Back to Dashboard
Module 35
VPN Technologies
← Previous Module
Next Module →
# 📘 CCNA 200-301 - Video 35: VPN Technologies ## Deep Study Notes --- ## 📌 Learning Objectives By the end of this video, you should understand: - What VPNs are and why they're used - Site-to-Site vs. Remote Access VPNs - IPsec protocols and components - IPsec tunnel vs. transport mode - DMVPN (Dynamic Multipoint VPN) concepts - VPN configuration fundamentals - VPN troubleshooting --- ## 🧠 Core Concepts ### 1. What is a VPN? **Definition:** A Virtual Private Network (VPN) creates a secure, encrypted connection over a public network (like the internet), allowing remote sites or users to communicate securely as if they were on a private network. **Analogy:** Think of a VPN like a private, armored car traveling through a busy city. The armored car (VPN tunnel) protects its contents (data) from thieves and prying eyes, even though it's traveling on public roads (the internet). ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ VPN CONCEPT │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ WITHOUT VPN: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Site A ──────────────────────────── Site B │ │ │ │ (Data travels in clear text) │ │ │ │ │ │ │ │ [Internet] ──────── ◀─── ISP can see data │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ WITH VPN (IPsec Tunnel): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Site A ════════════════════════════════════ Site B │ │ │ │ (Encrypted VPN Tunnel) │ │ │ │ │ │ │ │ [Internet] ──────── ✗─── ISP cannot read data (encrypted) │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 2. VPN Types | Type | Description | Use Case | Example | |------|-------------|----------|---------| | **Site-to-Site VPN** | Connects entire networks to each other | Branch to HQ, partner connections | IPsec tunnel between routers | | **Remote Access VPN** | Connects individual users to corporate network | Employees working from home | AnyConnect, IPsec client | | **Client-Based VPN** | Software installed on user device | End-user connectivity | Cisco AnyConnect | | **Clientless VPN** | Browser-based access | Limited application access | SSL VPN portal | ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ VPN TYPES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ SITE-TO-SITE VPN: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ ┌─────────┐ ┌─────────┐ │ │ │ │ │ Branch │════════════════════│ HQ │ │ │ │ │ │ Office │ IPsec Tunnel │ Office │ │ │ │ │ └─────────┘ └─────────┘ │ │ │ │ │ │ │ │ Entire network at branch can access entire network at HQ │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ REMOTE ACCESS VPN: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ ┌─────────┐ │ │ │ │ │ Laptop │ │ │ │ │ │(Home) │ │ │ │ │ └────┬────┘ │ │ │ │ │ │ │ │ │ │ AnyConnect/IPsec │ │ │ │ ▼ │ │ │ │ ┌─────────────────────────────────────────────────────────┐ │ │ │ │ │ Internet │ │ │ │ │ └─────────────────────────────────────────────────────────┘ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ▼ │ │ │ │ ┌─────────┐ │ │ │ │ │ HQ │ │ │ │ │ │ Office │ │ │ │ │ └─────────┘ │ │ │ │ │ │ │ │ Individual users connect securely to corporate network │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 3. IPsec Components **IPsec (IP Security):** A suite of protocols that provides security for IP communications through authentication and encryption. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ IPSEC COMPONENTS │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ IPSEC SUITE │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ ┌────────────────────────┼────────────────────────┐ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │ │ │ IKE/ISAKMP │ │ ESP │ │ AH │ │ │ │ (Phase 1) │ │ (Encryption) │ │(Authentication)│ │ │ └───────────────┘ └───────────────┘ └───────────────┘ │ │ │ │ │ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │ │ │ • Key Exchange│ │ • Data │ │ • Integrity │ │ │ │ • Peer Auth │ │ Encryption │ │ • Auth only │ │ │ │ • SA Creation │ │ • Auth │ │ (no encryption)│ │ │ │ • DH Exchange │ │ • Anti-Replay │ │ │ │ │ └───────────────┘ └───────────────┘ └───────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **IPsec Protocols:** | Protocol | IP Number | Purpose | |----------|-----------|---------| | **AH (Authentication Header)** | 51 | Data integrity and authentication (no encryption) | | **ESP (Encapsulating Security Payload)** | 50 | Encryption, authentication, anti-replay | | **IKE (Internet Key Exchange)** | UDP 500 | Key exchange, SA establishment | --- ### 4. IPsec Modes ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ IPSEC MODES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ TRANSPORT MODE: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Original IP Header │ TCP/UDP │ Payload │ │ │ │ │ │ │ │ After IPsec (Transport Mode): │ │ │ │ Original IP Header │ ESP/AH │ TCP/UDP │ Payload │ │ │ │ (Unencrypted) │ Header │ (Encrypted) │ │ │ │ │ │ │ │ Use Case: End-to-end encryption (host to host) │ │ │ │ IP header preserved (for routing) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ TUNNEL MODE (Most Common): │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Original IP Header │ TCP/UDP │ Payload │ │ │ │ │ │ │ │ After IPsec (Tunnel Mode): │ │ │ │ New IP Header │ ESP/AH │ Original IP Header │ Payload │ │ │ │ (Encrypted) │ Header │ (Encrypted) │ │ │ │ │ │ │ │ │ Use Case: Site-to-site VPN (gateway to gateway) │ │ │ │ Entire original packet encrypted │ │ │ │ New IP header for routing │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 5. IPsec Phase 1 (IKE Phase 1) **Purpose:** Establish a secure, authenticated channel (ISAKMP SA) for Phase 2 negotiation. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ IKE PHASE 1 - MAIN MODE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Router A Router B │ │ │ │ │ │ │ │ 1. IKE SA Proposal (Encryption, Hash, DH Group) │ │ │ ─────────────────────────────────────────────────────────────► │ │ │ │ │ │ 2. IKE SA Accepted │ │ │ ◄───────────────────────────────────────────────────────────── │ │ │ │ │ │ 3. Diffie-Hellman Key Exchange │ │ │ ─────────────────────────────────────────────────────────────► │ │ │ │ │ │ 4. Diffie-Hellman Key Exchange │ │ │ ◄───────────────────────────────────────────────────────────── │ │ │ │ │ │ 5. Identity Verification (Pre-shared key / Certificates) │ │ │ ─────────────────────────────────────────────────────────────► │ │ │ │ │ │ 6. Identity Verification │ │ │ ◄───────────────────────────────────────────────────────────── │ │ │ │ │ │ IKE SA Established (Phase 1 Complete) │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **IKE Phase 1 Parameters:** | Parameter | Options | Description | |-----------|---------|-------------| | **Encryption** | AES, 3DES, DES | Data encryption algorithm | | **Hash** | SHA, MD5 | Integrity/hashing algorithm | | **DH Group** | 1, 2, 5, 14, 19, 20, 21 | Diffie-Hellman key exchange group | | **Authentication** | Pre-shared key, RSA signatures | Peer authentication method | | **Lifetime** | 86400 seconds (default) | SA lifetime | --- ### 6. IPsec Phase 2 (IKE Phase 2) **Purpose:** Establish IPsec SA for actual data encryption. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ IKE PHASE 2 - QUICK MODE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ Router A Router B │ │ │ │ │ │ │ │ 1. IPsec SA Proposal (ESP/AH, Encryption, Lifetime) │ │ │ ─────────────────────────────────────────────────────────────► │ │ │ │ │ │ 2. IPsec SA Accepted │ │ │ ◄───────────────────────────────────────────────────────────── │ │ │ │ │ │ 3. IPsec SA Confirmation │ │ │ ─────────────────────────────────────────────────────────────► │ │ │ │ │ │ IPsec SA Established (Phase 2 Complete) │ │ │ │ │ │ Data Transmission │ │ │ ◄─────────────────────────────────────────────────────────────► │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **IPsec Phase 2 Parameters:** | Parameter | Options | Description | |-----------|---------|-------------| | **Protocol** | ESP, AH | Security protocol | | **Encryption** | AES, 3DES, DES | Data encryption (ESP) | | **Authentication** | SHA, MD5 | Data integrity | | **Mode** | Tunnel, Transport | Encapsulation mode | | **Lifetime** | 3600 seconds (default) | IPsec SA lifetime | --- ### 7. Site-to-Site IPsec VPN Configuration **Basic IPsec VPN