So side to side tunnels using.
This is going to be the whole purpose to create this tunnel.
192 168.1.0 slash 24.
LA.
My job is the same thing as before.
I want to make sure that 10.1 communicates to 10.3 right over the internet.
Now is go long back.
We've been using them from a long time.
These are virtual tunnels, right?
Which support connectivity between your private networks over your public cloud, without encryption,
without anything.
It's the most simplest form of a tunnel.
Let's see how it's done.
My config is done.
151 .13.3 I can reach from R1 to R3.
Okay.
How do you create a tunnel?
Interface Channel zero.
Now, this zero can be any arbitrary number.
It is a local number.
It doesn't have to be the same on both sides.
Just like loopback zero.
Loopback one.
It is also just a number.
Right.
So I'll choose zero.
IP address 192 168 1.1.
Another source is the public address, which is 151 .15.1.
You could also say tunnel source fast Ethernet zero zero pointing towards the interfaces address tunnel
destination.
What is the final destination?
23.3.
But if you check your route now, you'll see a new connected interface in your running config.
This interface has the address of 192 168 1.0.
Let me go to the other side then I'll explain how it works.
Here also I'll say Interface tunnel.
I'll use one IP address.
192168.1.21.3.
Since it's our town source from here is what fast Ethernet zero zero tunnel destination since it's a
remote destination cannot be fast, Ethernet cannot be a local interface, it has to be an IP address.
So 12 dot one.
To see your tunnel up in you paying the other end point of the tunnel.
Too quick.
How does this work?
It's as simple as this.
From one side, when you configure interface Channel zero, what you're actually doing is you're creating
a public header.
The public header that you are creating will be the source which you mentioned.
The source was 12.1.
The destination that you mentioned was what, 23.3.
And on top of this will be a g r e header.
What is this header attached?
Of what?
We're typing.
Check your routing tables.
If you check your routing table.
Do you see this?
What does this mean?
When you're routing table, you see an interface.
What does that mean?
That means any traffic, anything that is going towards 151 .15.0 will leave from the interface fast
Ethernet zero zero.
Any traffic that is going towards ten 110, although it is a loopback.
If it was an interface, it would mean that it is leaving from loopback zero.
Similarly, any traffic going to the network of 192 168 1.0.
So when I ping 192 168 1.2 where am I trying to go?
I'm trying to go to this network.
It's going to leave from tunnel zero is tunnel zero of physical interface.
It's not a physical interface.
So when he sees tunnel zero, he attaches to this tunnel zero.
So Interface tunnel zero to this tunnel zero is attached.
The source, the destination and the header.
Which source Destination 12 .12 20 3.3 and the header is attached.
We will move back to back.
So it's not different from a loopback.
It's not.
It's just that loopback.
When I ping loopback, he knows that it's directly connected to me.
So he just pings himself.
When he pings a loopback he pings himself when he sees a tunnel.
Zero.
Because loopback has no configuration, right?
Blue back has no source, no destination.
So he goes into the loopback, sees there's an IP and pings that IP here, when he sees tunnel zero,
he goes into the configuration of tunnel zero checks out.
What is the source?
What is the destination that I need to attach attaches that with the header because the tunnel type
by default is gray.
We can change it, but by default the type is gray, so attaches the source, attaches the destination,
attaches the gray header.
Now any traffic that is going to the destination network of 192 168 1.0 will have that header attached
on top of that.
So your actual packet will look like this.
The packet will be going from 192 168 .1. 1 to 192 168.1.2.
This will be your actual header when it's supposed to make the routing decision of which interface to
leave from.
He finds out that is tunnel zero.
When he sees that tunnel zero it attaches.
What?
And the source and destination, which is 12.1 to 23 dot.
The packet leaves reaches R2.
R2 makes the routing decision makes based on only the public source and public destination.
Although he sees inside, he doesn't go inside.
He doesn't need to.
R2 is the internet.
No, that is the whole problem.
That is the whole problem.
It's not encrypted.
It's open.
Right.
Although it doesn't need the ISP doesn't need that part.
It it does all its routing based on what public address it sees that the source is 12.1.
The destination is 23.3.
So it just forwards it to R3.
All three will receive it.
All three will see.
12.12 23.3.
What is R3 going to do?
Open this part of the packet.
The IP part hits.
What?
