ACL 10.3 to 10.1.
If you wanted only one traffic, one tunnel, you could have just used one ACL, which says ten .0.0.
0 to 10 .0.0.0.
There will be only one tunnel.
But if you have two ACLs, two separate lines of ACLs that will create two separate data tunnels which
will obviously use the same parameters, but he will send it through different data tunnels which will
have the same endpoints.
If you check right now, the endpoints of both of the tunnels will be the same.
This is from 23.3 to 12.1.
And this is also 23.3 to 12.3.
The endpoint will be the same.
Everything will be the same except for it'll be shown as two different because they want to show you
encapsulation for this traffic is separate, encapsulation for this traffic is separate, so you can
differentiate between the two at your end.
At three, is that right?
So as many as as many data tunnels.
You have IPsec tunnels.
It's the actual tunnels.
Who is The traffic goes where this is happening.
It was all good.
I mean, when you have something like this, side to side, communication is more than enough.
It's fine.
But it has certain problems.
It has certain limitations.
What are those limitations?
For example, R1, R3 and R1, I have right now three sites, so it's okay.
What if tomorrow I have 50 sites for R3 to manage 50 sites he needs 50 What?
50 acres needs 50 acres to manage 50 sites.
Right.
Plus, if you add another sites to the 50 sites, you add another one site, you have to add one command
of ACL to all the 50 sites, at least one even more than that.
Right.
So you have to create separate tunnels for all of that.
It is good for lower number of sites, but scalability is not there.
Plus, another limitation is, remember I told you ice camp is only triggered when you have interesting
traffic.
Say, for example, your tunnel is up but 24 hours pass.
After 24 hours, the tunnel goes down.
If you use a crypto map like this, the tunnel will stay down.
It will not come up unless you have interest in traffic, which is really not an issue because when
you send interest in traffic, it will automatically come up.
So if you're sending if you're using a protocol or anything, the moment you send something, 1 or 2
packets will go drop and it will go through and the tunnel will be set up.
But still, if there is a requirement that you want the tunnel to be up all the time, if you want the
tunnel to be up all the time, you would require a mechanism of keepalives or something like that.
That's the second limitation.
Third limitation is an IPsec tunnel.
Does not this crypto map using crypto maps, it does not support multicast and broadcast through.
There is a reason for that.
Say, for example, I want you to run routing between 10.1 and 10.3.
I would run a routing protocol here.
How does your routing traffic look like?
Source will be ten .1.1.0.
Destination whatever zero wherever here destination will be 224 dot.
Even if this was allowed through the ACL, you say ACL this should go through the tunnel.
The other side multicast traffic looks like.
What source?
Destination.
You'll have to put that in the ACL.
Are these two a mirror image of each other?
They're not a mirror image of each other.
It's loading the Provence.
Routing does not work.
Thing does not work.
Doesn't work through an IPsec tunnel.
If you're using crypto maps.
Right.
So why do we do crypto maps is to get the concept of how the nine packet exchange works and how to set
up a side to side routing from where to where doesn't work private to private.
I know that you cannot run dynamic routing through the tunnel and you're sending traffic through the
tunnel.
You can only send traffic, which is meant in the ACL, right.
How does it decide which traffic goes through c R1?
How does it decide which traffic goes through the tunnel?
What is the main criteria for it?
Interesting traffic which is defined by ACL.
Now you want routing traffic to go through.
How will that happen?
How will that work?
What will you use?
How what will you use when we yesterday.
Static.
I did what with the static.
I mean, the whole routing was done by the default route.
That is the public.
You're talking about the public routing.
Public routing will be there.
I want routing between 10.1 networks and 10.3 networks, and that was possible.
So what will you create?
The neighbors.
Can you run on the Internet?
But.
I didn't.
I didn't use the edge.
He used it as a normal, not the Internet concept.
It's a normal browser.
It will work as a normal router.
But again, that will give you connectivity maximum from R1 to R3.
You can you can share if you want to, if you can share 10.1.
But then Internet will also have 10.1, which is not allowed.
If you share routing between 1 and 2, one and two cannot become neighbors because then internet will
get 10.1, which is not allowed.
Even if you run BGP, 10.1 is not allowed to be advertised in your BGP.
So R1 you don't want R1 and R3 to become neighbors using the public address lab.
You can do anything.
Lab.
I don't even need the tunnel.
I can just have a static route from R1 to R3 will work.
Right.
But our job is not lab.
Right now we are going for a real life perspective scenario where this is the internet and you want
our ten one and ten three to be shared dynamically through a protocol.
For that you will have to tell R1 what traffic should be interesting to be sent through the tunnel.
And the interesting traffic in the case of routing protocols is what to 20 400, 10 to 24 009 and stuff
like that, which is not practically possible with the ACL because they cannot be a mirror image.
For it to be a mirror image, it should look like this.
Ten .1.1.1 going to 224 .0.0. let's say ten.
And on the other side the mirror image should be 220 400 ten going to.
Is it possible, is it possible for the source to ever be a multicast address?
Multicast is always destination.
The source will never be a multicast.
Okay.
So that kind of problem, these three problems in your crypto maps caused the need increase, the need
for tunnels which were already there being used.
The only problem with tunnels were they were open, they were cleartext.
So if you send, for example, a telnet through and you follow the TCP stream, you should see the password
and all of those things would be available to you.
So what did we do?
We tried to protect the tunnel with IPsec.
It's called over IPsec
Over IPsec.
So you have running on top of that, you will run IPsec to protect your tunnel, which will support
your routing, which will support your keepalives.
You can do your keepalives you can do your routing Keepalives Why?
Because let's say you keep keepalives for 10s every 10s it will send a keepalive packet that will do
least of all.
What you will do is it will make sure that the tunnel never goes down.
When your system goes down after 24 hours, the keepalive will come back, trigger it back up again.
So your tunnel will never stay down.
Okay.
Gary, what do you mean by unidirectional?
We are not defining if we are not defining.
Even not even.
Not.
But usually why we use gray is we use ijp or something over it.
And they will go through.
Yes, they will bring it back up again.
That is the whole point of using every five seconds it goes right.
The packets will go, so I'll bring it back up again.
You can tune that if you don't want a lot of traffic to go through ijp, you can tune that to 40s.
It doesn't affect the neighbor relationship.
Hello.
Timers don't affect the neighbor relationship, so you can increase that to a higher value and you can
make sure as per your company's norms, how do you want the tunnel to be up and how do you want it to
go down and stuff like that?
Okay, that is what XLR over IP set that will do tomorrow, right?
Plus we'll also do Natting and the MTA.
We'll see how MTA affects your your tunnel.
How does it make it go down?
Okay, now we won't have an actual switch which does double tagging or even tagging in that case, right?
Sometimes Mpls also adds labels.
You have Mpls running in the service provider and we do Hikvision two is also in your syllabus as the
new one that they're using right now.
And Flex VPN is out there also, which is new, which has taken over all the VPNs out there, right?
But in your syllabus you don't have the complete flex VPN, you only have some part of it.
But I have a video if you want.
I have a video for the Flex VPN also for all the three hub and spoke, spoke, two spoke and server
client.
All three.
I have a video separately which I just created for the sake of the video.
It's not there for your syllabus, but it's I've done it as a video.
Okay, that'd be all for today.
I think this.