Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the easy-accordion-free domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114

Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the zoho-flow domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114

Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the wordpress-seo domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php on line 6114

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893

Warning: Cannot modify header information - headers already sent by (output started at /home/mother99/jacksonholdingcompany.com/wp-includes/functions.php:6114) in /home/mother99/jacksonholdingcompany.com/wp-includes/rest-api/class-wp-rest-server.php on line 1893
{"id":482,"date":"2023-07-31T17:27:41","date_gmt":"2023-07-31T17:27:41","guid":{"rendered":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/"},"modified":"2023-07-31T17:27:41","modified_gmt":"2023-07-31T17:27:41","slug":"a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm","status":"publish","type":"post","link":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/","title":{"rendered":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm"},"content":{"rendered":"

Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video. Right now, we\u2019re building a new data center to host the hands-on lab environments for learners, whether you\u2019re training in Cisco U. or taking a course with your favorite Cisco instructor. As you may know, A LOT goes into building a new data center. But since I\u2019m working on building the IPSEC VPN connections between this new data center and the others in our network, let\u2019s narrow it down and take a technical look at IPSEC VPN tunnel creation.<\/p>\n

In this blog post and the accompanying video, I\u2019ll cover the IPSEC VPN tunnel creation process. We\u2019ll explore \u201cPhase 1\u201d and \u201cPhase 2\u201d and take a look at how the ACLs that identify \u201cinteresting traffic\u201d impact the security associations that are built. We\u2019ll even look at the packets involved in the communications as tunnels are set up. If that sounds good to you, continue on, network adventurer!<\/p>\n

A Technical Look at IPSEC VPN Tunnel Creation<\/strong><\/h2>\n
[embedded content]<\/iframe><\/p>\n<h4><strong>\u201cTechnically Speaking\u2026 with Hank Preston\u201d is a segment on <em>The U.\u00a0<\/em>series. <\/strong><\/h4>\n<h4><strong>Available on the Cisco U. by Learning and Certifications YouTube Channel. <a href=\"https:\/\/youtube.com\/playlist?list=PL2AuQ_ZjCjsrL3LTRVaGrvjZ0YWmFXy02\">View Playlist<\/a><\/strong><\/h4>\n<p>If you\u2019re new here, I\u2019m Hank Preston, Principal Engineer on the Labs and Systems team in Cisco Learning and Certifications. I\u2019ve been building IPSEC VPNs for almost my entire career as a network engineer. In fact, one of my first jobs as a shiny new network engineer was building out IPSEC VPN connections using Cisco PIX firewalls for a Cisco Partner. For me, that meant taking the configuration templates built by the team\u2019s more senior engineers and updating them with the details for a particular tunnel creation.<\/p>\n<p>It wasn\u2019t a problem\u2026 until there was one. You see, I didn\u2019t really know what all the commands did back then. So when things didn\u2019t work right away, finding the problem and knowing how to fix it was a bit of a mystery to me. Thankfully, there were some very good mentors and senior engineers to guide me.<\/p>\n<p>I had to learn the commands to run to help me determine the problem and how to fix it. It was during these troubleshooting sessions I first learned terms like \u201cPhase 1,\u201d \u201cPhase 2,\u201d \u201cMain Mode,\u201d \u201cQuick Mode,\u201d and \u201cAggressive Mode,\u201d as well as the protocols involved, like ISAKMP, IKE, IPSEC. It was a lot of fun, and it was only the beginning.<\/p>\n<p>Over the years, my depth of understanding grew, transforming me into a senior engineer, not unlike those who nurtured my own curiosity. In addition to learning on the job, I had to dive deep into IPSEC VPNs to prepare for my Cisco certification exams. Even though I was preparing for now-retired certifications like CCNA Security, CCSP, and \u201cVPN Specialist,\u201d IPSEC knowledge is still important to this day.<\/p>\n<h3><strong>So, should <em>you <\/em>learn IPSEC?<\/strong><\/h3>\n<p>IPSEC knowledge is critical for real-world applications <em>and<\/em> current Cisco certification exams. In fact, it\u2019s listed on the <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccna-exam-topics\">200-301 CCNA exam topics<\/a>, which is quite telling since the CCNA certification is the mark of someone who has the foundational knowledge to take their tech career in multiple directions. But that\u2019s not all. IPSEC is on the <a href=\"https:\/\/learningnetwork.cisco.com\/s\/encor-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Enterprise Core Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/scor-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Security Core Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/svpn-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Security VPN Specialist<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccie-enterpr-infrastructure-exam-topics\" target=\"_blank\" rel=\"noopener\">CCIE Enterprise Lab Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccie-security-exam-topics\" target=\"_blank\" rel=\"noopener\">CCIE Security Lab Exam<\/a>, and probably others. I didn\u2019t check.<\/p>\n<p>So when honing in on a topic for this month, my first choice was IPSEC VPNs. <em>IPSEC VPNs is a huge topic, though<\/em>. I knew I couldn\u2019t cover everything in a single short \u201cTechnically Speaking\u2026\u201d installment. In fact, I hadn\u2019t decided exactly where to focus until I was in the middle of standing up a new tunnel connection between two of our data centers.<\/p>\n<p>There I was, monitoring the tunnel status to ensure everything was healthy, when I found myself on the CLI of one of the firewalls, running commands I\u2019d run thousands of times: \u201cshow crypto isakmp sa\u201d and \u201cshow crypto ipsec sa.