User Tools
cisco:books:ccnp_300-730:ch3:001
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| cisco:books:ccnp_300-730:ch3:001 [2025/08/31 17:07] – Name | cisco:books:ccnp_300-730:ch3:001 [2025/08/31 17:54] (current) – Name | ||
|---|---|---|---|
| Line 447: | Line 447: | ||
| r2-spoke# | r2-spoke# | ||
| * The spoke is not generating the same style output as the hub. Lets verify the crypto configuration on the interface first. | * The spoke is not generating the same style output as the hub. Lets verify the crypto configuration on the interface first. | ||
| - | < | + | < |
| Building configuration... | Building configuration... | ||
| - | Current configuration : 98 bytes | + | Current configuration : 138 bytes |
| ! | ! | ||
| - | interface | + | interface |
| ip address 12.1.1.2 255.255.255.0 | ip address 12.1.1.2 255.255.255.0 | ||
| - | duplex | + | negotiation |
| + | no mop enabled | ||
| + | no mop sysid | ||
| | | ||
| end</ | end</ | ||
| * The interface configuration looks correct. Next is to verify the crypto configuration and double-check the mapping. | * The interface configuration looks correct. Next is to verify the crypto configuration and double-check the mapping. | ||
| < | < | ||
| + | ! Ignore the PKI cert info at the top. | ||
| crypto ikev2 proposal rook-proposal | crypto ikev2 proposal rook-proposal | ||
| | | ||
| Line 488: | Line 491: | ||
| | | ||
| * At first glance, it seems the ACL is correct, but the permit line is subtly backwards. Flip the hosts around and test again. | * At first glance, it seems the ACL is correct, but the permit line is subtly backwards. Flip the hosts around and test again. | ||
| - | < | + | * The next step is for demonstration purposes to show what happens when the access-list in-use is attempted to be edited. |
| - | + | < | |
| - | + | Enter configuration commands, one per line. End with CNTL/Z. | |
| - | + | r2-spoke(config)# | |
| - | + | r2-spoke(config-ext-nacl)# | |
| - | + | %ACL castle-acl can not be modified/ | |
| - | + | %Please first remove the ACL from crypto map or remove the crypto map from the interface</ | |
| - | + | * This is the correct procedure to migrate the ACL entry to the end. | |
| + | < | ||
| + | Enter configuration commands, one per line. End with CNTL/Z. | ||
| + | r2-spoke(config)# | ||
| + | r2-spoke(config-if)# | ||
| + | r2-spoke(config-if)# | ||
| + | *Aug 31 17: | ||
| + | r2-spoke(config-if)# | ||
| + | *Aug 31 17: | ||
| + | r2-spoke(config-if)# | ||
| + | r2-spoke(config-ext-nacl)# | ||
| + | r2-spoke(config-ext-nacl)# | ||
| + | * Verify the ACL is correct. | ||
| + | < | ||
| + | ip access-list extended castle-acl | ||
| + | 10 permit ip host 12.1.1.2 host 12.1.1.1</ | ||
| + | * The ACL is now correct. Next, add the crypto map back on the interface. | ||
| + | < | ||
| + | r2-spoke(config-if)# | ||
| + | * Turn debugging off on the hub and spoke. | ||
| + | < | ||
| + | All possible debugging has been turned off</ | ||
| + | < | ||
| + | All possible debugging has been turned off</ | ||
| + | * Test with a ping again from either the hub or spoke. | ||
| + | < | ||
| + | Type escape sequence to abort. | ||
| + | Sending 5, 100-byte ICMP Echos to 12.1.1.2, timeout is 2 seconds: | ||
| + | !!!!! | ||
| + | Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms</ | ||
| + | < | ||
| + | Type escape sequence to abort. | ||
| + | Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds: | ||
| + | !!!!! | ||
| + | Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms</ | ||
| + | * Success. Verify the crypto sa. | ||
| + | < | ||
| + | IPv4 Crypto IKEv2 SA | ||
| + | Tunnel-id Local | ||
| + | 1 | ||
| + | Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK | ||
| + | Life/Active Time: 86400/276 sec</ | ||
| + | < | ||
| + | IPv4 Crypto IKEv2 SA | ||
| - | * Packet Capture on r1-hub e0/0 interface. | + | Tunnel-id Local |
| - | {{ : | + | 1 |
| + | Encr: AES-CBC, keysize: 256, PRF: SHA512, Hash: SHA512, DH Grp:14, Auth sign: PSK, Auth verify: PSK | ||
| + | Life/Active Time: 86400/313 sec</ | ||
| + | * One last check with Wireshark while pinging. | ||
| + | {{ : | ||
cisco/books/ccnp_300-730/ch3/001.1756660034.txt.gz · Last modified: by Name
Page Tools
