User Tools
cisco:books:ccnp_300-730:ch3:001
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cisco:books:ccnp_300-730:ch3:001 [2025/08/31 15:18] – Name | cisco:books:ccnp_300-730:ch3:001 [2025/08/31 17:54] (current) – Name | ||
|---|---|---|---|
| Line 16: | Line 16: | ||
| < | < | ||
| conf t | conf t | ||
| + | no ip domain lookup | ||
| hostname r1-hub | hostname r1-hub | ||
| line con 0 | line con 0 | ||
| + | history size 256 | ||
| logg syn | logg syn | ||
| exec-timeout 0 0 | exec-timeout 0 0 | ||
| Line 26: | Line 28: | ||
| ip address 1.1.1.1 255.255.255.255 | ip address 1.1.1.1 255.255.255.255 | ||
| ! | ! | ||
| - | interface | + | interface |
| | | ||
| ip address 12.1.1.1 255.255.255.0 | ip address 12.1.1.1 255.255.255.0 | ||
| Line 63: | Line 65: | ||
| match address castle-acl | match address castle-acl | ||
| ! | ! | ||
| - | interface | + | interface |
| | | ||
| no shutdown | no shutdown | ||
| Line 73: | Line 75: | ||
| < | < | ||
| conf t | conf t | ||
| + | no ip domain lookup | ||
| hostname r2-spoke | hostname r2-spoke | ||
| line con 0 | line con 0 | ||
| + | history size 256 | ||
| logg syn | logg syn | ||
| exec-timeout 0 0 | exec-timeout 0 0 | ||
| Line 83: | Line 87: | ||
| ip address 2.2.2.2 255.255.255.255 | ip address 2.2.2.2 255.255.255.255 | ||
| ! | ! | ||
| - | interface | + | interface |
| | | ||
| ip address 12.1.1.2 255.255.255.0 | ip address 12.1.1.2 255.255.255.0 | ||
| Line 120: | Line 124: | ||
| match address castle-acl | match address castle-acl | ||
| ! | ! | ||
| - | interface | + | interface |
| | | ||
| no shutdown | no shutdown | ||
| Line 140: | Line 144: | ||
| < | < | ||
| 12.1.1.2/32 | 12.1.1.2/32 | ||
| - | attached to Ethernet0/0</ | + | attached to GigabitEthernet1</ |
| * The hub's CEF table has the correct entry. This tells us that layers 1-3 are correct. If you want, you can view the ARP table to confirm. | * The hub's CEF table has the correct entry. This tells us that layers 1-3 are correct. If you want, you can view the ARP table to confirm. | ||
| < | < | ||
| Protocol | Protocol | ||
| - | Internet | + | Internet |
| * A packet capture on the hub's interface (or spoke) will reveal that their are no ESP packets being exchanged. | * A packet capture on the hub's interface (or spoke) will reveal that their are no ESP packets being exchanged. | ||
| * The following packet capture is taken when trying to ping the spoke from the hub. | * The following packet capture is taken when trying to ping the spoke from the hub. | ||
| Line 434: | Line 438: | ||
| *Aug 31 15: | *Aug 31 15: | ||
| *Aug 31 15: | *Aug 31 15: | ||
| + | * Scroll the top where the IKEv2 is retrieving its configuration. | ||
| + | < | ||
| + | *Aug 31 15: | ||
| + | {Output omitted.}</ | ||
| + | * Notice how the output keeps deleting the SA, then rebuilding the SA to send again. Turn on debugging on the spoke and try to ping the hub. | ||
| + | < | ||
| + | IKEv2 default debugging is on | ||
| + | r2-spoke# | ||
| + | * The spoke is not generating the same style output as the hub. Lets verify the crypto configuration on the interface first. | ||
| + | < | ||
| + | Building configuration... | ||
| + | Current configuration : 138 bytes | ||
| + | ! | ||
| + | interface GigabitEthernet1 | ||
| + | ip address 12.1.1.2 255.255.255.0 | ||
| + | | ||
| + | no mop enabled | ||
| + | no mop sysid | ||
| + | | ||
| + | end</ | ||
| + | * The interface configuration looks correct. Next is to verify the crypto configuration and double-check the mapping. | ||
| + | < | ||
| + | ! Ignore the PKI cert info at the top. | ||
