I'm going to create a tunnel between R4 and R1.
Let's start from R1, the simple one, and let's see what configurations do I need.
Step one policies.
What policies?
Then.
Syndication.
Step two.
What is the address on step two?
Address on the here will be 34 dot.
Okay.
Third.
For.
2010.
440.
Step five map.
Match this one on one set.
Transform.
Set.
Set Here.
151 .34.00.
Crypto map.
So from this end, it's okay.
From this end, there is nothing different.
It's pretty.
Pretty much almost the same as I did it before.
So I'll go in here.
Okay.
I see.
Camp is off from this end.
Is okay.
What about the other side?
What changes do I need to make?
Policy.
The same address.
Uh, when you need the public IP or the private IP, it has to be the public IP has to be because for
R4 to reach R1, he cannot reach it by the private address.
It can only reach it if he uses the.
Public, right?
Obviously, I mean, on the Internet, the only way to reach R1 is from the public address and you can
verify that also from R4.
If I ping 15.1.13. ten, I can reach that R1 to make sure that it is actually reaching R1 debug IP,
icmp ping.
Coming all the way to.
Obviously this source becomes 192, 168, 12.1 because of nothing to change is the destination.
So it comes back to 12.
So the address that you give on the other peer is 23 dot ten transforms at the same access.
This will be reflected
and said peer will again be what Interface Serial.
Happy to do our food and.
And then what I'll also do is debug.
Crypto icicle.
My nine packet exchange.
I want to debug it.
I want to see what all changes take place on R1.
What packets are sent?
What packets are received and so on and so forth.
Also I'll run what Wireshark.
Side by side.
Keep it on here before nothing and after nothing.
So two instances.
One is here.
The other one will be.
Yeah, right, guys.
Now let's initiate the tunnel.
Before I do that.
So access List.
IP Access List.
Extended Firewall.
No.
One.
No.
Ten.
No.
20 So it's denying everything.
Deny all the connections are denied.
Right.
I will initiate the connection from outside again.
Ping ten 111 with the source of ten will not go through.
You will see that if it was 25, now it goes to 26.
I will allow this traffic to go in.
First, let's have a look at the exchange.
As the camp is trying to come in but is getting dropped.
Destination unreachable is going to waste destination from source 500 to 500 to 23.10 is trying to create
a tunnel with 23.10.
But since R2 is blocking it, it's not allowing it to come back in.
What do I allow on the access list?
123.1.4.
Write it down again.
How do I allow this through this packet?
Through.
Peson on their outrage.
They changed that from 8.48.3 onwards and that gnat comes first in 8.4 onwards.
In water construction.
Did you find?
So from the public.
The public.
But the public.
Based on extreme translation doesn't.
But the text convection.
Then.
Let's call.
I think
it's the same.
I use it's the same one I use public because UDP will be started public to public.
Right.
You believe me will be started from one public to another.
Public.
So when I go here, it will be the same packet.
My original packet will be kept in the buffer going from 10.4 to 10.1.
It will be buffered and then a UDP session will be established with the set pair command, with the
access list, with the UDP pair address which you have specified.
So going from one 51.30 4.4 to 23.10 from here because he doesn't know the actual address UDP 502.
When you come to a router, you have two checks in there.
The first check is the ACL check.
Then you have natting happening.
Still is right now blocking it.
You have to allow it through the block.
So you go to the ACL and you say, what?
Permit this traffic.
Which one?
This, this, this and.
You permit this and it will go through.
So once it gets permitted, it goes to the gnat.
The nat changes.
Which part?
23.10.
It changes it.
By what?
192 168 .1.5.1.
The packet reaches the other.
Okay.
Does this go to R2?
IP access list.
Extended firewall number.
Let's say ten as a permit UDP from host 151 .34.4 to host.
151 .23. ten Equal to source also.
Okay, let's try the exchange again.
Right now it was getting stuck in no exchange.
So crypto now it won't because it has stopped trying.
But earlier it would get stuck in no exchange because he did not get the reply for the first package.
Now I'll do it again.
Where do you think it will get stuck?
What will be the state of the package?
Yeah, my dad.
What did I tell you about the exchange?
Not to be detected.
Where is that?
Third and fourth.
It will be detected.
The change is made in the fifth package.
Again, Trionfo will be in detection.
The key exchange.
Key exchange should show.
Now, both will work the same way because the outside will be the same.
Which means which packet is getting dropped.