It's the jihadi compares the header that he received.
Source was 12.1.
Destination was 23.3.
Compares it to the configuration on whatever configuration is there on our three show run interface.
Channel 011 compares it sees the destination is 12.1, the source is 23.3.
So knows that it's meant for 192 168 1.3 network how also in its routing table it will have the same
information traffic coming to this network this tunnel so forwards it to 192 168 1.0.
It moves everything forwards it to 192 168 1.01.2.
Basically to be more specific and the packet reaches its corresponding interface, which is loopback,
which is actually virtual tunnel to virtual tunnel, but is the simplest form of making your private
tunnel.
Private networks communicate to each other the most simplest form, right?
There is no encryption, no authentication, nothing anyone can mess up, mess around with this data.
Anybody can.
Right now.
The question is what happens to the headers?
How much overhead do you add?
A header adds How much overhead?
24 bytes of data.
Drives for IP addresses.
It uses 16.
Then for its own header, it's eight bytes.
Just keep that in mind.
We'll need that later.
Check it out from R1.
I'll ping 151 .13.3.
A normal ping from public to public costs me 114 bytes from public to public.
But if I think 282 168.1.3 the same thing will cost me 138.
Why?
Because now I have an extra header on top of this 24 bytes of extra header.
I have ICMP here, then I have the actual source and destination.
When it reaches here, figures out my leaving interface is done zero as what?
On top of that adds the source and destination, which is 23.3 to 12.1.
And then the layer two stuff to reach the final destination.
What is the use of this one?
My private networks can communicate to each other.
How right now they are not.
Right now they're not right.
So what I'm going to do, if you understand, you understand completely how Gary works based on the
routing table.
Right.
He sees that anything going from this source, anything coming from 192 168 1.0 doesn't matter where
it's trying to go.
It is a normal side to side situation, private to private crypto maps using crypto maps.
Yes, but it was complicated.
Why?
Because everything had to be defined with ACLs.
The interesting traffic was to be defined with ACLs.
Right.
Here it's been defined via virtual interfaces.
Is also known as.
Yeah, no is something else.
You guys something else?
I'll explain what that is.
We are moving towards that direction.
Right?
So now is this clear?
Anything source if pink, for example.
8.8.8.8 to the source of.
To zero, right?
It's some random address, but since the source is tunnel zero.
You will see that this packet
is not.
The okay is the decision is based on the destination, right.
The decision in the routing table is based on what the destination where you're trying to go.
So basically right now, anything going to 102 168, 1.0 will go through the tunnel.
But tell me what happens now if I enable multicast on this interface, will it go through the tunnel
also?
Right now, if you do show IP interface Tunnel zero, you'll see that it's not part of any multicast
group.
It's not part of any multicast group.
What I'll do is I'll run router one and I'll use the command network.
192 168 1.0.2.
So what have I done?
Have enabled multicast address on which interface 192 and only on 192 168 1.0, which is what the tunnel
interface since it has multicast enabled, the traffic for your multicast is going to look like this
192 168 .1.0 or 1.1.
To be more specific, let's move this cable here.
1.1 going to 224 .0.0. ten.
If it was a physical interface, what would this mean if it was, for example, this interface?
It would mean hello packets will be sent on this interface.
The leaving interface will still be what?
Similarly for these multicast addresses, what is the leaving interface going to be?
Channel zero.
These hello packets are going to be sent to air through the tunnel.
Right?
Because the tunnel is part of the multicast group.
220 400 ten.
Today.
Sink it and see if you understand this.
My interface.
Channel zero is part of the multicast group to 20 400 ten.
What does that mean?
That means it can send and receive any packets which are based on these multicast addresses.
Since it's EGP every five seconds it will send out hello packets with the destination of 220 400 ten.
My question is, are these going to be tunneled or not?
Are these going to be done like this or not?
They will be because I wouldn't have spent enough energy to make a header like that.
Take.
Only that right now.
Only that.
170 2.1 68.
No.
Then that tunnel will not join.
Yes, because I use this address.
That is why the tunnel joined you saying if I had used a different address, would the tunnel have joined
the multicast multicast address or not?
It wouldn't have.
So how does the routing protocol work?
Whatever network command that you use, it goes to the running configuration routing.
Sorry, the routing table in the routing table uses that network address, finds out the interface with
respect to that address then enables IGP on that interface.