Configuration:** ```cisco ! ========== ROUTER A ========== ! ! Phase 1: ISAKMP Policy crypto isakmp policy 10 encryption aes hash sha authentication pre-share group 2 lifetime 86400 ! crypto isakmp key VPNKEY address 203.0.113.2 ! ! Phase 2: IPsec Transform Set crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac mode tunnel ! ! Phase 2: Crypto Map crypto map VPN-MAP 10 ipsec-isakmp set peer 203.0.113.2 set transform-set VPN-TRANSFORM match address 110 ! ! ACL for interesting traffic access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 ! ! Apply crypto map to interface interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map VPN-MAP ! ! ========== ROUTER B ========== ! crypto isakmp policy 10 encryption aes hash sha authentication pre-share group 2 lifetime 86400 ! crypto isakmp key VPNKEY address 203.0.113.1 ! crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac mode tunnel ! crypto map VPN-MAP 10 ipsec-isakmp set peer 203.0.113.1 set transform-set VPN-TRANSFORM match address 110 ! access-list 110 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 ! interface GigabitEthernet0/0 ip address 203.0.113.2 255.255.255.0 crypto map VPN-MAP ``` --- ### 8. VPN Interesting Traffic **Definition:** Interesting traffic is traffic that triggers the VPN tunnel to be established. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ INTERESTING TRAFFIC │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ACL defines what traffic should be encrypted: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255│ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ Traffic Flow: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ PC (192.168.1.10) → Server (192.168.2.10) │ │ │ │ │ │ │ │ Router A sees packet: │ │ │ │ • Source: 192.168.1.10, Dest: 192.168.2.10 │ │ │ │ • Matches ACL 110 → Interesting! │ │ │ │ • Check if IPsec SA exists │ │ │ │ • If not, initiate IKE (Phase 1 and Phase 2) │ │ │ │ • Encrypt packet and send through tunnel │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ Traffic that does NOT match ACL: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Internet traffic (dest not in 192.168.2.0/24) │ │ │ │ • Goes out without encryption │ │ │ │ • Or may be blocked (depending on configuration) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ### 9. IPsec Verification Commands | Command | Purpose | |---------|---------| | `show crypto isakmp sa` | Display IKE Phase 1 SAs | | `show crypto ipsec sa` | Display IPsec Phase 2 SAs | | `show crypto map` | Display crypto map configuration | | `show crypto ipsec transform-set` | Display transform sets | | `debug crypto isakmp` | Debug IKE Phase 1 | | `debug crypto ipsec` | Debug IPsec Phase 2 | | `show crypto session` | Display active crypto sessions | **Example Outputs:** ```cisco Router# show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 203.0.113.2 203.0.113.1 QM_IDLE 1001 ACTIVE Router# show crypto ipsec sa interface: GigabitEthernet0/0 Crypto map tag: VPN-MAP, local addr 203.0.113.1 protected vrf: (none) local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0) current_peer 203.0.113.2 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 1234, #pkts encrypt: 1234, #pkts digest: 1234 #pkts decaps: 1234, #pkts decrypt: 1234, #pkts verify: 1234 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 203.0.113.1, remote crypto endpt.: 203.0.113.2 path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 current outbound spi: 0x12345678(305419896) inbound esp sas: spi: 0x87654321(2271560481) transform: esp-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 2001, flow_id: 1, crypto map: VPN-MAP sa timing: remaining key lifetime (k/sec): (4608000/3585) IV size: 16 bytes replay detection support: Y Status: ACTIVE ``` --- ### 10. DMVPN (Dynamic Multipoint VPN) **Definition:** DMVPN is a Cisco solution that combines GRE tunnels, IPsec encryption, and NHRP (Next Hop Resolution Protocol) to create a dynamic, scalable VPN network. ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ DMVPN ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────┐ │ │ │ HQ Router │ │ │ │ (Hub) │ │ │ │ NHRP Server │ │ │ └────────┬────────┘ │ │ │ │ │ ┌─────────────────┼─────────────────┐ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ Branch 1 │ │ Branch 2 │ │ Branch 3 │ │ │ │ (Spoke) │ │ (Spoke) │ │ (Spoke) │ │ │ │ NHRP Client │ │ NHRP Client │ │ NHRP Client │ │ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ │ DMVPN Features: │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Dynamic spoke-to-spoke tunnels (no need to configure all peers) │ │ │ │ • NHRP resolves spoke IP addresses │ │ │ │ • Single GRE tunnel interface for all spokes │ │ │ │ • IPsec encryption for all traffic │ │ │ │ • Scalable (add spokes without hub reconfiguration) │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` **DMVPN Hub Configuration:** ```cisco ! Hub Router interface Tunnel0 ip address 10.0.0.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication DMVPNKEY ip nhrp map multicast dynamic ip nhrp network-id 1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel protection ipsec profile DMVPN-PROFILE ! crypto ipsec profile DMVPN-PROFILE set transform-set DMVPN-TRANSFORM ``` **DMVPN Spoke Configuration:** ```cisco ! Spoke Router interface Tunnel0 ip address 10.0.0.2 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication DMVPNKEY ip nhrp map 10.0.0.1 203.0.113.1 ip nhrp map multicast 203.0.113.1 ip nhrp network-id 1 ip nhrp nhs 10.0.0.1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel protection ipsec profile DMVPN-PROFILE ``` --- ### 11. VPN Troubleshooting | Problem | Symptom | Solution | |---------|---------|----------| | **No IKE SA** | `show crypto isakmp sa` empty | Check reachability, ACL, shared secret | | **Phase 1 Fails** | `debug crypto isakmp` shows errors | Verify IKE policy matches, pre-shared key | | **No IPsec SA** | Phase 1 up, Phase 2 down | Check transform set, ACL, interesting traffic | | **Traffic Not Encrypted** | Packets going in clear | Verify ACL matches traffic, crypto map applied | | **Tunnel Flapping** | SA constantly rebuilding | Check keepalive, routing, NAT issues | | **MTU Issues** | Large packets fail | Adjust MTU, configure MSS | **Troubleshooting Commands:** ```cisco ! Check IKE Phase 1 Router# show crypto isakmp sa Router# debug crypto isakmp ! Check IPsec Phase 2 Router# show crypto ipsec sa Router# debug crypto ipsec ! Check crypto map application Router# show crypto map Router# show running-config | section crypto ! Clear VPN SAs (if stuck) Router# clear crypto isakmp Router# clear crypto sa ``` --- ### 12. VPN Best Practices ``` ┌─────────────────────────────────────────────────────────────────────────────┐ │ VPN BEST PRACTICES │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ 1. STRONG CRYPTOGRAPHY │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Use AES-256 encryption (not DES or 3DES) │ │ │ │ • Use SHA-256 for hashing (not MD5) │ │ │ │ • Use Diffie-Hellman Group 14 or higher │ │ │ │ • Use RSA certificates instead of pre-shared keys when possible │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 2. PERFECT FORWARD SECRECY (PFS) │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Enable PFS in Phase 2 │ │ │ │ • Ensures compromise of one key doesn't compromise others │ │ │ │ • set pfs group2 │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 3. MTU CONSIDERATIONS │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Reduce MTU on tunnel interfaces (1400) │ │ │ │ • Configure TCP MSS adjustment │ │ │ │ • ip tcp adjust-mss 1360 │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 4. KEY MANAGEMENT │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Use short SA lifetimes (1-8 hours) │ │ │ │ • Rotate pre-shared keys regularly │ │ │ │ • Use certificate-based authentication for large deployments │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ │ 5. MONITORING │ │ ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ • Configure syslog for VPN events │ │ │ │ • Monitor SA counts and lifetimes │ │ │ │ • Set up alerts for tunnel failures │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` --- ## 🔧 Complete Configuration Examples ### Lab 1: Site-to-Site IPsec VPN **Topology:** ``` Site A (192.168.1.0/24) Site B (192.168.2.0/24) ┌─────────┐ ┌─────────┐ │ Router A│ │ Router