The fifth package is getting dropped.
So you want to check the exchange?
You can go in here.
Yeah.
No, not fourth.
Fourth will be detection until fourth.
See?
Starting from here.
This is the first packet with the policies.
You know, Policies.
Second packet with the policies.
Let's check the third packet.
We have key exchange and nonce.
You also have what?
From that detection.
Those are not the what is included in there.
What information is in that?
The actual source of the packet.
They won't show it here.
It's not written open text.
We won't show it to you there.
But in there is the address, the actual address.
It doesn't actually send the full address.
It sends the hashing hash value of that address of that first address.
Now, once you have that first address in there, the other side will get it and it will detect it.
Mac, why do you need it both ways?
Why do you need to wait for the fourth packet?
Because when I'm the peer, you're the peer I'm sending you.
I'm telling you, this is the source.
When you reply back, you will tell me that that is happening,
right?
It's like this.
So what happens in R1?
Initiate the R1, initiate the connection.
Same thing.
Exact same thing.
R1 doesn't know.
See first packet goes policies.
Second packet.
He will still send 192 168 in the payload right it goes out here.
R4 detects Nat in the fourth packet.
He replies and tells him listen Nat is happening.
R4 will tell him that's why you need the fourth packet so that the both sides know.
Do you get it?
Now?
Detection is packet number three.
So packet number three R1 will put his source in there and R4 will see when it receives when it is received
at R4.
R4 will see.
Okay, that is happening.
So R4 knows but R1 doesn't know they need to mutually decide on that.
So R4 will reply back with the fourth packet in the payload and that will be yes, that has been detected.
So from now on we will move to move to port number 4500.
Right?
You can see that in Wireshark also if you want to if you go in here, this was packet number.
Fourth packet number fifth is this 128.
If you check this source is 4500.
Destination is.
Source 45, destination 45.
And this packet is dropped because you get an ICMP unreachable message.
So it keeps on sending it again and again and again.
Right.
Since it's the first packet which gets stuck in exchange.
Exchange.
Is this clear?
How do you allow this?
So I allowed 500.
I also need to allow 45.
So I'll go to my ACL.
I'll go back again.
I'll say 20 permit UDP from host 151 .34.4 to host 151 .13.1 equal to 45.
Now.
How many packets will be allowed?
Where will it get stuck?
Will it get stuck in the middle?
You say?
Yes.
Goes to.
When that happens.
In the end.
No, I forgot to show you something else.
Wait.
Forgot to show you the actual stuff.
This is the debug IPsec ICMP, right.
Let's check the debug.
Now I want to see exactly from the start clear crypto sessions.
Let's remove this whole thing.
The sessions.
The tunnel is clear.
I want to see the exchange which takes place because of debug.
Because you won't have Wireshark available to you all the time.
You ought to work on Debugs.
I'll copy this.
The links.
From here and paste it here.
These are the debugging messages, all of them, which happen when your camp is getting formed.
Right.
So you'll see a pair struct has been created.
Local port that I'm using is 500.
Destination port is 500 again.
Right.
I'm getting a message from the peer.
My Isa camp is ready and there is a vendor id nati that has been detected a lot of things.
The important part is not this.
I'll show you what policies checking the transform set against the priority.
So he gets the priority from there and he's checking it against this.
Right.
And he says it is acceptable.
This is a camp policy.
Whatever I'm receiving from the other side is acceptable to me.
Right.
Then the lifetime that they have agreed upon, 86,004.
If the other side's lifetime is less, it doesn't mean that the negotiations will fail.
The lower one will be negotiated.
So the other side, if one of the side will choose the lifetime, let's say 12 hours, both of them
will negotiate on 12 hours.
That's what he's doing here.
Okay.
Then again, certain IDs which are not used constructed Nati.
Is canceled.
Pignati.
What is he constructing inside Natty?
The actual source address and sending it to the other side.
The other side receives it.
Receive packet from the other side.
500.
In that packet will be the information that Nat is happening.
So you will see that it says Nat detected or not found.
Yeah.
Right here.
And it receives the packet back.
Says what?
This happens at the end of the fourth batch.
He sees that the gnat has been found when he sees the gnat has been found.
You see that he will move to.
From 500 to thousand 500.
So what happened and everything.
I'll explain that right now.
It's how it happens with UDP.
So all nine packets of ISI, the first four will be 500.
The rest of them will be 45.
But what happens with ESP?