How a routing protocol works is if you want to look at the process, it will open your routing table,
show IP route in your routing table.
It will go to that network that you've advertised and then check this interface in the end, which is
tunnel zero, then go to tunnel zero and activate routing, basically make it join multicast group to
20 400 ton.
That's why in IPV six what they have done is they have reduced this step in IPV six.
You don't have a network command, you just go to the interface and enable the routing on that interface.
Just say one enable is done, OSPF one enabled is done.
So they have reduced this step of network command, then going in the routing table and doing all that.
Okay.
Is it clear on one side?
Right.
Let's have a look at the hello packets.
These are your hellos.
And this is not the yellow.
This is a loop blue.
1821681.1 going to 24 The outside there will always be the same 1.12 20 3.3 which will always make sure
that this packet reaches R3.
R3 will know how to open it because it has the same tunnel config.
It will know how to open this packet.
My job is to encapsulate it in a way so that it reaches the other side.
Okay.
Then here moving to R3, the outer one.
Network 192 168 1.0.1.
My neighbor is up, so IP neighbors neighbor is up.
Correct.
So I beat out.
I will not see anything in that out.
But what I will do now is I will advertise it.
I will advertise a loopback Zero is already there, so I'll go to router one.
I'll advertise ten 000.
But I want you to see is something else.
Swipe it out.
10.1.
Will it go through the tunnel?
If I send a ping to ten 111, will it go through the tunnel?
Why?
Because the next hop is.
What?
The next stop is 192, 168, 1.1.
And how is that that next hop reachable to me via tunnel one.
So if I send a packet to ten .1.1.1 with a source of ten .3.3.3 this will go through the tunnel because
the decision will be made made based on the next hop, which is 190 261.1 for me to reach 192 168 1.1
and extra header has to be added which is the header on top, so your ping will still be the same.
The ping will still be the same, but 138 same.
We will have the same header.
So 10.1 to 10.3.
We're actually communicating from loopback to and then you have your on top public addresses on top
of that.
Questions.
Any questions?
Until now.
In the packet.
You won't see it in the packet.
You won't see any tunnel lighting when you're pinging.
Now you don't even need those tunnel IPS because now your job is done.
Now your loopbacks are communicating to each other.
You will never need them.
You only created them to create a neighbor relationship.
Right So my my packet will now go from for example, if you're talking about R1, it will go from ten
one one 1 to 10 333.
The packet will be formed like this.
Right?
All you need to know is what is the next hop.
Next hop is 192 168 1.3.
If that is the next hop, what do I need?
I need the header.
Which header?
The header will always be the same.
The decision is should I have the header or not?
That's it.
Header will always be 12.1.
Yes.
What about the 150 address?
Wouldn't have been 150.
150 is the public address that you purchased from the internet.
Will require 153 and then 192.
No, no, no.
First it was.
This is 150.
That is the header that attaches, right?
The outside header is attached.
That's how it does the routing.
Little was.
Last time with the header.
I made it in the reverse direction.
I made it like this ten one.
That's how I usually make it.
But there was no space.
Ten .1.1.12 ten .3.3.3.
Right.
And then on top of that I dashed the header, which is going from 12.12 from here.
23.3 to 12 dot.
Going from 10.1 to 10.3.
So.
The outsider will always, always be the same because that's how the guy you have configured it like
that source is constant.
Destination is constant.
All you need to make sure is is it going through the tunnel or not?
If it's going through the tunnel, attach this header.
If it's not, then do not.
Said if you try to ping 151 .1.1, just ping.
151 .5.1 It will go straight.
Why?
Because the leaving interface will be F00 for this ping.
The decision is solely made based on what destination are you trying to reach?
Right.
It is good.
My loopbacks are communicating to each other everything is all right except for there is a small problem.
Now this is going to form your base from now on until dmvpn.
Think about it this way.
We've already started the process of the MVP.
This is just the basics, but we are moving towards that eventually.
Okay.
R1 What I'll do is I'll tell it ten, three, three, three.
The source of loopback.
Zero.
I can't look back to look back going through the tunnel, right.
The problem with this is it is open text.
So if you just follow TCP stream, you will see everything in there.
Well, it is capturing the data.
You just follow the TCP stream because it's open text.
Clear text.
It can see everything that you're sending your passwords, Whatever is your password, Cisco.