\u201d As I verified that each security association for the traffic types had come up and was healthy, I reflected on my early days of building VPNs on PIXs running these same commands and not knowing what I was looking at. And that\u2019s when it hit me: <em>this would make an excellent addition to the library<\/em>.<\/p>\n<p>And here were are. Feel free to use the video above to help you follow what I have outlined below. Alright, adventurers\u2026 let\u2019s jump in.<\/p>\n<h2><strong>Can\u2019t have a VPN without a couple of sites to connect together\u2026<\/strong><\/h2>\n<p><strong>Before we start looking at the tunnel creation, we need a network to work with. <\/strong><\/p>\n<p>So, I put together a fairly straightforward 2-site network:<\/p>\n<p><a href=\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2023\/07\/vpn-01-111.jpg\"><\/a>Simple 2-site Network<\/p>\n<p><strong>Site 1<\/strong> (bottom in the diagram) has two local networks; a YELLOW network and a BLUE network.<\/p>\n<p><strong>Site 2<\/strong> (top in the diagram) has a single local network, the PURPLE network.<\/p>\n<p>Each site is connected to an untrusted WAN by a firewall. \u00a0The firewall is configured like firewalls often are: to perform NAT\/PAT on traffic passing from \u201cinside\u201d to \u201coutside.\u201d<\/p>\n<p>Bringing the IPSEC VPN concept into this network, the goal is to create a tunnel between the two firewalls that will allow traffic between the sites to be securely tunneled across the WAN. This would then provide a network path for hosts on Site 1\u2019s YELLOW and BLUE networks to reach the hosts on Site 2\u2019s PURPLE network.<\/p>\n<p><a href=\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2023\/07\/vpn-02-112.jpg\"><\/a><\/p>\n<p><strong>Just to let you know\u2026 the focus of this post is NOT on the configuration required to set up the network or the IPSEC tunnel itself.<\/strong> Instead, we will look at the <em>process<\/em> that happens to establish and build the connections when relevant traffic arrives at the firewall and initiates the IPSEC process.<\/p>\n<h4>If you\u2019d like to see the configurations in this setup, I have posted a <a href=\"https:\/\/github.com\/CiscoDevNet\/cml-community\/blob\/master\/lab-topologies\/ipsec-exploration.yaml\" target=\"_blank\" rel=\"noopener\">CML topology file<\/a> for this network in the <a href=\"https:\/\/github.com\/CiscoDevNet\/cml-community\" target=\"_blank\" rel=\"noopener\">CML Community on GitHub<\/a>. If you\u2019d like to dive deeper and try some of this exploration yourself, download the file and run it on your CML server.<\/h4>\n<h2><strong>Saying something \u201cinteresting\u201d<\/strong><\/h2>\n<p>Just because a VPN is configured on a firewall doesn\u2019t mean the tunnel will be established.<\/p>\n<p><strong>Tunnels<\/strong> are established when they are needed and will eventually be torn down if left idle (without traffic passing through them) for long enough.<br \/>\nA <strong>firewall<\/strong> determines what type of traffic should trigger the building of a VPN based on an access list that is associated with the IPSEC crypto map that defines the VPN.<\/p>\n<p>Let\u2019s take a look at the access list on <strong>Site1-FW<\/strong> that defines this \u201cinteresting traffic.\u201d<\/p>\n<p>Site1-FW# show access-list s2svpn_to_site2 <br \/>\naccess-list s2svpn_to_site2; 2 elements; name hash: 0xa681e779<br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip object-group SITE1 object-group SITE2 log default (hitcnt=0) 0xb520aee6 <br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip 192.168.200.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xfab888fb <br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip 192.168.100.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xb7b04209 <br \/>\nSite1-FW# show run crypto map \u202f<a href=\"https:\/\/www.youtube.com\/@CiscoUtube\">YouTube<\/a>\n<\/p><p>Use <strong>#CiscoU<\/strong>\u00a0and\u00a0<strong>#CiscoCert<\/strong>\u202fto join the conversation.<\/p>\n<h4><strong><em>Read next: <a href=\"https:\/\/blogs.cisco.com\/learning\/exploring-default-docker-networking-part-1\">Exploring Default Docker Networking [Part 1]<\/a> by Hank Preston<\/em><\/strong><\/h4>\n<div>\n\t\tShare\n<div class=\"twitter\">\n<div class=\"box\"><\/div>\n<\/div>\n<div class=\"facebook\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"http:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation&title=A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"linkedin\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"https:\/\/www.linkedin.com\/cws\/share?url=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"mail\">\n<div class=\"box\">\n\t<a class=\"share\" href=\"mailto:?subject=Cisco%20Blog:%20A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation&body=I%20saw%20this%20post%20on%20Cisco%20Blogs%20and%20thought%20you%20might%20like%20to%20read%20it.%0A%0AA%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation%0A%0Ahttps:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation%0A%0ADisclaimer%0A%0ACisco%20is%20not%20responsible%20for%20the%20content%20of%20this%20email,%20and%20its%20contents%20do%20not%20necessarily%20reflect%20Cisco%E2%80%99s%20views%20or%20opinions.%20Cisco%20has%20not%20verified%20the%20email%20address%20or%20name%20of%20the%20sender.\"> <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n<div class=\"share_text\">Share:<\/div>\n<div>\n<div class=\"twitter\">\n<div class=\"box\"><\/div>\n<\/div>\n<div class=\"facebook\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"http:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation&title=A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"linkedin\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"https:\/\/www.linkedin.com\/cws\/share?url=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"mail\">\n<div class=\"box\">\n\t<a class=\"share\" href=\"mailto:?subject=Cisco%20Blog:%20A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation&body=I%20saw%20this%20post%20on%20Cisco%20Blogs%20and%20thought%20you%20might%20like%20to%20read%20it.