That's what we want to see, right?
Let's open it on Wireshark and see.
Remember the color of ESPs used to be What?
It used to be white, colorless.
Now it's still blue.
While it's still blue, If you open the packet and you have a look at it, you'll see something strange.
IPV four.
It used to be IPV four and ESP before.
Before netting.
So it's using UDP four five.
This is the UDP 4500 which is added, which is an extra Add.
It's an add on between your IPV four and ESP.
Right.
Earlier it used to be IPV four and ISP.
So in the ACL you used to specify permit this from source this to this, and the protocol is highest.
Now it's not the same.
Now it's permit from the source of 34.4 to the destination of 23.1 and 4500 to 4500.
So if you permit that, it will go through the ACL.
You don't have to worry about what is coming after that.
Do you understand?
When the ACL, when your actor is doing his routing, when he's making a routing decision, he does
his decisions based on what the header?
What header is visible to him?
The public header, right?
This.
So when he does it, this header is visible to him.
Right.
Earlier it was IPv4 and this was not there.
Right.
So when you allow through the you allow IP address from this to this which protocol ESB protocol and
is done.
So is it let's say this.
No.
Why is it less safe?
What is visible?
This is just you added it.
There is no extra.
There is no information in here.
It's not telling you what is the actual port number you're using inside.
It's just there so that now when natting occurs, it will occur here.
If padding occurs, you have an additional four 4500 for padding.
You can change this 45, which will not affect the hash.
Even if this was H here h will do hashing from here onwards.
UDP encapsulation of IPsec packets.
It will not go to the other headers because now you have H.
You have given him a header on the right side, Left side.
He already has the header, so we'll hash that part.
So what, what do we have on the left side?
The public access and let me write down the header here.
See the header from coming from R4.
It will look like this.
Let's say ten .1.1.1.4.4.4.
Going to ten .1.1.1.
Now it can be ICMP or it can be anything, it can be TCP or ICMP or whatever you send it, right?
It will be encapsulated using what?
ESP but since that has been detected on top of this will also apply.
First, it's called UDP encapsulation of IPsec packets then.
450045.
And then your actual IP header, which is like the public header.
Yes.
Now, this is this packet is for the external.
They can play around with it, do whatever they want with this part of the traffic, which is going
from 34.4 to 23 dot ten.
Since this packet is not hashed, it's open and the port numbers earlier.
Remember the problem with ESP was there was no port number available so I could not do padding because
it was IP, then ESP and then encryption.
There's nothing in the middle where I could pack for padding.
You need port numbers.
That's why I added those port numbers on top of this.
This is why did I add a UDP on top of that one?
Because I want to prevent the H because H does it on the right and the left.
So H would do it for this guy also.
And this guy also.
That's why I give him this.
And this is never changed.
Even if fighting is happening, this part will change.
Good.
Sorry.
Empty you.
You think this is empty?
Yeah.
It has no valuable information in there.
Thank you.
Oh, there's another one.
The 4501.
This one.
Something.
There's nothing in there.
Just an empty header right there for.
Okay, let's do it.
What happens when you have Batman?
And.
Uh huh.
Okay, so in batting, what you would do is.
You would have this address.
You have this address bound to a padded address.
151 .23. Let's say the interface address at port number you bind it to, for example, 500.
Right.
So when you create a tunnel from here, you will be creating it.
With whom?
500.
When the actual tunnel is created, whatever traffic is going out from now, whatever traffic will come
out from here.
Right.
Let's say I want to.
Create a tunnel and I want to send traffic.
The tunnel is up.
I want to send traffic to ten .4.4.4, which is telnet.
Horizontal Internet traffic, right.
You net detection is on.
Batting is happening here.
So my traffic will go from 150 .1., let's say not.
Well, let's say my traffic is going from 192.168.15.1.
Going to.
34.4 Searsport.
4500 destination port the UDP.
And then the actual ESP which is protected from then on when it hits the router.
The moment it hits the router, the router doesn't just change this, it changes this with the interface
address in pad in case a pad which is one dot 20 3.2.
It also changes which part the source code to any random number 1024 and then the packet will move to
where to four.
If it was ESP, this was not available to him.
These port numbers were not available to him so he could not do it.
He would drop the packet.
Great.
They is the reply.
Yeah.
The reply will come.
To what?
Coming from 4502 when this packet hits the router.
What is the router going to do?
Change it back to what?
Remove this.