So dangerous.
Good.
Effective lets you communicate across the internet, but dangerous.
Yes, it's better than crypto maps in a way that it's dynamic.
When I say dynamic, what I mean to say is tomorrow if I have another site here ten .17. 11 all I need
to do is just add it to the routing protocol.
Everybody will receive it.
Crypto maps saw there was a problem if you had more sites.
Access lists got complicated from here to here, here to here.
Hairpinning.
So many different stuff here.
One extra site will not cost you anything.
Even if it's in the 1011 domain.
You don't have to do anything because it's already advertised in here.
You just need to put it there.
Everybody will receive it.
The only problem is what?
Its open text.
How do I protect it?
I'll use it.
Let's see how.
Let's go ahead and start the steps.
What is the first step?
Crypto.
It will always be the same.
Your policies.
You have to configure all the always your key.
You have to configure always transform set.
You have to configure all this.
So this will be from now until the end of VPN.
Yes, that part will have to do some different only that part authentication.
Pre-shared Hash MD5 Group two.
Step two crypto ice cap key is Cisco address address.
You will give the public address of why?
Because I am negotiations have to take place.
Ice cap is always from public to public.
Remember from this public to it will not go through the tunnel.
That's a control separate control plane traffic that is negotiated separately.
It will have a look at how that takes place.
151 .23.3.
Step three is what crypto IPsec.
Transform set.
ESG as ESG five step four access list is not there anymore.
Crypto map is not there anymore.
Now, it's much easier than that.
Much, much easier than that crypto.
IPsec.
We call it profile.
In the profile, I only call the Transform.
Create a profile.
And in that profile I only call what you can have multiple policies and programs in the profile.
You can have multiple ones.
You can only have one transform set.
And what was this profiling like?
I can have multiple policies.
The first thing.
When did we do that reading?
You can have multiple policies.
With what?
For the first one, you can have different policies with different people, with different.
That is this one.
So it's going to have different with different you can have ten, 20, 30, 40, 50, ten will go here,
20, 30 will be here, 40, 50 will be somewhere else.
So that's you configure different policies here.
That's not the profile.
Profile you apply for, check this out.
You go to your tunnel zero.
You say tunnel tunnel protection with IPsec profile and you call it I.
What you're actually saying is the simplest of terms.
What you're saying is you're giving the tunnel.
You're telling him, okay, you are there, I know you're there, but I need to protect you using ESP,
also esp, I've already configured.
Right.
So in the profile I'm calling the transform the.
The transform set is calling ESP, but for the ESP to work first negotiation should happen.
So the whole process will happen.
Right?
And the negotiations will happen based on which source and which IP based on the tunnel source internal
IP.
So your whole ICM will be negotiation negotiated based on your tunnel source tunnel destination.
So you have a separate UDP going out based on your tunnel source as public headers UDP will be negotiated.
Once that is negotiated, everything going through the tunnel will be protected using ESP.
Let's check this.
Let's go to r one again.
Self-protection camp is on.
Check this out.
This is what I was talking about.
The tunnel will go down.
Your neighbor relationship will go down.
Why?
Because one side is encrypting.
Now he's trying to create that.
So.
Happened.
Weishaupt.
The site is trying to create a campus show crypto as the other side is not responding.
So you will not send out any packets.
Now everything is buffered and stopped because Basecamp is not getting negotiated.
If you go here.
It might be.
How the second package is going to look like.
Can you tell me?
As a compact, How is it going to look like?
So this will be 151 .15.1 destination will be 151 .13.3 right inside there.
UDP 500, UDP 500 and whatever.
So something is up with Wireshark.
But anyways.
Let's first try on the other interface.
Maybe this interface has a problem.
As you can keep on trying and trying and trying.
Why?
Because.
Hello.
Every five seconds will keep on going out for that.
Hello.
He would require to do it, so I will keep on trying.
It's connection.
That's a good thing about your interface tunnels.
Since you're running routing on it, you will see.
Hello.
Packets will always keep on going there, so make sure that the tunnel doesn't go down.
But why are we meeting the.
It's supposed to be eyes.
Cameras is supposed to be in 15 seconds.
Here is from three.
Check this out.
Not from one, two, three.
So is the other that this idea will never leave until the negotiations take place now?
The tunnel is protected.
Means even no packet will go out of this traffic if it's not protected.