%0A%0AA%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation%0A%0Ahttps:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation%0A%0ADisclaimer%0A%0ACisco%20is%20not%20responsible%20for%20the%20content%20of%20this%20email,%20and%20its%20contents%20do%20not%20necessarily%20reflect%20Cisco%E2%80%99s%20views%20or%20opinions.%20Cisco%20has%20not%20verified%20the%20email%20address%20or%20name%20of%20the%20sender.\"> <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n<p>\u00a0\u00a0Explore the IPSEC VPN tunnel creation process, including “Phase 1” and “Phase 2,” how Security Associations are impacted when ACLs identify “interesting traffic,” and even the packets involved in the communications.\u00a0\u00a0<a href=\"https:\/\/feedpress.me\/link\/23532\/16274101\/a-technical-look-at-ipsec-vpn-tunnel-creation\" target=\"_blank\" class=\"feedzy-rss-link-icon\" rel=\"noopener\">Read More<\/a>\u00a0Cisco Blogs\u00a0<\/p>","protected":false},"excerpt":{"rendered":"<p><\/p>\n<p>Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video.\u2026 <a href=\"https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation?utm_medium=feed&utm_source=feedpress.me&utm_campaign=Feed%3A+CiscoBlogs\">Read more on Cisco Blogs<\/a><\/p>\n<p>\u200b<\/p>\n<p>Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video. Right now, we\u2019re building a new data center to host the hands-on lab environments for learners, whether you\u2019re training in Cisco U. or taking a course with your favorite Cisco instructor. As you may know, A LOT goes into building a new data center. But since I\u2019m working on building the IPSEC VPN connections between this new data center and the others in our network, let\u2019s narrow it down and take a technical look at IPSEC VPN tunnel creation.<\/p>\n<p>In this blog post and the accompanying video, I\u2019ll cover the IPSEC VPN tunnel creation process. We\u2019ll explore \u201cPhase 1\u201d and \u201cPhase 2\u201d and take a look at how the ACLs that identify \u201cinteresting traffic\u201d impact the security associations that are built. We\u2019ll even look at the packets involved in the communications as tunnels are set up. If that sounds good to you, continue on, network adventurer!<\/p>\n<h2><strong>A Technical Look at IPSEC VPN Tunnel Creation<\/strong><\/h2>\n<p><iframe width=\"640\" height=\"360\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/pQRLCi9QrEM?feature=oembed\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\">[embedded content]<\/iframe><\/p>\n<h4><strong>\u201cTechnically Speaking\u2026 with Hank Preston\u201d is a segment on <em>The U.\u00a0<\/em>series. <\/strong><\/h4>\n<h4><strong>Available on the Cisco U. by Learning and Certifications YouTube Channel. <a href=\"https:\/\/youtube.com\/playlist?list=PL2AuQ_ZjCjsrL3LTRVaGrvjZ0YWmFXy02\">View Playlist<\/a><\/strong><\/h4>\n<p>If you\u2019re new here, I\u2019m Hank Preston, Principal Engineer on the Labs and Systems team in Cisco Learning and Certifications. I\u2019ve been building IPSEC VPNs for almost my entire career as a network engineer. In fact, one of my first jobs as a shiny new network engineer was building out IPSEC VPN connections using Cisco PIX firewalls for a Cisco Partner. For me, that meant taking the configuration templates built by the team\u2019s more senior engineers and updating them with the details for a particular tunnel creation.<\/p>\n<p>It wasn\u2019t a problem\u2026 until there was one. You see, I didn\u2019t really know what all the commands did back then. So when things didn\u2019t work right away, finding the problem and knowing how to fix it was a bit of a mystery to me. Thankfully, there were some very good mentors and senior engineers to guide me.<\/p>\n<p>I had to learn the commands to run to help me determine the problem and how to fix it. It was during these troubleshooting sessions I first learned terms like \u201cPhase 1,\u201d \u201cPhase 2,\u201d \u201cMain Mode,\u201d \u201cQuick Mode,\u201d and \u201cAggressive Mode,\u201d as well as the protocols involved, like ISAKMP, IKE, IPSEC. It was a lot of fun, and it was only the beginning.<\/p>\n<p>Over the years, my depth of understanding grew, transforming me into a senior engineer, not unlike those who nurtured my own curiosity. In addition to learning on the job, I had to dive deep into IPSEC VPNs to prepare for my Cisco certification exams. Even though I was preparing for now-retired certifications like CCNA Security, CCSP, and \u201cVPN Specialist,\u201d IPSEC knowledge is still important to this day.<\/p>\n<h3><strong>So, should <em>you <\/em>learn IPSEC?<\/strong><\/h3>\n<p>IPSEC knowledge is critical for real-world applications <em>and<\/em> current Cisco certification exams. In fact, it\u2019s listed on the <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccna-exam-topics\">200-301 CCNA exam topics<\/a>, which is quite telling since the CCNA certification is the mark of someone who has the foundational knowledge to take their tech career in multiple directions. But that\u2019s not all. IPSEC is on the <a href=\"https:\/\/learningnetwork.cisco.com\/s\/encor-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Enterprise Core Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/scor-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Security Core Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/svpn-exam-topics\" target=\"_blank\" rel=\"noopener\">CCNP Security VPN Specialist<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccie-enterpr-infrastructure-exam-topics\" target=\"_blank\" rel=\"noopener\">CCIE Enterprise Lab Exam<\/a>, <a href=\"https:\/\/learningnetwork.cisco.com\/s\/ccie-security-exam-topics\" target=\"_blank\" rel=\"noopener\">CCIE Security Lab Exam<\/a>, and probably others. I didn\u2019t check.<\/p>\n<p>So when honing in on a topic for this month, my first choice was IPSEC VPNs. <em>IPSEC VPNs is a huge topic, though<\/em>. I knew I couldn\u2019t cover everything in a single short \u201cTechnically Speaking\u2026\u201d installment. In fact, I hadn\u2019t decided exactly where to focus until I was in the middle of standing up a new tunnel connection between two of our data centers.