Change it back to.
So when the packet goes to R1, it will still be 45.
This is for the telnet for is inside esp.
That is right there inside esp.
So that decapsulation it does.
Then he finds the actual port number and then he sends to the actual number that is hidden behind the
ESP.
Any questions?
Detection.
In in for initiated traffic.
You want to see how it looks like from afar?
Yes.
Alpha.
Alpha is what?
Static.
Starting the exchange.
Same.
There'll be no change if he goes to.
Let's say he's coming from 150 .1. 23 dot sorry.
30 4.4 going to 151 dot 23 dot 20 3.1 ten.
Right.
And starting from first they'll start for 500 to 500, the first part for UDP.
Then they will negotiate it, they will negotiate it, then they'll come back and start the exchange
onwards 4500 to 4500.
Here the destination will always be 4500.
And since here, since here, you're using 4500 for R1, you will bind the two ports.
You will keep 504,500 open so that no one else uses it.
Right.
When the packet hits 45, he will not change 45 to anywhere.
He'll keep it as 45 and move it back to.
You don't want 45 to change, right?
The destination port here should not change, but the packet is coming back in y.
When it reaches R1, it should reach at which port number r1 will only understand it if he's coming
back at 4500.
Fighting happens when?
What is the whole point of fact?
People can go out coming in.
It doesn't affect anything.
It's that going out.
I want the source to be changed to an address.
I do.
I am using pads so that whoever is coming out can use the interface address.
Y z.
Static part, right?
Have you done static part?
What does static part do?
You link the outside addresses one port number to a service inside.
So 151 dot 20 3.2 port number 4500 is linked to 192 168 12.1 14 port number four 4500.
So anything is coming to 4500.
It will go into 4500 on R1.
You will also do it for 500.
So if it's coming on 500 or 4500, you'll move it.
Where to R1 at port 504,500 respectively.
And in the future it will be thousands.
That is going out.
Going out.
The packet that goes out.
That packet.
Yes.
If the return comes to that older port number that he used, this will change after.
After what?
Why is it different?
It's supposed to be.
This one.
Even from Marco.
To see the problem with this.
When you're going from R4.
Right?
When you're going from R4.
He said that we initiate the tunnel from outside.
If you're initiating the tunnel from outside, do you know what source port number is open here on R1?
You don't know the source port.
So what you do is you bind 4505 hundred from here to outside.
You say if I send a packet on R2, you say if I send a packet to R2 address at port number 4500, that
port that should be forwarded to R1 at port number 4500.
And you say if I forward the packet to 500, that should be again forwarded to 192 168 12.1 at port
number one 500.
So from outside I will still send it on five 4500, but when it reaches here it knows 4500.
He has to put he removes it and put it back back again, but he moves it back to R1 static packet.
Do you understand
where
there's another router who does what?
Nothing.
There's another outage.
Yeah.
Then he'll do his own normal routing.
If there's another router here, let's say our seven connected to whom?
Yeah, that's what I'm saying.
Okay.
Between these two, there's another outage.
Yeah.
I have another out.
Okay, then what about.
What is the port number is 45.
It will always go to our.
There is another VPN configured on.
Then you will have to use policy.
Nat.
In policy.
Nat, you have to say if it's coming from 34, then it should go to R1.
If it's coming from 34 and it's coming to port number 4505 hundred, it should go to R1.
If it's coming from some other router, the one which you have created the tunnel with and it's going
to 4505 hundred, it should go to policy BBR
that with Nat you need to do it for nothing.
No, no, no.
This is a policy.
Nat When you say Nat inside source, you say change it here using access list.
And then I don't want to change the next hop.
He says, I want to change the map.
See, what he's trying to say is, when you do that, right, what are you doing with Pat?
You're saying 151 dot 20 3.2 Port number 500 should take me to 192.168.15.1 Port number 500.
And they also say one 51.23.
If someone is coming at 4500, you should also take me to the same one at 4500 so that the exchange
is complete.
This is pat static.
Pat static statically bind these two together.
What you could also do is you could say, okay, if it comes here, not only this, I have a condition
now, if his destination is this and his source is 151 dot 30 4.0, if these two match in an access
list, I'll specify it.
If it's coming from this source to this destination or this source to this destination, it should be
noted on 2192.168.25.1 Port number 500 or 4500.
I'm not.
And as it comes.
I'll also say if it's coming to the same port numbers using a different source from the outside.