For the protection he would require ESP or esp, he would require a scam to be negotiated.
Okay.
What do I need to do on the other side?
Check this out.
Everything will be the same.
Except for.
As see Kam Key.
Cisco should be sent to 12.111.
Yes.
Thank you.
Always make that mistake.
So here, this is going to be tunnel one.
Tunnel protection.
None.
Check this out.
Stop this.
Collections.
Jurassic Ham complete exchange took place from one to another.
You're all nine packets and then ESP.
Then I want to ping again now and I want to see if it's possible.
It is possible.
But check out the size of the pink.
How much is it?
How much was an original pink?
114.
Gary added 24 bytes.
It became 138 on top of that.
How much did you add again?
52 bytes of ESP for each header.
For protection.
52 bytes of ESP.
You see how much that is.
But the good thing is everything that you do now.
You don't need ssh you don't need for any kind of communication anymore because it's going through DSP.
Going through his.
How is your header looking like?
Let's have a look at the header.
The traffic is trying to go from ten 111 going to ten.
Figures out the living interface.
What is the living interface?
Channel zero.
Attaches What?
The retract was in.
Going from 12.1 to what attaches on top of that one.
ESPN.
Does it have an outside hitter?
Also, it should have an outside hitter.
Why?
Because everything here will be.
Everything will be hidden.
So the Internet will not know how to communicate, how to route the packet.
So for that he would also have 12.1 to 23.3.
Where does he get this from?
From the interface.
From the interface again.
So the same header is repeated two times inside here.
The.
No, I have not set any set pair command.
Remember, there is no set pair.
The key is not for the header.
When you see the set key, that is not for the header.
That is for the fifth packet in the fifth packet.
He locally sees he locally sees 23.3 which key to send.
He does not use that part.
So you can have multiple keys.
Right.
He will see based on which header here he see.
Okay.
I'm going to 23.3.
Which key should I send?
You know, he doesn't have a set player, doesn't have a set player.
He takes it from the tunnel, zero tunnel source, tunnel destination.
He'll add on top of this again, that's why the added headers, that's where the added is.
Right?
Good.
It's fine.
It's very, very, very good.
Why?
Because now you have routing protocols plus IPsec.
Earlier you had IPsec using crypto maps but no routing protocols.
Then you had routing protocols, but no IPsec.
Now you combine them together.
But what how are you paying for it on header sizes?
You're paying for both technologies together based on header your data.
Your header, which was supposed to be a normal ping of 114, is now 190, which is a lot more than
before.
Okay.
Any questions?
No, we used to.
Now we have found a better alternative.
Out of this better alternative.
What we'll do is.
Do you see a redundancy in here somewhere?
Do you see a redundancy in the header somewhere?
This header is repeated, isn't it?
Is there any point of this header being repeated?
Will it help us?
Will it help?
Anybody know this extra header is not going to help anybody.
It's just there when he opens it.
When the guy comes in and opens it, he sees ESP, opens it, it gets the outside header again, It
needs to open it without any use of it.
We'll do the same thing again.
How do I make sure this doesn't happen?
This is known as.
Transport mode.
Dunham.
By default, the mode of a tunnel is what?
Tunnel mode.
We call it tunnel mode.
Tunnel mode means he doesn't care.
Whatever he's using doesn't care.
It just tunnels and goes through transport mode checks.
Transport mode is intelligent.
It checks when he's copying the header outside.
It checks the header on the right and the header on the left.
If it sees the same header on both sides, it will remove the inside one.
Relieving you of 16 more bites.
Do you understand?
When it's attaching the outside public header, it checks is the inside header and the outside header
the same?
If it is the same, it will remove it and remove the inside header automatically.
The whole thing.
Correct.
Let's try let's see what's done is done on the IPsec crypt is done under the transform settings.
So I'll go to crypto IPsec Transform set D set esp three dash esp MD5.
In here.
I have only one option.
It's called mold.
Either tunnel or transport.
I'll change it to transport.
I'll go to the other side.
Use the same the try Pisek transform set t set PSP three as PSP and five more.
Okay, check it.
You'll see that it has not changed changed crypto crypto IPsec in your IPsec in your inbound and outbound.
It will show you what settings are in use.
Right now.
It's what channel?
Both are internal, inbound and outbound.
Both essays are in the tunnel mode.