<\/p>\n<p>There I was, monitoring the tunnel status to ensure everything was healthy, when I found myself on the CLI of one of the firewalls, running commands I\u2019d run thousands of times: \u201cshow crypto isakmp sa\u201d and \u201cshow crypto ipsec sa.\u201d As I verified that each security association for the traffic types had come up and was healthy, I reflected on my early days of building VPNs on PIXs running these same commands and not knowing what I was looking at. And that\u2019s when it hit me: <em>this would make an excellent addition to the library<\/em>.<\/p>\n<p>And here were are. Feel free to use the video above to help you follow what I have outlined below. Alright, adventurers\u2026 let\u2019s jump in.<\/p>\n<h2><strong>Can\u2019t have a VPN without a couple of sites to connect together\u2026<\/strong><\/h2>\n<p><strong>Before we start looking at the tunnel creation, we need a network to work with. <\/strong><\/p>\n<p>So, I put together a fairly straightforward 2-site network:<\/p>\n<p><a href=\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2023\/07\/vpn-01-111.jpg\"><\/a>Simple 2-site Network<\/p>\n<p><strong>Site 1<\/strong> (bottom in the diagram) has two local networks; a YELLOW network and a BLUE network.<\/p>\n<p><strong>Site 2<\/strong> (top in the diagram) has a single local network, the PURPLE network.<\/p>\n<p>Each site is connected to an untrusted WAN by a firewall. \u00a0The firewall is configured like firewalls often are: to perform NAT\/PAT on traffic passing from \u201cinside\u201d to \u201coutside.\u201d<\/p>\n<p>Bringing the IPSEC VPN concept into this network, the goal is to create a tunnel between the two firewalls that will allow traffic between the sites to be securely tunneled across the WAN. This would then provide a network path for hosts on Site 1\u2019s YELLOW and BLUE networks to reach the hosts on Site 2\u2019s PURPLE network.<\/p>\n<p><a href=\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2023\/07\/vpn-02-112.jpg\"><\/a><\/p>\n<p><strong>Just to let you know\u2026 the focus of this post is NOT on the configuration required to set up the network or the IPSEC tunnel itself.<\/strong> Instead, we will look at the <em>process<\/em> that happens to establish and build the connections when relevant traffic arrives at the firewall and initiates the IPSEC process.<\/p>\n<h4>If you\u2019d like to see the configurations in this setup, I have posted a <a href=\"https:\/\/github.com\/CiscoDevNet\/cml-community\/blob\/master\/lab-topologies\/ipsec-exploration.yaml\" target=\"_blank\" rel=\"noopener\">CML topology file<\/a> for this network in the <a href=\"https:\/\/github.com\/CiscoDevNet\/cml-community\" target=\"_blank\" rel=\"noopener\">CML Community on GitHub<\/a>. If you\u2019d like to dive deeper and try some of this exploration yourself, download the file and run it on your CML server.<\/h4>\n<h2><strong>Saying something \u201cinteresting\u201d<\/strong><\/h2>\n<p>Just because a VPN is configured on a firewall doesn\u2019t mean the tunnel will be established.<\/p>\n<p><strong>Tunnels<\/strong> are established when they are needed and will eventually be torn down if left idle (without traffic passing through them) for long enough.<br \/>\nA <strong>firewall<\/strong> determines what type of traffic should trigger the building of a VPN based on an access list that is associated with the IPSEC crypto map that defines the VPN.<\/p>\n<p>Let\u2019s take a look at the access list on <strong>Site1-FW<\/strong> that defines this \u201cinteresting traffic.\u201d<\/p>\n<p>Site1-FW# show access-list s2svpn_to_site2 <br \/>\naccess-list s2svpn_to_site2; 2 elements; name hash: 0xa681e779<br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip object-group SITE1 object-group SITE2 log default (hitcnt=0) 0xb520aee6 <br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip 192.168.200.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xfab888fb <br \/>\naccess-list s2svpn_to_site2 line 1 extended permit ip 192.168.100.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xb7b04209 <br \/>\nSite1-FW# show run crypto map \u202f<a href=\"https:\/\/www.youtube.com\/@CiscoUtube\">YouTube<\/a>\n<\/p>\n<p>Use <strong>#CiscoU<\/strong>\u00a0and\u00a0<strong>#CiscoCert<\/strong>\u202fto join the conversation.<\/p>\n<h4><strong><em>Read next: <a href=\"https:\/\/blogs.cisco.com\/learning\/exploring-default-docker-networking-part-1\">Exploring Default Docker Networking [Part 1]<\/a> by Hank Preston<\/em><\/strong><\/h4>\n<div>\n\t\tShare<\/p>\n<div class=\"twitter\">\n<div class=\"box\"><\/div>\n<\/div>\n<div class=\"facebook\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"http:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation&title=A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"linkedin\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"https:\/\/www.linkedin.com\/cws\/share?url=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"mail\">\n<div class=\"box\">\n\t<a class=\"share\" href=\"mailto:?subject=Cisco%20Blog:%20A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation&body=I%20saw%20this%20post%20on%20Cisco%20Blogs%20and%20thought%20you%20might%20like%20to%20read%20it.%0A%0AA%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation%0A%0Ahttps:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation%0A%0ADisclaimer%0A%0ACisco%20is%20not%20responsible%20for%20the%20content%20of%20this%20email,%20and%20its%20contents%20do%20not%20necessarily%20reflect%20Cisco%E2%80%99s%20views%20or%20opinions.%20Cisco%20has%20not%20verified%20the%20email%20address%20or%20name%20of%20the%20sender.\"> <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n<div class=\"share_text\">Share:<\/div>\n<div>\n<div class=\"twitter\">\n<div class=\"box\"><\/div>\n<\/div>\n<div class=\"facebook\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"http:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation&title=A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"linkedin\">\n<div class=\"box\">\n\t\t<a class=\"share\" href=\"https:\/\/www.linkedin.com\/cws\/share?url=https:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation\"><\/a>\n\t<\/div>\n<\/div>\n<div class=\"mail\">\n<div class=\"box\">\n\t<a class=\"share\" href=\"mailto:?subject=Cisco%20Blog:%20A%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation&body=I%20saw%20this%20post%20on%20Cisco%20Blogs%20and%20thought%20you%20might%20like%20to%20read%20it.