If the source is different, then it should take me to the other outer R2, which is also running 540
500.
Policy that.
With policy night you can policy.
That's why I said policy, right?
Have you ever seen policy?
Not how it works.
Policy not write policy that works in this scenario.
That's the exact scenario.
I think that will not work.
Dynamic pad static part is not work.
That's why I said those ones will not because one port number, you'll only be able to bind it to one
source.
But if you use the source as an access list and you send that to this address only if the access list
matches.
I'll show you how that is done.
The command for that is you would say IP nat inside source static.
You also have an address for an access list.
Source list.
If the source is the access list and the access list, you specify exactly coming from this source to
this destination.
If that matches, if the list is, let's say 101, then the destination should be what either the pool
or the interface address source will be from that particular address.
Destination will be port number 504,500.
Both if it's 500, then you keep it at 500.
If it's 4500, you'll keep it at 4500.
And you?
Just didn't have a sweet table.
But we will take.
Yeah.
According to the table.
Yes.
I think.
And that.
Not if you're only using static.
No.
With static fat?
No, but it is possible to do that.
That is also that is also a kind of fact.
That is also a kind of fact.
Which is an additional they have added on to pad normal static pad.
You cannot.
That's why they brought policy.
Nat Right.
Nat Nat would not happen anyways, but it would happen with one host.
But now you have two hosts to host also pad will fail.
So what comes further is policy pad policy now where you can specify if it's from this source to destination,
this destination, then change it.
Okay.
It's easier On the firewall firewall, they have something known as twice Nat All right.
So you can do that there.
If you're using Nat King on a firewall, you can do it there.
Also on the router is also possible.
Okay, Clear.
Is this clear?
The whole concept of Nat, the detection happens in three and four.
The process which happens after that is known as Nat Nat Traversal.
We are traversing now through Nat.
Nat is happening, but we are still traversing using the tunnel.
Okay.
See also.
No, no, no.
That's different.
That's nine zero.
That's one of our.
That's our identity.
That.
Right, Nat Traversal, Because nothing was happening, right?
My ISP would not be able to do nothing.
ESB was.
ESB did not have nothing.
Yeah, I think so.
It wouldn't do nothing.
ESB would do that.
Yes.
Complicated.
So that's what it does automatically.
It uses I don't specify 500.
Also, do I specify 500 anywhere?
I do not specify 500.
It automatically goes.
It will always go to 4500.
It will not go to 4600 or 40 501.
The protocol is defined in a way so that when it doesn't go 500, it goes to 4500.
If you check your access list, it is also called non icecap something non icecap list non 500 icecap
port number 4500 is also called non 500.
Non 500 means 4500 icecap.
So I starts the traffic traffic.
Apple would reply to the 2005.
Yeah, but it's hard for such traffic.
The traffic is at 45 is only 4000.
Yes.
The thing is you wouldn't even do that.
The most times when you do this you'll always reserve port numbers for into out reserve 505 hundred.
So when he's going out he's not fat will happen.
But if he's going from 500 he will be stuck with 500.
He'll give him 500 also or to make it will work without that also.
But that will mean that you can only initiate the tunnel from inside.
For this case, you would still need to do it if you want to enable from the outside.
If you don't book the port numbers for 4000 504,500, you would not be able to create the tunnel from
outside.
Right.
Because when 4500 comes here, he doesn't know what to map.
So he would drop the packet.
So in any case, the better scenario would be you bind 192 168 12.1 to port number 504,500 on the outside
address.
Then it's possible.
Static statically bind this to 23.0 1020 3.2 at port number 540 500.
So they should take me to 192 168 .2.14 Number 4500.
182 168 12.1 code number.
Right.
One more thing.
If you check your show, Crypto IPsec.
You should see in that the port numbers that you're using.
And I've not changed it.
I'll change it in.
Here, you will not see it.
You'll see it under the interfaces.
I'll show you how to do that.
The board that it's using.
IPsec The board that my IPsec is using is which one?
45.
Because now it's UDP encapsulation.
Good.
What be.
But we shall not checkpoint It's different and some other firewalls is different.
This is also same same for 8.2 onwards it changed, but before 8.2 it was ACL first, then Nat, but
that caused problems later because you had to use the Nat addresses, not the real ones.
So they moved it back to 8.4.
They did nothing.
That's a different scenario, right?
Okay.
Oh.
Okay.
It's all right.
Thought the recording was not happening, but that's.