How do you fix this?
I need to clear it because tunnel and transfer mode are negotiated in the beginning of the exchange.
Clear Crypto is a scam.
Yeah.
And that was necessary.
It will not be.
As income needs to be refreshed because once the negotiations take place, as sessions see also you
can session will clear the whole thing,
clear crypto sessions.
Now the mode is what transport inbound outbound from here also.
The more it is transport.
Good enough.
Mixed as in.
No, no.
This negotiated Bodin's negotiated.
What I want you to check is if I bring three, three, three.
The source of ten.
One, one one.
170 the size of the packet, confirming that the 16 bytes have been removed from the IP address.
Okay.
134 is the hello package.
Hello, Package.
Let.
Have reduced the size of my score over IPsec.
The whole process is called over IPsec.
I've reduced the size of my over IPsec by 16 bytes, but if you have a look at the header now, there
is still a little bit of gray in here.
I really need it now.
So I'm just using ESP anyways.
Do I need gray?
I don't need those eight bytes anymore because when I open it I will see esp will open it and find what
the actual header.
This was not possible for a long, long time.
A lot of for a long time this was not possible.
But then IPsec was developed.
IPsec was developed to work exactly like GUI without GUI.
Yeah.
If you don't have the now, you take the tunnel.
That's what I'm saying.
To do that ESP came forward.
ESP came forward, did exactly the same thing that used to do exact same things as used to do using
the ESP header.
This type of tunnel was not called a tunnel.
It was called a static virtual tunnel interface and SVT.
The one where I'll remove Zarina.
How?
I'll basically configure the tunnel and tell him, Listen, this tunnel is not a tunnel anymore.
This tunnel is a pure IPsec tunnel.
When I say a pure IPsec tunnel, what I'm saying is there is no gray in here.
It's a public address, then ESP, then your actual address, the actual source and destination.
Sorry.
The before it was there was a header on top of this one, a normal header.
Then there was a public address here.
When I did transport mode, it removed the public address.
Now I'm going to configure this whole tunnel as a pure IPsec tunnel.
So what I'll do is I'll go to Interface Tunnel zero.
I'll say tunnel mode.
IPsec IPV four tunnel mode is not by default.
The mode is what?
It's a tunnel, so it attaches the header.
But if I change the mode completely now it is not going to attach the header.
I'll say tunnel mode IPsec ipv from one end from the other side also.
From the one tunnel mode IPsec IP.
Now let's ping again.
Check out the size of the pinks.
166.
Eight more bites have been reduced.
Eight more bytes have been reduced.
The header eight bytes.
Then 16 of the IP header in total 24.
Right.
So if you think about it now.
Now, your traffic has no on top of this.
Now, it's not is not there anymore.
It's not.
If you didn't use, like you said, what would be the use of if I didn't use IPsec?
If you're not protecting the tunnels with IPv6, then that is the question.
That is what I wanted to show you.
If I don't use tunnel protection now, will this tunnel work?
It will not work because we needed a header.
The normal GRE when you communicate from ten .1.1.12.3.3.3.
The header that is added is which one which is standalone does not require anything.
So it bites standalone.
But now it's a pure IPsec tunnel.
So what am I using here?
ESP but for this esp what do I require?
Tunnel protection.
That is the only one thing that you need to configure that is different from here.
You need to protect the tunnel using tunnel protection so the source and destination will obviously
will be the same, which is 12.1 to 23.3.
But since you require ESP, since you definitely require ESP, you would also require what protection?
If you remove that tunnel protection, your tunnel will go down.
That was not the case with Gary, even without protection.
Used to work, right?
We saw OpenText.
We could see Telnet messages and everything used to work even without the protection.
Protection just added extra security if you're using a pure IPsec tunnel.
What are you saying?
You're saying I'm protecting it using IPsec.
Right.
And for IPsec, which header do you need?
ESP h.
H will work.
H will work, but it will only protect give you authentication.
Let's try.
I will go to this site as a crypto IPsec.
Before that, I want to show you this show.
Crypto IPsec.
The mode I change to what transport it has gone back to even though in the running configuration.
Even though the running configuration you'll see the mode is still transport.
You can configure the mode as transport.
It will try to do what the transport mode tells it to do, but if it cannot do that, it will move back
to the tunnel mode.
Why did it happen right now?