%0A%0AA%20Technical%20Look%20at%20IPSEC%20VPN%20Tunnel%20Creation%0A%0Ahttps:\/\/blogs.cisco.com\/learning\/a-technical-look-at-ipsec-vpn-tunnel-creation%0A%0ADisclaimer%0A%0ACisco%20is%20not%20responsible%20for%20the%20content%20of%20this%20email,%20and%20its%20contents%20do%20not%20necessarily%20reflect%20Cisco%E2%80%99s%20views%20or%20opinions.%20Cisco%20has%20not%20verified%20the%20email%20address%20or%20name%20of%20the%20sender.\"> <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n<p>\u00a0\u00a0Explore the IPSEC VPN tunnel creation process, including “Phase 1” and “Phase 2,” how Security Associations are impacted when ACLs identify “interesting traffic,” and even the packets involved in the communications.\u00a0\u00a0<a href=\"https:\/\/feedpress.me\/link\/23532\/16274101\/a-technical-look-at-ipsec-vpn-tunnel-creation\" target=\"_blank\" class=\"feedzy-rss-link-icon\" rel=\"noopener\">Read More<\/a>\u00a0Cisco Blogs\u00a0<\/p>\n<p><\/p>\n","protected":false},"author":1,"featured_media":276,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-482","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cisco-learning"],"yoast_head":"\n<title>A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm - JHC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm\" \/>\n<meta property=\"og:description\" content=\"Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video.\u2026 Read more on Cisco Blogs \u200b Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video. Right now, we\u2019re building a new data center to host the hands-on lab environments for learners, whether you\u2019re training in Cisco U. or taking a course with your favorite Cisco instructor. As you may know, A LOT goes into building a new data center. But since I\u2019m working on building the IPSEC VPN connections between this new data center and the others in our network, let\u2019s narrow it down and take a technical look at IPSEC VPN tunnel creation. In this blog post and the accompanying video, I\u2019ll cover the IPSEC VPN tunnel creation process. We\u2019ll explore \u201cPhase 1\u201d and \u201cPhase 2\u201d and take a look at how the ACLs that identify \u201cinteresting traffic\u201d impact the security associations that are built. We\u2019ll even look at the packets involved in the communications as tunnels are set up. If that sounds good to you, continue on, network adventurer! A Technical Look at IPSEC VPN Tunnel Creation [embedded content] \u201cTechnically Speaking\u2026 with Hank Preston\u201d is a segment on The U.\u00a0series. Available on the Cisco U. by Learning and Certifications YouTube Channel. View Playlist If you\u2019re new here, I\u2019m Hank Preston, Principal Engineer on the Labs and Systems team in Cisco Learning and Certifications. I\u2019ve been building IPSEC VPNs for almost my entire career as a network engineer. In fact, one of my first jobs as a shiny new network engineer was building out IPSEC VPN connections using Cisco PIX firewalls for a Cisco Partner. For me, that meant taking the configuration templates built by the team\u2019s more senior engineers and updating them with the details for a particular tunnel creation. It wasn\u2019t a problem\u2026 until there was one. You see, I didn\u2019t really know what all the commands did back then. So when things didn\u2019t work right away, finding the problem and knowing how to fix it was a bit of a mystery to me. Thankfully, there were some very good mentors and senior engineers to guide me. I had to learn the commands to run to help me determine the problem and how to fix it. It was during these troubleshooting sessions I first learned terms like \u201cPhase 1,\u201d \u201cPhase 2,\u201d \u201cMain Mode,\u201d \u201cQuick Mode,\u201d and \u201cAggressive Mode,\u201d as well as the protocols involved, like ISAKMP, IKE, IPSEC. It was a lot of fun, and it was only the beginning. Over the years, my depth of understanding grew, transforming me into a senior engineer, not unlike those who nurtured my own curiosity. In addition to learning on the job, I had to dive deep into IPSEC VPNs to prepare for my Cisco certification exams. Even though I was preparing for now-retired certifications like CCNA Security, CCSP, and \u201cVPN Specialist,\u201d IPSEC knowledge is still important to this day. So, should you learn IPSEC? IPSEC knowledge is critical for real-world applications and current Cisco certification exams. In fact, it\u2019s listed on the 200-301 CCNA exam topics, which is quite telling since the CCNA certification is the mark of someone who has the foundational knowledge to take their tech career in multiple directions. But that\u2019s not all. IPSEC is on the CCNP Enterprise Core Exam, CCNP Security Core Exam, CCNP Security VPN Specialist, CCIE Enterprise Lab Exam, CCIE Security Lab Exam, and probably others. I didn\u2019t check. So when honing in on a topic for this month, my first choice was IPSEC VPNs. IPSEC VPNs is a huge topic, though. I knew I couldn\u2019t cover everything in a single short \u201cTechnically Speaking\u2026\u201d installment. In fact, I hadn\u2019t decided exactly where to focus until I was in the middle of standing up a new tunnel connection between two of our data centers. There I was, monitoring the tunnel status to ensure everything was healthy, when I found myself on the CLI of one of the firewalls, running commands I\u2019d run thousands of times: \u201cshow crypto isakmp sa\u201d and \u201cshow crypto ipsec sa.