B│ │203.0.113.1│══════════════════════════│203.0.113.2│ └─────────┘ └─────────┘ ``` **Router A Configuration:** ```cisco hostname RouterA ! ! Phase 1 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 14 lifetime 86400 ! crypto isakmp key VPNKEY address 203.0.113.2 ! ! Phase 2 crypto ipsec transform-set VPN-TRANSFORM esp-aes-256 esp-sha256-hmac mode tunnel ! ! Crypto Map crypto map VPN-MAP 10 ipsec-isakmp set peer 203.0.113.2 set transform-set VPN-TRANSFORM set pfs group14 match address 110 ! ! Interesting Traffic access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 ! ! Interfaces interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map VPN-MAP ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ! end ``` **Router B Configuration:** ```cisco hostname RouterB ! crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 14 lifetime 86400 ! crypto isakmp key VPNKEY address 203.0.113.1 ! crypto ipsec transform-set VPN-TRANSFORM esp-aes-256 esp-sha256-hmac mode tunnel ! crypto map VPN-MAP 10 ipsec-isakmp set peer 203.0.113.1 set transform-set VPN-TRANSFORM set pfs group14 match address 110 ! access-list 110 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 ! interface GigabitEthernet0/0 ip address 203.0.113.2 255.255.255.0 crypto map VPN-MAP ! interface GigabitEthernet0/1 ip address 192.168.2.1 255.255.255.0 ! end ``` --- ### Lab 2: GRE over IPsec VPN **Router A Configuration:** ```cisco hostname RouterA ! ! IKE Phase 1 crypto isakmp policy 10 encryption aes hash sha authentication pre-share group 2 ! crypto isakmp key VPNKEY address 203.0.113.2 ! ! IPsec Profile for GRE crypto ipsec profile GRE-PROFILE set transform-set GRE-TRANSFORM ! crypto ipsec transform-set GRE-TRANSFORM esp-aes esp-sha-hmac mode transport ! ! GRE Tunnel with IPsec interface Tunnel0 ip address 10.0.0.1 255.255.255.0 tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 tunnel protection ipsec profile GRE-PROFILE ! interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 ! ! OSPF over tunnel router ospf 1 network 192.168.1.0 0.0.0.255 area 0 network 10.0.0.0 0.0.0.255 area 0 ! end ``` --- ## ✅ Exam Tips (For CCNA 200-301) | Topic | What Cisco Tests | |-------|------------------| | **IPsec Protocols** | ESP (50) for encryption, AH (51) for auth, IKE (UDP 500) | | **IKE Phase 1** | Establishes secure channel (ISAKMP SA) | | **IKE Phase 2** | Establishes IPsec SA for data | | **Tunnel vs. Transport** | Tunnel (gateway-gateway), Transport (host-host) | | **Interesting Traffic** | ACL that triggers VPN | | **DMVPN** | NHRP, mGRE, IPsec for scalable VPNs | ### Common Exam Scenarios: **Scenario 1:** "Which IPsec protocol provides both encryption and authentication?" - **Answer:** ESP (Encapsulating Security Payload) **Scenario 2:** "What is the purpose of IKE Phase 1?" - **Answer:** Establish a secure, authenticated channel for IKE Phase 2 **Scenario 3:** "What protocol does DMVPN use for dynamic peer discovery?" - **Answer:** NHRP (Next Hop Resolution Protocol) ### Mnemonics: **IPsec Protocols:** **"A-E-I" - AH, ESP, IKE** - **A**H: Authentication only (IP 51) - **E**SP: Encryption + Authentication (IP 50) - **I**KE: Key Exchange (UDP 500) **IKE Phases:** **"1 for Channel, 2 for Data"** - Phase 1: Establish secure channel - Phase 2: Protect actual data --- ## 📝 Summary (1-Minute Revision) ``` VPN TECHNOLOGIES: VPN TYPES: ├── Site-to-Site: Connects entire networks └── Remote Access: Connects individual users IPSEC COMPONENTS: ├── IKE (UDP 500): Key exchange, SA establishment ├── ESP (IP 50): Encryption + authentication └── AH (IP 51): Authentication only IPSEC MODES: ├── Tunnel Mode: Entire packet encrypted (site-to-site) └── Transport Mode: Only payload encrypted (host-to-host) IKE PHASE 1 (ISAKMP SA): ├── Encryption: AES, 3DES, DES ├── Hash: SHA, MD5 ├── DH Group: 1, 2, 5, 14 ├── Authentication: Pre-shared key, RSA └── Lifetime: 86400 sec (default) IKE PHASE 2 (IPsec SA): ├── Protocol: ESP, AH ├── Encryption: AES, 3DES ├── Authentication: SHA, MD5 ├── Mode: Tunnel, Transport └── Lifetime: 3600 sec (default) DMVPN: ├── mGRE: Multipoint GRE tunnel ├── NHRP: Dynamic peer discovery ├── IPsec: Encryption └── Hub-and-spoke with spoke-to-spoke tunnels VERIFICATION: ├── show crypto isakmp sa ├── show crypto ipsec sa ├── show crypto map ├── debug crypto isakmp └── debug crypto ipsec ``` --- ## 🧪 Practice Questions **1. Which IPsec protocol provides encryption and authentication?