Because I said there is no gree anymore.
This packet is not right.
The header on the inside and the outside.
Are they the same now?
DSP is attached here on the outside of ESP is what, 12.1 and 23 dot the inside and the outside, are
they the same?
Same address.
Will you be able to remove anything from here?
Earlier it was different.
Earlier, he was adding himself on top of jihad.
So the public and public was same on both sides.
So he removed the inside one.
Now he's just attaching himself to the private network inside and outside hitter, a completely different.
He's not able to remove anything.
He's not able to remove any.
He will go back to the tunnel.
Even if you configure it to have transport mode, it will still not work on transport mode.
It will still go back to tunnel.
You have to understand that.
That's how it works.
That's how you can configure a transport.
You can configure a router in transport mode, but if it cannot make that move, if it cannot remove
the header, it will still stay in tunnel.
Yes, the standard mode is used in a lamp and it's used usually in private entrances.
The and then this tunnel mode is.
And what does that actually mean?
Well, it actually I'll explain that in get VPN.
When you're doing get VPN, we're actually doing private to private communication.
So a private cloud, that's where it's mostly used.
That's why they say that transport mode is for private to private communication.
Right.
Private land.
I'll explain that.
The right.
Now, even if you're using, you can use transport mode.
But the thing is, we would not use anymore.
Why?
Because now you have to.
The FBI requires all that requires see what a times requires is this if you only have a pure tunnel,
it's like this interface Tunnel zero IP address 1921681.1 The Mask.
Dinosaurs is 150 .1.1.1 tunnel destination is 150 .1.23.3.
That's it.
That's all a tunnel requires.
What does an IPsec require?
Same thing.
But tunnel mode IPsec for census IPsec Tunnel.
Also require tunnel protection.
IPsec Profile.
High.
Here.
I don't need a header by default.
Header is available to the first tunnel.
The second tunnel does require a header because it's not.
Gary has been removed.
So if I remove protection the tunnel will not come up.
You can give it a try.
But before that let's change the to change this to H.
Modena from the other side also.
Yeah.
Tonight.
I don't think it'll work.
Let's try.
It requires ESPN.
It is down.
It does require ESPN.
That is attached as required.
It is very old.
I don't think anyone would even think about using it because ESP gives you the same.
So there you go.
ESP gives you the same.
What?
The same features, the same MD5, the same.
Sha is given as the ESP header.
Let's see.
Yeah.
And then that it's open.
It works.
Same same process.
So the destination.
But it's just like a header, right?
Instead of now you have to open.
Not encrypted.
So it's just like the same old which you had before.
If you think NC three three with a source of ten 111.
150.
Jerry was 138.
This is 158.
But this gives you integrity.
Only integrity if you would.
If you would.
But most of the times what you would do is use ESP for only integrity if you want.
You can use it to.
Yeah, he is.
First encryption, then hashing.
So you'll see.
Hashing happening.
You'll see the header first, which will be encrypted.
On top of that, you'll see it and then you'll see the rest of the stuff like.
The same IPsec ESP for CSP three days and a MD5.
So instead of using esp, esp three days and esp MD5, we will use esp one and for the other one.
So esp encryption should be done using esp authentication should be done using age.
Right.
But again, production will always use.
Most of the time.
Right.
Any questions?
If I remove the protection, the tunnel will not come up.
No tunnel protection.
IPsec profile.
I Whatever.
No matter what you do, the tunnel will go off.
As the camp is off, everything is down.
The tunnel will not come up.
Show IP interface.
It will be down.
It will stay down.
There is no.
There is no way it will come up.
Why?
Because now it will.
Since it's an IPsec tunnel, it would require that ESP to work.
It would need that header for that header it needs.
Can you turn it off already?
It will not work without it.
If it was again, I'm repeating this again.
If it was, it does not require anything like that.
But since it's a protected tunnel, it does require all of these details.
Okay.
Yes.
With IPsec.
We always use that.
No, no, no.
Now with I think 12 dot 212 dot two.
Yeah.
Show IP Interface Brief.
Should be up.
Okay, we got down because it did not have the header to attach.
That's virtual templates not done in virtual templates.
That's easy.
Okay.
Any other questions?
Let me go back about it will go back to.
He doesn't have that bias when you're when you're going through the mode of IPsec IPv4.
Right.