\u201d As I verified that each security association for the traffic types had come up and was healthy, I reflected on my early days of building VPNs on PIXs running these same commands and not knowing what I was looking at. And that\u2019s when it hit me: this would make an excellent addition to the library. And here were are. Feel free to use the video above to help you follow what I have outlined below. Alright, adventurers\u2026 let\u2019s jump in. Can\u2019t have a VPN without a couple of sites to connect together\u2026 Before we start looking at the tunnel creation, we need a network to work with. So, I put together a fairly straightforward 2-site network: Simple 2-site Network Site 1 (bottom in the diagram) has two local networks; a YELLOW network and a BLUE network. Site 2 (top in the diagram) has a single local network, the PURPLE network. Each site is connected to an untrusted WAN by a firewall. \u00a0The firewall is configured like firewalls often are: to perform NAT\/PAT on traffic passing from \u201cinside\u201d to \u201coutside.\u201d Bringing the IPSEC VPN concept into this network, the goal is to create a tunnel between the two firewalls that will allow traffic between the sites to be securely tunneled across the WAN. This would then provide a network path for hosts on Site 1\u2019s YELLOW and BLUE networks to reach the hosts on Site 2\u2019s PURPLE network. Just to let you know\u2026 the focus of this post is NOT on the configuration required to set up the network or the IPSEC tunnel itself. Instead, we will look at the process that happens to establish and build the connections when relevant traffic arrives at the firewall and initiates the IPSEC process. If you\u2019d like to see the configurations in this setup, I have posted a CML topology file for this network in the CML Community on GitHub. If you\u2019d like to dive deeper and try some of this exploration yourself, download the file and run it on your CML server. Saying something \u201cinteresting\u201d Just because a VPN is configured on a firewall doesn\u2019t mean the tunnel will be established. Tunnels are established when they are needed and will eventually be torn down if left idle (without traffic passing through them) for long enough. A firewall determines what type of traffic should trigger the building of a VPN based on an access list that is associated with the IPSEC crypto map that defines the VPN. Let\u2019s take a look at the access list on Site1-FW that defines this \u201cinteresting traffic.\u201d Site1-FW# show access-list s2svpn_to_site2  access-list s2svpn_to_site2; 2 elements; name hash: 0xa681e779 access-list s2svpn_to_site2 line 1 extended permit ip object-group SITE1 object-group SITE2 log default (hitcnt=0) 0xb520aee6  access-list s2svpn_to_site2 line 1 extended permit ip 192.168.200.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xfab888fb  access-list s2svpn_to_site2 line 1 extended permit ip 192.168.100.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xb7b04209  Site1-FW# show run crypto map \u202fYouTube Use #CiscoU\u00a0and\u00a0#CiscoCert\u202fto join the conversation. Read next: Exploring Default Docker Networking [Part 1] by Hank Preston Share Share: \u00a0\u00a0Explore the IPSEC VPN tunnel creation process, including "Phase 1" and "Phase 2," how Security Associations are impacted when ACLs identify "interesting traffic," and even the packets involved in the communications.\u00a0\u00a0Read More\u00a0Cisco Blogs\u00a0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\" \/>\n<meta property=\"og:site_name\" content=\"JHC\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-31T17:27:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif\" \/>\n\t<meta property=\"og:image:width\" content=\"1\" \/>\n\t<meta property=\"og:image:height\" content=\"1\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/gif\" \/>\n<meta name=\"author\" content=\"webmaster\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Hank Preston\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\"},\"author\":{\"name\":\"webmaster\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/fd5c1bc5f9cf48ea7dd11f1c36681713\"},\"headline\":\"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm\",\"datePublished\":\"2023-07-31T17:27:41+00:00\",\"dateModified\":\"2023-07-31T17:27:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\"},\"wordCount\":1317,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif\",\"articleSection\":[\"Cisco: Learning\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\",\"url\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\",\"name\":\"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm - JHC\",\"isPartOf\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif\",\"datePublished\":\"2023-07-31T17:27:41+00:00\",\"dateModified\":\"2023-07-31T17:27:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage\",\"url\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif\",\"contentUrl\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif\",\"width\":1,\"height\":1},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jacksonholdingcompany.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#website\",\"url\":\"https:\/\/jacksonholdingcompany.com\/\",\"name\":\"JHC\",\"description\":\"Your Business Is Our Business\",\"publisher\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jacksonholdingcompany.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#organization\",\"name\":\"JHC\",\"url\":\"https:\/\/jacksonholdingcompany.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/cropped-cropped-jHC-white-500-\u00d7-200-px-1-1.png\",\"contentUrl\":\"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/cropped-cropped-jHC-white-500-\u00d7-200-px-1-1.png\",\"width\":452,\"height\":149,\"caption\":\"JHC\"},\"image\":{\"@id\":\"https:\/\/jacksonholdingcompany.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/fd5c1bc5f9cf48ea7dd11f1c36681713\",\"name\":\"webmaster\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/911695a544af2e1fa85dfa9007bba0e3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/911695a544af2e1fa85dfa9007bba0e3?s=96&d=mm&r=g\",\"caption\":\"webmaster\"},\"sameAs\":[\"https:\/\/jacksonholdingcompany.com\"],\"url\":\"https:\/\/feedpress.me\/link\/23532\/16274101\/a-technical-look-at-ipsec-vpn-tunnel-creation\"}]}<\/script>\n","yoast_head_json":{"title":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm - JHC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/","og_locale":"en_US","og_type":"article","og_title":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm","og_description":"Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video.