** - A) AH - B) ESP - C) IKE - D) ISAKMP <details> <summary>Answer</summary> <b>B) ESP</b> - Encapsulating Security Payload provides both encryption and authentication. </details> **2. What is the default IPsec mode for site-to-site VPNs?** - A) Transport Mode - B) Tunnel Mode - C) GRE Mode - D) L2TP Mode <details> <summary>Answer</summary> <b>B) Tunnel Mode</b> - Tunnel mode encapsulates the entire packet, used for site-to-site VPNs. </details> **3. Which protocol does IKE use for key exchange?** - A) TCP - B) UDP - C) IP - D) ICMP <details> <summary>Answer</summary> <b>B) UDP</b> - IKE uses UDP port 500 for key exchange. </details> **4. What is the purpose of IKE Phase 1?** - A) Encrypt data traffic - B) Establish a secure channel for Phase 2 - C) Authenticate users - D) Assign IP addresses <details> <summary>Answer</summary> <b>B) Establish a secure channel for Phase 2</b> - Phase 1 creates the ISAKMP SA for secure negotiation. </details> **5. Which command displays active IKE Phase 1 SAs?** - A) `show crypto ipsec sa` - B) `show crypto isakmp sa` - C) `show crypto session` - D) `show ipsec sa` <details> <summary>Answer</summary> <b>B) `show crypto isakmp sa`</b> - Displays IKE Phase 1 security associations. </details> **6. What does NHRP do in DMVPN?** - A) Encrypts traffic - B) Provides dynamic peer address resolution - C) Establishes GRE tunnels - D) Authenticates users <details> <summary>Answer</summary> <b>B) Provides dynamic peer address resolution</b> - NHRP resolves spoke IP addresses for direct tunnels. </details> **7. Which IPsec protocol uses IP number 50?** - A) AH - B) ESP - C) IKE - D) ISAKMP <details> <summary>Answer</summary> <b>B) ESP</b> - ESP uses IP protocol number 50. </details> **8. What is the default IKE Phase 1 lifetime?** - A) 3600 seconds - B) 86400 seconds - C) 14400 seconds - D) 7200 seconds <details> <summary>Answer</summary> <b>B) 86400 seconds</b> - Default IKE Phase 1 lifetime is 24 hours. </details> **9. Which command defines traffic that should be encrypted?** - A) `crypto map` - B) `access-list` in crypto map - C) `ip route` - D) `tunnel destination` <details> <summary>Answer</summary> <b>B) `access-list` in crypto map</b> - The ACL in the crypto map defines interesting traffic. </details> **10. Which protocol does DMVPN use for dynamic tunnel establishment?** - A) IPsec - B) GRE - C) NHRP - D) All of the above <details> <summary>Answer</summary> <b>D) All of the above</b> - DMVPN combines mGRE, NHRP, and IPsec. </details> **11. What is the difference between IKE Phase 1 and Phase 2?** - A) Phase 1 encrypts data, Phase 2 negotiates keys - B) Phase 1 establishes secure channel, Phase 2 establishes data SAs - C) Phase 1 uses ESP, Phase 2 uses AH - D) Phase 1 is for remote access, Phase 2 for site-to-site <details> <summary>Answer</summary> <b>B) Phase 1 establishes secure channel, Phase 2 establishes data SAs</b> - Phase 1 creates ISAKMP SA, Phase 2 creates IPsec SA. </details> **12. Which of the following is a strong encryption algorithm for IPsec?** - A) DES - B) 3DES - C) AES-256 - D) RC4 <details> <summary>Answer</summary> <b>C) AES-256</b> - AES-256 provides strong encryption, while DES and 3DES are deprecated. </details> --- ## 📌 Next Steps After completing Video 35, you should be ready for: - **Video 36:** Device Hardening and Security - **Video 37:** AAA (Authentication, Authorization, Accounting) **Lab Practice:** 1. Configure site-to-site IPsec VPN between two routers 2. Verify with `show crypto isakmp sa` and `show crypto ipsec sa` 3. Test with ping between private networks 4. Configure GRE over IPsec 5. Run OSPF over GRE over IPsec 6. Troubleshoot with debug commands --- **Ready for Video 36?** Share the link or say "next" and I'll continue with Device Hardening and Security. I'll continue with **Video 36: Device Hardening and Security** based on the standard CCNA 200-301 curriculum. ---