You're considering that is not there anymore.
So 24 bytes of are not there anymore.
So earlier when it used to attach, when you change the mode of the tunnel, what you're basically doing
is earlier the mode was right.
So when it then 111 going to ten 333.
When it checks the leaving interface, it sees tunnel zero.
What is the mode of that tunnel?
So based on that, he would attach a header.
But now what is the mode?
IPsec.
IPv4.
The tunnel is not.
Now it's IPsec.
Now he's not going to attack here.
Now he's going to attach what straight up ESP then protect it.
The Tamil board has changed.
Do you understand?
Now, when he goes to the tunnel and he sees the leaving interface based on that, he makes the decision
of should I, which which header should I ask for here?
You don't need that.
Even if you put it, it will not take it.
It will go to the.
Any questions?
Said.
Obesity.
If you want to create a tunnel with the device which is inside the network, not with the edge.
If a device is not on the edge, if it's inside of the network somewhere, you want to create a tunnel
with that.
But can you create it with the private address from here?
You don't have any ability to the private address of that.
So how will you create the tunnel?
You will add that and give that device a public address.
So then now your device can communicate to that.
If you want.
If you want to create from me, I'm online.
Right?
I have an edge.
I have connected a direct connection from the Internet to my router.
I'm using that address.
It's well and good.
I want to create a tunnel with a device right here inside Networkers.
Right.
So there's one router right here.
I want to create it with that.
But I know that this whole network, there's only one public pipe which is on the edge.
How do I represent this?
How do I create that with this device?
I'll give it an address on the outside, on the public address so nothing will happen for this device.
And then whoever is sitting at home can communicate to this device through that public address.
What?
Yeah.
Uh, to the other side.
So.
One.
No.
I cannot hear you properly.
Yeah, it is what it is not.
As one vote is not required.
Yeah.
And what is the edge?
What do you call what do you guys call the edge?
Have you done SARS?
What is the edge?
End user.
End of the end of what?
What do you mean by end of the network?
Access to Edge.
When I talk about Edge, I talk about this router, the Edge router, which is connected to the internet,
but devices are access that are access devices towards the end.
Well, that's if you talk about an Http language edge is the edge devices, the last devices towards
the end of the Http, right?
So you configure them as access port, right?
But these are perimeter routers, right?
Call them edge routers also.
What do they do?
They're connected to the Internet, so their job is to natting and everything.
Right?
Let's say this is the address that it has Now.
You have devices inside.
Among those devices, you have a router here, right?
You're also connected to another edge from a different company.
You want to create a tunnel between this guy and this guy?
How will you create it?
You want to create a tunnel like that?
How do you create?
What is the first basic thing that you need to do before you create the basic connectivity?
Layer three Connectivity.
So this guy should be able to ping, but will he be able to ping because this is going to have a private
address?
This is done.
Once.
It will have a private address.
Will I be able to send a packet from here to here?
Unless I do.
What?
Unless this network, this router is represented on this address as a Nat database.
So let's say 151 dot 20 dot one.
When this router will send a packet to 151 .1.1 his packet will go to.
After that everything is the same.
You just need to make sure that your first step is complete, which is making sure that connectivity
between the two routers is.
You know that?
Yes.
Yeah.
This is going back to our static analysis.
This is static math.
That part will be possible.
Also will be possible.
But for Pat, what do you need to do?
You need to pat this to the address of 151 point 20.10 at port number 500.
And.
For these guys 500 and static.
So that takes place.
Once your camp takes place, you will also go through.
Okay.
The camp will take place, but there will be a problem.
How about you speak?
Is we will go from 151 .26. x going to.
There'll be no translation.
Oh, yeah, it will.
It will take this.
It will work because we will have UDP 4500 on the outside that will also be patterned on to 4500.
So it will take place with that.
So right here will be like how ESP on top of that will be 45 to 45.
The packet will come to 45 here which will be forwarded to 45 inside.
So we'll go to the actual.
That's what energy is, right?
And yet I think the problem with when you say it's not working, we'll have to figure that out.
We'll have to see.
You said that it's not working right.
With when you do when you it didn't work.
We'll have to see
what the age brackets
shouldn't be the case shouldn't be the case.
We'll check.
We'll check after the break.
Let's take a break.
This is done.
Then we are moving.
The next topic is, if you understand this, the next topic will be.