| + | crypto ikev2 proposal rook-proposal | ||
| + | | ||
| + | | ||
| + | group 14 | ||
| + | crypto ikev2 policy svpn-policy | ||
| + | | ||
| + | crypto ikev2 keyring lion-key | ||
| + | peer peer-remote | ||
| + | address 12.1.1.1 | ||
| + | pre-shared-key cisco | ||
| + | ! | ||
| + | crypto ikev2 profile side-profile | ||
| + | match identity remote address 12.1.1.1 255.255.255.255 | ||
| + | | ||
| + | | ||
| + | | ||
| + | crypto ipsec transform-set tset esp-aes esp-sha512-hmac | ||
| + | mode tunnel | ||
| + | crypto map svpn-map 10 ipsec-isakmp | ||
| + | set peer 12.1.1.1 | ||
| + | set transform-set tset | ||
| + | set pfs group14 | ||
| + | set ikev2-profile side-profile | ||
| + | match address castle-acl</ | ||
| + | * The **crypto map svpn-map** does match. Reading through Chapter 3, as referenced above, concludes that the crypto configuration is correct. Lets look at the access-list the crypto map is referencing. | ||
| + | < | ||
| + | ip access-list extended castle-acl | ||
| + | | ||
| + | * At first glance, it seems the ACL is correct, but the permit line is subtly backwards. Flip the hosts around and test again. | ||
| + | * The next step is for demonstration purposes to show what happens when the access-list in-use is attempted to be edited. | ||
| + | < | ||
| + | Enter configuration commands, one per line. End with CNTL/Z. | ||
| + | r2-spoke(config)# | ||
| + | r2-spoke(config-ext-nacl)# | ||
| + | %ACL castle-acl can not be modified/ | ||
| + | %Please first remove the ACL from crypto map or remove the crypto map from the interface</ | ||
| + | * This is the correct procedure to migrate the ACL entry to the end. | ||
| + | < | ||
| + | Enter configuration commands, one per line. End with CNTL/Z. | ||
| + | r2-spoke(config)# | ||
| + | r2-spoke(config-if)# | ||
| + | r2-spoke(config-if)# | ||
| + | *Aug 31 17: | ||
| + | r2-spoke(config-if)# | ||
| + | *Aug 31 17: | ||
| + | r2-spoke(config-if)# | ||
| + | r2-spoke(config-ext-nacl)# | ||
| + | r2-spoke(config-ext-nacl)# | ||
| + | * Verify the ACL is correct. | ||
| + | < | ||
| + | ip access-list extended castle-acl | ||
| + | 10 permit ip host 12.1.1.2 host 12.1.1.1</ | ||
| + | * The ACL is now correct. Next, add the crypto map back on the interface. | ||
| + | < | ||
| + | r2-spoke(config-if)# | ||
| + | * Turn debugging off on the hub and spoke. | ||
| + | < | ||
| + | All possible debugging has been turned off</ | ||
| + | < | ||
| + | All possible debugging has been turned off</ | ||
| + | * Test with a ping again from either the hub or spoke. | ||
| + | < | ||
| + | Type escape sequence to abort. | ||
| + | Sending 5, 100-byte ICMP Echos to 12.1.1.2, timeout is 2 seconds: | ||
| + | !!!!! | ||
| + | Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms</ | ||
| + | < | ||
| + | Type escape sequence to abort. | ||
| + | Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds: | ||
| + | !!!!! | ||
| + | Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms</ | ||
| + | * Success. Verify the crypto sa. | ||
| + | < | ||
| + | IPv4 Crypto IKEv2 SA | ||
| + | Tunnel-id Local | ||
| + | 1 | ||
| + | Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK | ||
| + | Life/Active Time: 86400/276 sec</ | ||
| + | < | ||
| + | IPv4 Crypto IKEv2 SA | ||
| - | + | Tunnel-id Local | |
| - | + | 1 | |
| - | + | Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK | |
| - | + | | |
| - | * Packet Capture on r1-hub e0/0 interface. | + | * One last check with Wireshark while pinging. |
| - | {{ : | + | {{ : |
cisco/books/ccnp_300-730/ch3/001.1756653529.txt.gz · Last modified: by Name
Page Tools