\u2026 Read more on Cisco Blogs \u200b Hello everyone, and welcome back to my little corner of the Internet. I always take inspiration from what I\u2019m currently working on in my day job when putting together an idea for a post and\/or video. Right now, we\u2019re building a new data center to host the hands-on lab environments for learners, whether you\u2019re training in Cisco U. or taking a course with your favorite Cisco instructor. As you may know, A LOT goes into building a new data center. But since I\u2019m working on building the IPSEC VPN connections between this new data center and the others in our network, let\u2019s narrow it down and take a technical look at IPSEC VPN tunnel creation. In this blog post and the accompanying video, I\u2019ll cover the IPSEC VPN tunnel creation process. We\u2019ll explore \u201cPhase 1\u201d and \u201cPhase 2\u201d and take a look at how the ACLs that identify \u201cinteresting traffic\u201d impact the security associations that are built. We\u2019ll even look at the packets involved in the communications as tunnels are set up. If that sounds good to you, continue on, network adventurer! A Technical Look at IPSEC VPN Tunnel Creation [embedded content] \u201cTechnically Speaking\u2026 with Hank Preston\u201d is a segment on The U.\u00a0series. Available on the Cisco U. by Learning and Certifications YouTube Channel. View Playlist If you\u2019re new here, I\u2019m Hank Preston, Principal Engineer on the Labs and Systems team in Cisco Learning and Certifications. I\u2019ve been building IPSEC VPNs for almost my entire career as a network engineer. In fact, one of my first jobs as a shiny new network engineer was building out IPSEC VPN connections using Cisco PIX firewalls for a Cisco Partner. For me, that meant taking the configuration templates built by the team\u2019s more senior engineers and updating them with the details for a particular tunnel creation. It wasn\u2019t a problem\u2026 until there was one. You see, I didn\u2019t really know what all the commands did back then. So when things didn\u2019t work right away, finding the problem and knowing how to fix it was a bit of a mystery to me. Thankfully, there were some very good mentors and senior engineers to guide me. I had to learn the commands to run to help me determine the problem and how to fix it. It was during these troubleshooting sessions I first learned terms like \u201cPhase 1,\u201d \u201cPhase 2,\u201d \u201cMain Mode,\u201d \u201cQuick Mode,\u201d and \u201cAggressive Mode,\u201d as well as the protocols involved, like ISAKMP, IKE, IPSEC. It was a lot of fun, and it was only the beginning. Over the years, my depth of understanding grew, transforming me into a senior engineer, not unlike those who nurtured my own curiosity. In addition to learning on the job, I had to dive deep into IPSEC VPNs to prepare for my Cisco certification exams. Even though I was preparing for now-retired certifications like CCNA Security, CCSP, and \u201cVPN Specialist,\u201d IPSEC knowledge is still important to this day. So, should you learn IPSEC? IPSEC knowledge is critical for real-world applications and current Cisco certification exams. In fact, it\u2019s listed on the 200-301 CCNA exam topics, which is quite telling since the CCNA certification is the mark of someone who has the foundational knowledge to take their tech career in multiple directions. But that\u2019s not all. IPSEC is on the CCNP Enterprise Core Exam, CCNP Security Core Exam, CCNP Security VPN Specialist, CCIE Enterprise Lab Exam, CCIE Security Lab Exam, and probably others. I didn\u2019t check. So when honing in on a topic for this month, my first choice was IPSEC VPNs. IPSEC VPNs is a huge topic, though. I knew I couldn\u2019t cover everything in a single short \u201cTechnically Speaking\u2026\u201d installment. In fact, I hadn\u2019t decided exactly where to focus until I was in the middle of standing up a new tunnel connection between two of our data centers. There I was, monitoring the tunnel status to ensure everything was healthy, when I found myself on the CLI of one of the firewalls, running commands I\u2019d run thousands of times: \u201cshow crypto isakmp sa\u201d and \u201cshow crypto ipsec sa.\u201d As I verified that each security association for the traffic types had come up and was healthy, I reflected on my early days of building VPNs on PIXs running these same commands and not knowing what I was looking at. And that\u2019s when it hit me: this would make an excellent addition to the library. And here were are. Feel free to use the video above to help you follow what I have outlined below. Alright, adventurers\u2026 let\u2019s jump in. Can\u2019t have a VPN without a couple of sites to connect together\u2026 Before we start looking at the tunnel creation, we need a network to work with. So, I put together a fairly straightforward 2-site network: Simple 2-site Network Site 1 (bottom in the diagram) has two local networks; a YELLOW network and a BLUE network. Site 2 (top in the diagram) has a single local network, the PURPLE network. Each site is connected to an untrusted WAN by a firewall. \u00a0The firewall is configured like firewalls often are: to perform NAT\/PAT on traffic passing from \u201cinside\u201d to \u201coutside.\u201d Bringing the IPSEC VPN concept into this network, the goal is to create a tunnel between the two firewalls that will allow traffic between the sites to be securely tunneled across the WAN. This would then provide a network path for hosts on Site 1\u2019s YELLOW and BLUE networks to reach the hosts on Site 2\u2019s PURPLE network. Just to let you know\u2026 the focus of this post is NOT on the configuration required to set up the network or the IPSEC tunnel itself. Instead, we will look at the process that happens to establish and build the connections when relevant traffic arrives at the firewall and initiates the IPSEC process. If you\u2019d like to see the configurations in this setup, I have posted a CML topology file for this network in the CML Community on GitHub. If you\u2019d like to dive deeper and try some of this exploration yourself, download the file and run it on your CML server. Saying something \u201cinteresting\u201d Just because a VPN is configured on a firewall doesn\u2019t mean the tunnel will be established. Tunnels are established when they are needed and will eventually be torn down if left idle (without traffic passing through them) for long enough. A firewall determines what type of traffic should trigger the building of a VPN based on an access list that is associated with the IPSEC crypto map that defines the VPN. Let\u2019s take a look at the access list on Site1-FW that defines this \u201cinteresting traffic.\u201d Site1-FW# show access-list s2svpn_to_site2  access-list s2svpn_to_site2; 2 elements; name hash: 0xa681e779 access-list s2svpn_to_site2 line 1 extended permit ip object-group SITE1 object-group SITE2 log default (hitcnt=0) 0xb520aee6  access-list s2svpn_to_site2 line 1 extended permit ip 192.168.200.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xfab888fb  access-list s2svpn_to_site2 line 1 extended permit ip 192.168.100.0 255.255.255.0 172.16.10.0 255.255.255.0 log default (hitcnt=0) 0xb7b04209  Site1-FW# show run crypto map \u202fYouTube Use #CiscoU\u00a0and\u00a0#CiscoCert\u202fto join the conversation. Read next: Exploring Default Docker Networking [Part 1] by Hank Preston Share Share: \u00a0\u00a0Explore the IPSEC VPN tunnel creation process, including \"Phase 1\" and \"Phase 2,\" how Security Associations are impacted when ACLs identify \"interesting traffic,\" and even the packets involved in the communications.\u00a0\u00a0Read More\u00a0Cisco Blogs\u00a0","og_url":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/","og_site_name":"JHC","article_published_time":"2023-07-31T17:27:41+00:00","og_image":[{"width":1,"height":1,"url":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif","type":"image\/gif"}],"author":"webmaster","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Hank Preston","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#article","isPartOf":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/"},"author":{"name":"webmaster","@id":"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/fd5c1bc5f9cf48ea7dd11f1c36681713"},"headline":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm","datePublished":"2023-07-31T17:27:41+00:00","dateModified":"2023-07-31T17:27:41+00:00","mainEntityOfPage":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/"},"wordCount":1317,"commentCount":0,"publisher":{"@id":"https:\/\/jacksonholdingcompany.com\/#organization"},"image":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage"},"thumbnailUrl":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif","articleSection":["Cisco: Learning"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/","url":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/","name":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm - JHC","isPartOf":{"@id":"https:\/\/jacksonholdingcompany.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage"},"image":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage"},"thumbnailUrl":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif","datePublished":"2023-07-31T17:27:41+00:00","dateModified":"2023-07-31T17:27:41+00:00","breadcrumb":{"@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#primaryimage","url":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif","contentUrl":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/16274101-LWfqFr.gif","width":1,"height":1},{"@type":"BreadcrumbList","@id":"https:\/\/jacksonholdingcompany.com\/a-technical-look-at-ipsec-vpn-tunnel-creation-hank-preston-on-july-28-2023-at-602-pm\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jacksonholdingcompany.com\/"},{"@type":"ListItem","position":2,"name":"A Technical Look at IPSEC VPN Tunnel Creation Hank Preston on July 28, 2023 at 6:02 pm"}]},{"@type":"WebSite","@id":"https:\/\/jacksonholdingcompany.com\/#website","url":"https:\/\/jacksonholdingcompany.com\/","name":"JHC","description":"Your Business Is Our Business","publisher":{"@id":"https:\/\/jacksonholdingcompany.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jacksonholdingcompany.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jacksonholdingcompany.com\/#organization","name":"JHC","url":"https:\/\/jacksonholdingcompany.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jacksonholdingcompany.com\/#\/schema\/logo\/image\/","url":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/cropped-cropped-jHC-white-500-\u00d7-200-px-1-1.png","contentUrl":"https:\/\/jacksonholdingcompany.com\/wp-content\/uploads\/2023\/07\/cropped-cropped-jHC-white-500-\u00d7-200-px-1-1.png","width":452,"height":149,"caption":"JHC"},"image":{"@id":"https:\/\/jacksonholdingcompany.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/fd5c1bc5f9cf48ea7dd11f1c36681713","name":"webmaster","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jacksonholdingcompany.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/911695a544af2e1fa85dfa9007bba0e3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/911695a544af2e1fa85dfa9007bba0e3?s=96&d=mm&r=g","caption":"webmaster"},"sameAs":["https:\/\/jacksonholdingcompany.com"],"url":"https:\/\/feedpress.me\/link\/23532\/16274101\/a-technical-look-at-ipsec-vpn-tunnel-creation"}]}},"_links":{"self":[{"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/posts\/482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/comments?post=482"}],"version-history":[{"count":0,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/posts\/482\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/media\/276"}],"wp:attachment":[{"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/media?parent=482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/categories?post=482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jacksonholdingcompany.com\/wp-json\/wp\/v2\/tags?post=482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}